documentation_complete: true

title: 'Record Events that Modify the System''s Discretionary Access Controls'

description: |-
    At a minimum, the audit system should collect file permission
    changes for all users and root. Note that the "-F arch=b32" lines should be
    present even on a 64 bit system. These commands identify system calls for
    auditing. Even if the system is 64 bit it can still execute 32 bit system
    calls. Additionally, these rules can be configured in a number of ways while
    still achieving the desired effect. An example of this is that the "-S" calls
    could be split up and placed on separate lines, however, this is less efficient.
    Add the following to <tt>/etc/audit/audit.rules</tt>:
{{% if product in ["fedora", "rhel10"] %}}
    <pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
{{% else %}}
    <pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
{{% endif %}}
        -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
        -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
    If your system is 64 bit then these lines should be duplicated and the
    arch=b32 replaced with arch=b64 as follows:
{{% if product in ["fedora", "rhel10"] %}}
    <pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
{{% else %}}
    <pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
{{% endif %}}
        -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
        -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>