# Ensure unsuccessful file access attempts are collected

Necessity: Monitoring unsuccessful file access attempts is critical for detecting potential security breaches. These events can indicate an attacker attempting to access sensitive files, enumerate system file permissions, or execute unauthorized actions. Failure to log these attempts creates a significant blind spot for intrusion detection systems and forensic analysis, allowing malicious activity to go unnoticed. Auditing and Remediation: The audit script verifies that the Linux audit framework (`auditd`) is configured with specific rules to create a log event whenever a file access syscall fails with a 'Permission denied' (EACCES) or 'Operation not permitted' (EPERM) error. The remediation script adds these precise rules to the auditd configuration, ensuring that such attempts are captured for review. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'enabled'. This is a foundational security control with no practical downside. Basic security requires this logging to meet compliance standards like the CIS Benchmarks. For Moderate and Strict environments, this logging is non-negotiable, as the data it produces is essential for active threat hunting and incident response. There is no less-secure 'level' for this control; it should always be active in any security-conscious environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if auditd rules are configured to log unsuccessful file access attempts. The script must inspect the running auditd configuration or the rules files in `/etc/audit/rules.d/` for rules that audit the `creat`, `open`, `openat`, `truncate`, and `ftruncate` syscalls for `exit=-EACCES` and `exit=-EPERM` on both 32-bit and 64-bit architectures. The script must output only `true` if all required rules are present, and `false` otherwise.

## Remediation Script Working

bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add the necessary rules to a file in `/etc/audit/rules.d/` to log unsuccessful file access attempts (EACCES and EPERM) for key file access syscalls on both architectures, then reload the auditd rules. If the argument is 'disabled', it must remove these specific rules. The script must return `true` on success and `false` on failure.

