Detections
Analytics
OL6-00-000185 - The audit system must be configured to audit all discretionary access control permission modifications using chown, fchown, fchownat, and lchown - b32 auid>=500
Information
The changing of file permissions could indicate that a user is attempting to gain access to information that would otherwise be disallowed. Auditing DAC modifications can facilitate the identification of patterns of abuse among both authorized and unauthorized users.The system call rules are loaded into a matching engine that intercepts each syscall made by all programs on the system. Therefore, it is very important to use syscall rules only when absolutely necessary, since these affect performance. The more rules, the bigger the performance hit. The performance can be helped, however, by combining syscalls into one rule whenever possible.
Solution
At a minimum, the audit system should collect file permission changes for all users and root. Add the following to '/etc/audit/audit.rules':-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid=0 -k perm_mod
If the system is 64-bit, then also add the following:
-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid=0 -k perm_mod
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_6_V2R7_STIG.zip
Item Details
Audit Name: DISA STIG Oracle Linux 6 v2r7
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-12c., CAT|III, CCI|CCI-000172, Rule-ID|SV-208894r810468_rule, STIG-ID|OL6-00-000185, STIG-Legacy|SV-65377, STIG-Legacy|V-51167, Vuln-ID|V-208894
Plugin: Unix
Control ID: 175fd683f21d6365eb8536b1866eabe8d4a72c90dd4d4066b8fd6200bb34721e