documentation_complete: true

prodtype: rhel7,fedora

title: 'Record Events that Modify the System''s Discretionary Access Controls - setxattr'

description: |-
    At a minimum, the audit system should collect file permission
    changes for all users and root. If the <tt>auditd</tt> daemon is configured
    to use the <tt>augenrules</tt> program to read audit rules during daemon
    startup (the default), add the following line to a file with suffix
    <tt>.rules</tt> in the directory <tt>/etc/audit/rules.d</tt>:
    <pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -F key=perm_mod</pre>
    If the system is 64 bit then also add the following line:
    <pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -F key=perm_mod</pre>
    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
    utility to read audit rules during daemon startup, add the following line to
    <tt>/etc/audit/audit.rules</tt> file:
    <pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -F key=perm_mod</pre>
    If the system is 64 bit then also add the following line:
    <pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=4294967295 -F key=perm_mod</pre>

rationale: |-
    The changing of file permissions could indicate that a user is attempting to
    gain access to information that would otherwise be disallowed. Auditing DAC modifications
    can facilitate the identification of patterns of abuse among both authorized and
    unauthorized users.

severity: unknown

identifiers:
    cce@rhel7: 27213-8

references:
    cis: 5.2.10
    cjis: 5.4.1.1
    cui: 3.1.7
    disa: 126,172
    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
    nist: AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    ospp@rhel7: FAU_GEN.1.1.c
    pcidss: Req-10.5.5
    srg: SRG-OS-000064-GPOS-00033,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203
    stigid@rhel7: "030440"

ocil: '<audit-syscall-check-macro syscall="setxattr" />'
