cis-ubuntu1804-v220-5-2-3-9

name	cis-ubuntu1804-v220-5-2-3-9
version	2.2.0
date_published	"2024-01-01T00:00:00.000Z"
category	cis-logging
description	Ensure discretionary access control permission modification events are collected
author	CIS Benchmarks
tags	["cis","ubuntu","linux","ubuntu-18.04","auditing","auditd"]
target	{"platform":"linux","version":"18.04"}
severity_boost	{}

5.2.3.9 Ensure discretionary access control permission modification events are collected

Profile Applicability

• Level 2 - Server
• Level 2 - Workstation

Description

Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls effect the permissions, ownership and various attributes of files:

• chmod
• fchmod
• fchmodat
• chown
• fchown
• fchownat
• lchown
• setxattr
• lsetxattr
• fsetxattr
• removexattr
• lremovexattr
• fremovexattr

In all cases, an audit record will only be written for non-system user ids and will ignore Daemon events. All audit records will be tagged with the identifier "perm_mod."

Rationale

Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.

Audit

Run the following commands to check on disk configuration and loaded rules. The output for both commands should be the same.

On disk configuration

awk '/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/chmod/ \
 ||/fchmod/ \
 ||/fchmodat/ \
 ||/chown/ \
 ||/fchown/ \
 ||/fchownat/ \
 ||/lchown/ \
 ||/setxattr/ \
 ||/lsetxattr/ \
 ||/fsetxattr/ \
 ||/removexattr/ \
 ||/lremovexattr/ \
 ||/fremovexattr/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/' /etc/audit/rules.d/*.rules

Running configuration

auditctl -l | awk '/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \
&&/ -S/ \
&&(/chmod/ \
 ||/fchmod/ \
 ||/fchmodat/ \
 ||/chown/ \
 ||/fchown/ \
 ||/fchownat/ \
 ||/lchown/ \
 ||/setxattr/ \
 ||/lsetxattr/ \
 ||/fsetxattr/ \
 ||/removexattr/ \
 ||/lremovexattr/ \
 ||/fremovexattr/) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/'

Verify the output for both includes similar rules for 32 and 64 bit architecture for each of the system calls.