# Ensure discretionary access control permission modification events are collected

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

"Create a Bash script that checks if auditd is configured to collect discretionary access control (DAC) permission modification events. The script must inspect the output of `auditctl -l` to verify that rules exist for the `chmod`, `fchmod`, `fchmodat`, `chown`, `fchown`, `fchownat`, `lchown`, `setxattr`, `lsetxattr`, `fsetxattr`, `removexattr`, `lremovexattr`, and `fremovexattr` syscalls for both 32-bit and 64-bit architectures, filtering for user IDs greater than or equal to 1000. The script must return only 'enabled' if all required rules are present or 'disabled' if any are missing, with no additional text."

## Remediation Script Working

"Create a Bash script that configures auditd rules to collect DAC permission modification events. The script must accept a single positional command-line argument: 'enabled'. If the argument is 'enabled', it will append the required rules for the `chmod`, `chown`, `setxattr` syscall families to a new or existing file in `/etc/audit/rules.d/`. After adding the rules, the script must execute `augenrules --load` to apply the changes. The script must return `true` on success and `false` on failure."

