mediumauditverified ✓✓rollback-safe
Audit permission changes (Ubuntu)
audit-syscall-perm-mod-chmod · UBUNTU ≥ 22 · 1 impl
Description
The system must generate an audit record for permission changes so that the responsible user can be identified.
Rationale
Auditing these system calls supports detection of unauthorized changes and forensic reconstruction of events.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng
Remediateaudit_rule_set
- rule:
- -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_chng
- persist_file:
- /etc/audit/rules.d/50-syscall-perm-mod-chmod.rules
Framework references
STIG
V-270786 / UBTU-24-900150V-260633 / UBTU-22-654155
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:full
#audit#auditd#syscall