# Ensure actions as another user are always logged

Necessity: The 'setuid' and 'setgid' system calls allow a program to run with the privileges of its owner or group, respectively, rather than the user who executed it. Attackers frequently exploit vulnerabilities in SUID/SGID executables to escalate privileges. Logging these system calls is critical for security monitoring as it creates an audit trail of every attempt by a user process to change its identity. This log is invaluable for detecting and investigating unauthorized privilege escalation and other malicious activities.

Auditing and Remediation: The audit script inspects the currently active auditd rule set to confirm that rules are in place to monitor all 'setuid' and 'setgid' events initiated by authenticated users (auid>=1000). The remediation script directly modifies the auditd rule configuration on disk, adding the necessary rules to a persistent file and then instructing the audit daemon to reload its configuration, thereby activating the new monitoring rules.

Recommended State Rationale:
- Basic: ['enabled']. This is the minimum acceptable state. Failing to log identity changes leaves a significant gap in security visibility, making it difficult to trace the actions of an attacker after an initial compromise.
- Moderate: ['enabled']. This state is identical to Basic because the control is binary; it is either on or off. This level ensures compliance with industry best practices and security frameworks such as the CIS Benchmarks, which mandate logging of privilege escalation events.
- Strict: ['enabled']. In a high-security environment, this control is non-negotiable. The forensic data generated is essential for incident response, threat hunting, and proving compliance with rigorous regulatory standards. The strict recommendation is to ensure these rules are always active and continuously monitored for tampering.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for 'setuid' and 'setgid' are loaded. The script should query the currently loaded audit rules using 'auditctl -l' and use 'grep' to verify the presence of rules that audit the 'setuid' and 'setgid' syscalls for both 32-bit and 64-bit architectures. The script must output only 'true' if the rules exist, and 'false' otherwise.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script should add the following rules to a file in '/etc/audit/rules.d/', such as '50-identity.rules': '-a always,exit -F arch=b64 -S setuid -S setgid -F auid>=1000 -F auid!=-1 -F key=identity' and '-a always,exit -F arch=b32 -S setuid -S setgid -F auid>=1000 -F auid!=-1 -F key=identity'. It should then reload the auditd rules using 'augenrules --load'. If the argument is 'disabled', it should remove these specific rules. The script must output 'true' on success and 'false' on failure.

