# Ensure successful and unsuccessful attempts to use the chacl command are collected

Necessity: Auditing the use of the 'chacl' command is crucial for security as it is used to modify file and directory Access Control Lists (ACLs). Unauthorized or malicious use of this command can lead to privilege escalation, denial of service, or unauthorized data access by altering critical system file permissions. Failing to log its usage creates a significant blind spot in system security, preventing administrators from detecting and investigating potential security breaches related to permission changes.

Auditing and Remediation: The audit script verifies that the system's audit daemon (auditd) is configured to log every successful and unsuccessful attempt to execute the '/usr/bin/chacl' command. The remediation script adds the necessary rule to the auditd configuration, ensuring that all executions are recorded with the key 'perm_mod' for easy identification and analysis. This makes the rule persistent across system reboots.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'present' because this is a binary control; it is either enabled or not. 
- Basic: Establishing a baseline of security requires monitoring all changes to file permissions. This is a fundamental control for accountability and intrusion detection.
- Moderate: For environments with heightened security requirements, this control remains essential. There is no less-secure-but-acceptable alternative to logging these events.
- Strict: In high-security and regulated environments, complete and non-negotiable logging of all permission modifications is mandatory for forensic investigation and compliance with standards like CIS Benchmarks. Therefore, the rule must be present.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the loaded auditd rules for a rule that audits execute permissions (-p x) for the path /usr/bin/chacl. The script must output 'present' if such a rule is found and 'absent' otherwise. The output must not contain any other text, labels, or formatting.

## Remediation Script Working

Bash script that accepts one positional argument: 'present' or 'absent'. If the argument is 'present', the script must add the rule '-w /usr/bin/chacl -p x -k perm_mod' to the auditd rules configuration (e.g., /etc/audit/rules.d/50-perm_mod.rules) and reload the rules. If 'absent', it should remove the rule. The script must return 'true' on success and 'false' on failure.

