mediumauditverified ✓✓rollback-safe
Audit ownership changes (Ubuntu)
audit-syscall-perm-mod-chown · UBUNTU ≥ 22 · 1 impl
Description
The system must generate an audit record for ownership changes so that the responsible user can be identified.
Rationale
Auditing these system calls supports detection of unauthorized changes and forensic reconstruction of events.
Check → Remediate
Checkaudit_rule_exists
- rule:
- -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng
Remediateaudit_rule_set
- rule:
- -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_chng
- persist_file:
- /etc/audit/rules.d/50-syscall-perm-mod-chown.rules
Framework references
STIG
V-270785 / UBTU-24-900140V-260634 / UBTU-22-654160
NIST 800-53
AU-2AU-12
Live verification
ubuntu22:checkubuntu24:checkubuntu24:full
#audit#auditd#syscall