documentation_complete: true

title: 'Record Events that Modify the System''s Discretionary Access Controls'

description: "At a minimum, the audit system should collect file permission \nchanges for all users and root.  Note that the \"-F arch=b32\" lines should be \npresent even on a 64 bit system.  These commands identify system calls for \nauditing.  Even if the system is 64 bit it can still execute 32 bit system \ncalls.  Additionally, these rules can be configured in a number of ways while \nstill achieving the desired effect.  An example of this is that the \"-S\" calls \ncould be split up and placed on separate lines, however, this is less efficient.\nAdd the following to <tt>/etc/audit/audit.rules</tt>:\n<pre>-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid&gt;=500 -F auid!=4294967295 -k perm_mod\n    -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=500 -F auid!=4294967295 -k perm_mod\n    -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 -k perm_mod</pre>\n\
    If your system is 64 bit then these lines should be duplicated and the \narch=b32 replaced with arch=b64 as follows:\n<pre>-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid&gt;=500 -F auid!=4294967295 -k perm_mod\n    -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid&gt;=500 -F auid!=4294967295 -k perm_mod\n    -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid&gt;=500 -F auid!=4294967295 -k perm_mod</pre>"
