In this lesson, you will learn how to verify that your system’s actual access controls align with your organization’s security policy by performing a comprehensive state audit.
Understanding Compliance Auditing
Auditing the system security state is the process of comparing your current configuration against a defined "Golden State." Even with robust access control models like MAC (Mandatory Access Control) or fine-grained POSIX capabilities, configuration drift occurs over time. An audit ensures that manual interventions or automated updates haven't weakened your defenses, such as an SUID bit being reapplied to a binary or an ACL being overly permissive on a sensitive directory.
Practical Verification
To conduct an audit, you must bridge the gap between "what we intended" and "what is actually running." This often involves creating a baseline of expected permissions and comparing them against the current filesystem and process state.
A simple way to verify access policy compliance is by using find to scan for files that violate your organizational policy. For example, if your policy mandates that no user-writable files should have the SUID bit set, you can run:
# Auditing for unauthorized SUID files in user home directories
find /home -type f -perm /4000 -ls
If this command returns any output, your audit has identified a security drift—a direct violation of your access control model.
Beyond permissions, you must verify the state of your security subsystems. Use systemctl or kernel audit tools to confirm that mandatory policies are actually loaded. For instance, if you rely on AppArmor or SELinux, an audit must verify their enforcement mode:
# Checking if the enforcement policy is currently active
getenforce
# OR
aa-status
If getenforce returns Permissive when your policy requires Enforcing, your system is in a non-compliant security state. Auditing isn't just about finding errors; it is the iterative process of reconciling your runtime environment with the formal security architecture you’ve designed. By regularly running these checks, you transform static security models into living, verifiable defenses.
Key Takeaway: Auditing system security state requires continuous validation to ensure that runtime configurations—such as file permissions and enforcement modes—strictly adhere to your defined organizational access policies.