All,
I've been running in compliance with this rule for quite some time now and I'm noticing that the amount of noise that it produces is simply outrageous.
The suggestion is:
At a minimum the audit system should collect file permission changes for
all users and root. Add the following to "/etc/audit/audit.rules":
-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
If the system is 64 bit then also add the following:
-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \
-k perm_mod
And here is the output of a normal workstation over about a week of auditing and normal usage: