# Ensure Audit Logging of Discretionary Access Control Permission Modifications

- Source: https://support.icompaas.com/support/solutions/articles/62000234898-ensure-audit-logging-of-discretionary-access-control-permission-modifications
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: **• Level 2**

Description:  
 Discretionary Access Control (DAC) permission modifications involve changes to file or directory permissions that control user and group access. Collecting audit logs of these changes helps detect unauthorized or malicious permission alterations.

Rationale:  
 Monitoring permission changes supports security by ensuring that access controls remain intact and unauthorized modifications are quickly identified.

Impact:  
 Pros:

-   Provides visibility into changes affecting file and directory permissions.  
    
-   Helps prevent privilege escalation and unauthorized data access.  
    

Cons:

-   May produce a large volume of audit logs; requires effective log management.  
    

Default Value:  
 Audit rules for permission modifications may not be enabled by default.

Pre-requisites:

-   Root or sudo privileges to configure audit rules.  
    

Remediation:

### Test Plan:

Using Linux command line:

Check existing audit rules for DAC permission changes:

auditctl -l | grep chmod

1.  Verify audit rules exist for system calls like chmod, fchmod, fchmodat.  
    

### Implementation Plan:

Using Linux command line:

Add audit rules to log DAC permission modifications:

auditctl -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm\_mod  
auditctl -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -k perm\_mod

1.  Persist these rules by adding them to /etc/audit/rules.d/audit.rules.  
    

### Backout Plan:

Using Linux command line:

Remove or disable permission modification audit rules if necessary:

auditctl -d always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm\_mod  
auditctl -d always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -k perm\_mod

1.  Reload audit daemon configuration.  
    

References:

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   [Linux Audit Framework  
    ](https://linux-audit.com/)
    
-   [NIST SP 800-53 Revision 5 - AU-6  
      
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#au-6)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.