<def-group>
  <definition class="compliance" id="audit_rules_dac_modification_lchown" version="1">
    <metadata>
      <title>Audit Discretionary Access Control Modification Events - lchown</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>The changing of file permissions and attributes should be 
      audited.</description>
    </metadata>
    <!-- x32 system calls are monitored and ... -->
    <criteria operator="AND">
      <criterion comment="dac modification lchown x32" 
      test_ref="test_audit_rules_dac_modification_lchown_x32" />
      <!-- system is not x64 or x64 system calls are monitored  -->
      <criteria operator="OR">
        <extend_definition comment="x64?" 
        definition_ref="system_info_architecture_x86_64" negate="true" />
        <criterion comment="dac modification lchown x64" 
        test_ref="test_audit_rules_dac_modification_lchown_x64" />
      </criteria>
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all" comment="dac modification lchown x32" 
  id="test_audit_rules_dac_modification_lchown_x32" version="1">
    <ind:object object_ref="object_audit_rules_dac_modification_lchown_x32" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object 
  id="object_audit_rules_dac_modification_lchown_x32" version="1">
    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
    <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch.  Remember that we can still have x32 libs on x64
         Watch for the lchown syscall.  
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
    <ind:pattern
    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" comment="dac modification lchown x64" 
  id="test_audit_rules_dac_modification_lchown_x64" version="1">
    <ind:object object_ref="object_audit_rules_dac_modification_lchown_x64" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object 
  id="object_audit_rules_dac_modification_lchown_x64" version="1">
    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
    <!-- What's going on here?
         Ensure we have both exit and always in the action list
         Syscall numbers between x64/x32 dont always line up so split them by 
           arch. Remember that we can still have x32 libs on x64 
         Watch for the lchown syscall.  
         Assume user id's start above 500 and watch for lchowns by them
         Watch for lchowns by users without a set loginuid (4294967295/-1)
         Ensure that a key is defined for it but we aren't especially concerned 
           with what it is
         Some regex foo to account for various ways this could be defined.

         A typical pattern would be: 
         -a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perms
    -->
    <ind:pattern
    operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid>=500[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
