# Ensure successful and unsuccessful attempts to use the setfacl command are collected

Necessity: The 'setfacl' command modifies file and directory Access Control Lists (ACLs), which are a critical component of filesystem security. An attacker or misconfigured process could use this command to escalate privileges, access sensitive data, or deny service by altering permissions. Auditing all successful and unsuccessful uses of 'setfacl' creates a definitive log of changes to filesystem permissions, which is crucial for detecting unauthorized activity and for forensic analysis during incident response.

Auditing and Remediation: The audit script checks if the system's audit daemon ('auditd') is configured to monitor for system calls related to the 'setfacl' command on both 32-bit and 64-bit architectures. The remediation script writes the specific rules required for this monitoring into the auditd permanent rule set, ensuring that any use of the command by a non-system user is logged with a unique key for easy filtering.

Recommended State Rationale: For this control, there is no value in a tiered approach. The 'setfacl' command poses a significant risk if misused. Therefore, for any level of security hardening—Basic, Moderate, or Strict—it is imperative that its usage is logged. Disabling this audit rule creates a critical visibility gap in system security monitoring. The only recommended state is 'Enabled' to ensure a complete and actionable audit trail is maintained for all permission modifications.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the auditd rules loaded into the kernel and within the persistent rule files (e.g., /etc/audit/rules.d/*.rules). The script must verify the existence of rules that log execution of the 'setfacl' command for both 32-bit and 64-bit architectures, specifically for user-initiated events (auid>=1000). The script must output only the string 'true' if compliant rules are found, and 'false' otherwise, with no extra text or labels.

## Remediation Script Working

shell script that accepts a single positional argument, which must be either 'enabled' or 'disabled'. If 'enabled', the script must add the following two rules to a persistent auditd rule file (e.g., /etc/audit/rules.d/permissions.rules): '-a always,exit -F arch=b64 -S setfacl -F auid>=1000 -F auid!=-1 -k perm_mod' and '-a always,exit -F arch=b32 -S setfacl -F auid>=1000 -F auid!=-1 -k perm_mod'. If 'disabled', it must remove these specific rules. The script must output only the boolean value 'true' upon successful modification or 'false' upon failure.

