Rules are added to auditd to log all DAC modifications using `lsetxattr`_.

.. _lsetxattr: http://linux.die.net/man/2/lsetxattr