# Ensure successful and unsuccessful attempts to use the setfacl command are collected

Necessity: The 'setfacl' command is used to modify Access Control Lists (ACLs) on files and directories, which is a critical security function. Monitoring its usage is essential for detecting unauthorized changes to file system permissions. An attacker could use this command to escalate privileges or grant themselves access to sensitive data. Failing to audit 'setfacl' creates a significant blind spot in system security monitoring and complicates forensic investigations after a security incident.

Auditing and Remediation: The audit script inspects the live kernel audit rules using 'auditctl' to verify if a rule is configured to watch for write and attribute change access (-p wa) to the '/usr/bin/setfacl' executable. The remediation script adds this rule to the persistent audit configuration located in '/etc/audit/rules.d/', ensuring that monitoring of this command survives a system reboot. This provides a durable record of all attempts to change file ACLs.

Recommended State Rationale: 
Basic: ['Enabled']. This is the fundamental recommended state. Any system administrator needs to know when permissions are being altered on the file system. This is a baseline requirement for security and operational integrity.
Moderate: ['Enabled']. For a moderately hardened system, this setting remains essential. There is no less-secure 'enabled' state; the control is either on or off. Maintaining this audit rule is a standard practice for meeting compliance and security benchmarks.
Strict: ['Enabled']. In a strictly hardened environment, comprehensive and non-negotiable auditing of all security-critical commands is mandatory. Disabling this rule would be a direct violation of high-security principles, as it would allow a critical security mechanism to be altered without a trace.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the currently loaded auditd rules for a rule that monitors the 'setfacl' command. The script should specifically look for a rule matching the pattern '-w /usr/bin/setfacl -p wa'. If such a rule is found, the script must output the string 'Enabled'. If the rule is not found, it must output 'Disabled'. The output must contain only one of these two strings.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must add the rule '-w /usr/bin/setfacl -p wa -k perm_mod' to a persistent audit rules file (e.g., /etc/audit/rules.d/permissions.rules) and then load the rules to make it active. If the rule already exists, no changes should be made. If the argument is 'Disabled', the script must remove the specified rule from all audit rule files. The script must return 'true' upon successful modification or 'false' if it fails.

