# Ensure successful and unsuccessful attempts to use the chacl command are collected

Necessity: The 'chacl' command is used to modify Access Control Lists (ACLs) on files and directories, which are a critical component of file system security. Unauthorized or accidental changes to ACLs can lead to privilege escalation, data exposure, or denial of service. Auditing all successful and unsuccessful attempts to use 'chacl' provides a detailed record of who is attempting to change permissions, which is essential for detecting malicious activity, performing forensic analysis after a security incident, and ensuring compliance with security policies. Without this auditing, an attacker could alter permissions to gain unauthorized access without leaving a clear trail.

Auditing and Remediation: The audit script verifies the presence of specific rules within the '/etc/audit/rules.d/' directory. These rules instruct the Linux Auditing System (auditd) to create a log event every time the 'chacl' system call is invoked, for both 32-bit and 64-bit architectures. The remediation script adds these precise rules to a configuration file, ensuring that the auditd service will log these events upon its next rule reload. The rules are keyed with 'perm_mod' for easy filtering of audit logs.

Recommended State Rationale: This is a binary security control; the rule is either present and effective or it is not. Therefore, the recommended state for all security levels (Basic, Moderate, and Strict) is 'present'. There is no intermediate or partial configuration that provides meaningful security value. The presence of the rule ensures that all modifications to file and directory ACLs are logged, which is a foundational requirement for system integrity monitoring as recommended by security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the audit rules for the 'chacl' command exist and are correctly configured in '/etc/audit/rules.d/'. The script should grep for the lines '-a always,exit -F arch=b64 -S chacl -F auid>=1000 -F auid!=4294967295 -k perm_mod', '-a always,exit -F arch=b32 -S chacl -F auid>=1000 -F auid!=4294967295 -k perm_mod', '-a always,exit -F arch=b64 -S chacl -F auid=0 -k perm_mod', and '-a always,exit -F arch=b32 -S chacl -F auid=0 -k perm_mod'. It must return 'present' if all required rules are found, and 'absent' otherwise, with no other text.

## Remediation Script Working

Bash script that accepts one argument: 'present' or 'absent'. If the argument is 'present', the script must add the following lines to a file in '/etc/audit/rules.d/', such as '/etc/audit/rules.d/permissions.rules': '-a always,exit -F arch=b64 -S chacl -F auid>=1000 -F auid!=4294967295 -k perm_mod', '-a always,exit -F arch=b32 -S chacl -F auid>=1000 -F auid!=4294967295 -k perm_mod', '-a always,exit -F arch=b64 -S chacl -F auid=0 -k perm_mod', and '-a always,exit -F arch=b32 -S chacl -F auid=0 -k perm_mod'. If the argument is 'absent', it should remove these lines. The script must then reload the auditd rules. It must return 'true' on success and 'false' on failure.

