ComplianceAsCode · Mab879 · Apr 23, 2025 · Apr 15, 2025
diff --git a/components/audit.yml b/components/audit.yml
@@ -69,6 +69,7 @@ rules:
 - audit_rules_dac_modification_chown
 - audit_rules_dac_modification_fchmod
 - audit_rules_dac_modification_fchmodat
+- audit_rules_dac_modification_fchmodat2
 - audit_rules_dac_modification_fchown
 - audit_rules_dac_modification_fchownat
 - audit_rules_dac_modification_fremovexattr

diff --git a/controls/anssi.yml b/controls/anssi.yml
@@ -1511,6 +1511,7 @@ controls:
     - audit_rules_dac_modification_chown
     - audit_rules_dac_modification_fchmod
     - audit_rules_dac_modification_fchmodat
+    - audit_rules_dac_modification_fchmodat2
     - audit_rules_dac_modification_fchown
     - audit_rules_dac_modification_fchownat
     - audit_rules_dac_modification_fremovexattr

diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml
@@ -2559,6 +2559,7 @@ controls:
       - audit_rules_dac_modification_chown
       - audit_rules_dac_modification_fchmod
       - audit_rules_dac_modification_fchmodat
+      - audit_rules_dac_modification_fchmodat2
       - audit_rules_dac_modification_fchown
       - audit_rules_dac_modification_fchownat
       - audit_rules_dac_modification_fremovexattr

diff --git a/controls/hipaa.yml b/controls/hipaa.yml
@@ -56,6 +56,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -219,6 +220,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -415,6 +417,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -1145,6 +1148,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -1283,6 +1287,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -1451,6 +1456,7 @@ controls:
             - audit_rules_dac_modification_chown
                - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr
@@ -1548,6 +1554,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/pcidss_4.yml b/controls/pcidss_4.yml
@@ -2869,6 +2869,7 @@ controls:
         - audit_rules_dac_modification_chown
         - audit_rules_dac_modification_fchmod
         - audit_rules_dac_modification_fchmodat
+        - audit_rules_dac_modification_fchmodat2
         - audit_rules_dac_modification_fchown
         - audit_rules_dac_modification_fchownat
         - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml b/controls/srg_gpos/SRG-OS-000037-GPOS-00015.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml b/controls/srg_gpos/SRG-OS-000042-GPOS-00020.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml b/controls/srg_gpos/SRG-OS-000062-GPOS-00031.yml
@@ -10,6 +10,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000064-GPOS-00033.yml b/controls/srg_gpos/SRG-OS-000064-GPOS-00033.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml b/controls/srg_gpos/SRG-OS-000392-GPOS-00172.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml b/controls/srg_gpos/SRG-OS-000462-GPOS-00206.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml b/controls/srg_gpos/SRG-OS-000466-GPOS-00210.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml b/controls/srg_gpos/SRG-OS-000471-GPOS-00215.yml
@@ -9,6 +9,7 @@ controls:
             - audit_rules_dac_modification_chown
             - audit_rules_dac_modification_fchmod
             - audit_rules_dac_modification_fchmodat
+            - audit_rules_dac_modification_fchmodat2
             - audit_rules_dac_modification_fchown
             - audit_rules_dac_modification_fchownat
             - audit_rules_dac_modification_fremovexattr

diff --git a/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/...g/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml
@@ -85,3 +85,6 @@ template:
           - chmod
           - fchmod
           - fchmodat
+{{% if product == "rhel10" %}}
+          - fchmodat2
+{{% endif %}}
diff --git a/...ure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat2/policy/stig/shared.yml b/...ure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat2/policy/stig/shared.yml
@@ -0,0 +1,26 @@
+srg_requirement: |-
+     Successful/unsuccessful uses of the fchmodat2 system call in {{{ full_name }}} must generate an audit record.
+
+vuldiscussion: |-
+    The changing of file permissions could indicate that a user is attempting to
+    gain access to information that would otherwise be disallowed. Auditing DAC modifications
+    can facilitate the identification of patterns of abuse among both authorized and
+    unauthorized users.
+
+checktext: |-
+    To determine if the system is configured to audit calls to the
+     fchmodat2  system call, run the following command:
+     $ sudo grep "fchmodat2" /etc/audit/audit.*
+    If the system is configured to audit this activity, it will return a line.
+
+
+    If no line is returned, then this is a finding.
+
+fixtext: |-
+    Configure the audit system to generate an audit event for any successful/unsuccessful use of the "fchmodat2" system call by adding or updating the following rules in the "/etc/audit/rules.d/audit.rules" file:
+    -a always,exit -F arch=b32 -S fchmodat2 -F auid>={{{ uid_min }}} -F auid!=unset -k perm_mod
+    -a always,exit -F arch=b64 -S fchmodat2 -F auid>={{{ uid_min }}} -F auid!=unset -k perm_mod
+
+    It's allowed to group this system call within the same line as "chmod", "fchmod", "fchmodat" and "fchmodat2".
+
+    The audit daemon must be restarted for the changes to take effect.
diff --git a/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat2/rule.yml b/.../auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat2/rule.yml
@@ -0,0 +1,59 @@
+documentation_complete: true
+
+title: 'Record Events that Modify the System''s Discretionary Access Controls - fchmodat2'
+
+description: |-
+    At a minimum, the audit system should collect file permission
+    changes for all users and root. If the <tt>auditd</tt> daemon is configured to
+    use the <tt>augenrules</tt> program to read audit rules during daemon startup
+    (the default), add the following line to a file with suffix <tt>.rules</tt> in
+    the directory <tt>/etc/audit/rules.d</tt>:
+    <pre>-a always,exit -F arch=b32 -S fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
+    If the system is 64 bit then also add the following line:
+    <pre>-a always,exit -F arch=b64 -S fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
+    If the <tt>auditd</tt> daemon is configured to use the <tt>auditctl</tt>
+    utility to read audit rules during daemon startup, add the following line to
+    <tt>/etc/audit/audit.rules</tt> file:
+    <pre>-a always,exit -F arch=b32 -S fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
+    If the system is 64 bit then also add the following line:
+    <pre>-a always,exit -F arch=b64 -S fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
+
+rationale: |-
+    The changing of file permissions could indicate that a user is attempting to
+    gain access to information that would otherwise be disallowed. Auditing DAC modifications
+    can facilitate the identification of patterns of abuse among both authorized and
+    unauthorized users.
+
+severity: medium
+
+identifiers:
+    cce@rhel10: CCE-86535-2
+
+references:
+    disa: CCI-000172,CCI-000130,CCI-000135,CCI-000169,CCI-002884
+    hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3)(ii)(A),164.308(a)(5)(ii)(C),164.312(a)(2)(i),164.312(b),164.312(d),164.312(e)
+    srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-APP-000091-CTR-000160,SRG-APP-000492-CTR-001220,SRG-APP-000493-CTR-001225,SRG-APP-000494-CTR-001230,SRG-APP-000500-CTR-001260,SRG-APP-000507-CTR-001295,SRG-APP-000495-CTR-001235,SRG-APP-000499-CTR-001255
+
+{{{ complete_ocil_entry_audit_syscall(syscall="fchmodat2") }}}
+
+warnings:
+    - general: |-
+        Note that these rules can be configured in a
+        number of ways while still achieving the desired effect. Here the system calls
+        have been placed independent of other system calls. Grouping these system
+        calls with others as identifying earlier in this guide is more efficient.
+
+fixtext: |-
+    {{{ fixtext_audit_rules_dac_modification_chmod("fchmodat2") | indent(4) }}}
+
+srg_requirement: '{{{ srg_requirement_audit_syscall("fchmodat2") }}}'
+
+template:
+    name: audit_rules_dac_modification
+    vars:
+        attr: fchmodat2
+        syscall_grouping:
+          - chmod
+          - fchmod
+          - fchmodat
+          - fchmodat2
@@ -0,0 +1,3 @@
+---
+default_result: FAIL
+result_after_remediation: PASS
diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_dac_actions/group.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_dac_actions/group.yml
@@ -11,12 +11,20 @@ description: |-
     still achieving the desired effect. An example of this is that the "-S" calls
     could be split up and placed on separate lines, however, this is less efficient.
     Add the following to <tt>/etc/audit/audit.rules</tt>:
+{{% if product == "rhel10" %}}
+    <pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat,fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
+{{% else %}}
     <pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
+{{% endif %}}
         -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
         -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
     If your system is 64 bit then these lines should be duplicated and the
     arch=b32 replaced with arch=b64 as follows:
+{{% if product == "rhel10" %}}
+    <pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,fchmodat2 -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
+{{% else %}}
     <pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
+{{% endif %}}
         -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod
         -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;={{{ auid }}} -F auid!=unset -F key=perm_mod</pre>
 
diff --git a/products/alinux2/profiles/pci-dss.profile b/products/alinux2/profiles/pci-dss.profile
@@ -109,3 +109,4 @@ selections:
     - '!service_timesyncd_enabled'
     - '!package_cryptsetup-luks_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/alinux3/profiles/pci-dss.profile b/products/alinux3/profiles/pci-dss.profile
@@ -117,3 +117,4 @@ selections:
     - '!service_timesyncd_enabled'
     - '!package_cryptsetup-luks_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/almalinux9/profiles/anssi_bp28_enhanced.profile b/products/almalinux9/profiles/anssi_bp28_enhanced.profile
@@ -54,6 +54,7 @@ selections:
     - '!file_owner_efi_user_cfg'
     - '!file_permissions_efi_user_cfg'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

diff --git a/products/almalinux9/profiles/anssi_bp28_high.profile b/products/almalinux9/profiles/anssi_bp28_high.profile
@@ -51,6 +51,7 @@ selections:
     - '!ensure_redhat_gpgkey_installed'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

diff --git a/products/almalinux9/profiles/pci-dss.profile b/products/almalinux9/profiles/pci-dss.profile
@@ -69,3 +69,4 @@ selections:
     - '!ensure_shadow_group_empty'
     - '!service_timesyncd_enabled'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/anolis23/profiles/pci-dss.profile b/products/anolis23/profiles/pci-dss.profile
@@ -140,3 +140,4 @@ selections:
     - '!service_timesyncd_enabled'
     - '!package_cryptsetup-luks_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/anolis8/profiles/pci-dss.profile b/products/anolis8/profiles/pci-dss.profile
@@ -139,3 +139,4 @@ selections:
     - '!service_timesyncd_enabled'
     - '!package_cryptsetup-luks_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/debian12/profiles/anssi_bp28_enhanced.profile b/products/debian12/profiles/anssi_bp28_enhanced.profile
@@ -68,3 +68,4 @@ selections:
   - '!ensure_almalinux_gpgkey_installed'
   - '!package_dracut-fips-aesni_installed'
   - '!audit_rules_file_deletion_events_renameat2'
+  - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/debian12/profiles/anssi_bp28_high.profile b/products/debian12/profiles/anssi_bp28_high.profile
@@ -68,3 +68,4 @@ selections:
   - '!ensure_almalinux_gpgkey_installed'
   - '!package_dracut-fips-aesni_installed'
   - '!audit_rules_file_deletion_events_renameat2'
+  - '!audit_rules_dac_modification_fchmodat2'
@@ -49,3 +49,4 @@ selections:
     - '!grub2_pti_argument'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
@@ -75,3 +75,4 @@ selections:
     - '!grub2_pti_argument'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
@@ -41,6 +41,7 @@ selections:
     - '!grub2_page_alloc_shuffle_argument'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

@@ -42,6 +42,7 @@ selections:
     - '!grub2_page_alloc_shuffle_argument'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

@@ -49,6 +49,7 @@ selections:
     - '!aide_periodic_checking_systemd_timer'
     - '!package_cryptsetup-luks_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # Use Oracle gpgkey rule
     - '!ensure_redhat_gpgkey_installed'
     - '!ensure_suse_gpgkey_installed'

@@ -45,6 +45,7 @@ selections:
     - '!package_xinetd_removed'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # OL9 unified the paths for grub2 files. These rules are selected in control file by R29.
     - '!file_groupowner_efi_grub2_cfg'
     - '!file_owner_efi_grub2_cfg'

@@ -46,6 +46,7 @@ selections:
     - '!package_xinetd_removed'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # disable R45: Enable AppArmor security profiles
     - '!apparmor_configured'
     - '!all_apparmor_profiles_enforced'

@@ -60,6 +60,7 @@ selections:
     - '!ensure_shadow_group_empty'
     - '!service_timesyncd_enabled'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     # Not applicable to OL9, packages not available in OL9
     - '!package_cryptsetup-luks_installed'
     - '!service_rpcbind_disabled'

diff --git a/products/rhcos4/profiles/anssi_bp28_enhanced.profile b/products/rhcos4/profiles/anssi_bp28_enhanced.profile
@@ -119,3 +119,4 @@ selections:
     - '!ensure_oracle_gpgkey_installed'
     - '!ensure_almalinux_gpgkey_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
diff --git a/products/rhcos4/profiles/anssi_bp28_high.profile b/products/rhcos4/profiles/anssi_bp28_high.profile
@@ -155,3 +155,4 @@ selections:
     - '!ensure_oracle_gpgkey_installed'
     - '!ensure_almalinux_gpgkey_installed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
@@ -61,5 +61,6 @@ selections:
     - '!ensure_almalinux_gpgkey_installed'
     - '!package_kea_removed'
     - '!audit_rules_file_deletion_events_renameat2'
+    - '!audit_rules_dac_modification_fchmodat2'
     - '!package_rsh-server_removed'
     - '!package_rsh_removed'