MEDIUM M13: Extended DAC Audit P3
Overview
Extends the basic DAC (Discretionary Access Control) audit rules from M3 to cover additional syscalls for file permission and ownership changes. While M3 covers chmod and chown, this group adds variants like fchmod, fchown, setxattr, and their ālā (symlink-aware) counterparts.
Profile: NIST 800-53 Moderate (rhcos4-moderate)
Compliance Checks
| Check | Description |
|---|---|
fchmod |
Audit file permission changes via fchmod |
fchmodat |
Audit file permission changes via fchmodat |
fchown |
Audit file ownership changes via fchown |
fchownat |
Audit file ownership changes via fchownat |
fremovexattr |
Audit extended attribute removal via fremovexattr |
fsetxattr |
Audit extended attribute setting via fsetxattr |
lchown |
Audit symlink ownership changes via lchown |
lremovexattr |
Audit symlink extended attribute removal |
lsetxattr |
Audit symlink extended attribute setting |
removexattr |
Audit extended attribute removal via removexattr |
setxattr |
Audit extended attribute setting via setxattr |
Verification
oc debug node/<node> -- chroot /host auditctl -l | grep -E 'fchmod|fchown|xattr'