# Ensure separate partition exists for /var/log/audit

The necessity of placing `/var/log/audit` on a separate partition is a critical security measure to ensure the integrity and availability of audit logs. It primarily mitigates the risk of a Denial-of-Service (DoS) attack where an attacker or a malfunctioning process could fill the entire root or `/var` filesystem by generating excessive logs, potentially crashing the system. Isolating the audit logs on their own partition contains this risk, ensuring the logging service can continue to function and the core operating system remains stable. Furthermore, it allows for specific, hardened mount options (like `nodev`, `noexec`) to be applied to the audit log directory, reducing its attack surface. The audit script verifies this configuration by querying the system's mount points to see if `/var/log/audit` is listed as a distinct entry. The remediation process is complex, involving manual disk partitioning followed by a script that updates the filesystem table (`/etc/fstab`) to make the mount persistent across reboots. The recommended state at all levels (Basic, Moderate, and Strict) is 'mounted' because this is a foundational best practice (e.g., CIS Benchmark for RHEL/CentOS) with no intermediate state; the security benefits are only realized when the partition is fully separated.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['mounted']` |
| **Moderate** | `['mounted']` |
| **Strict** | `['mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if `/var/log/audit` is configured on a separate partition. The script must output only the string 'mounted' if it is a separate mount point, or 'not mounted' if it is not. No other text or formatting should be included in the output.

## Remediation Script Working

Remediation for this control is a multi-step process that requires manual intervention to provision a new partition. Therefore, write a Bash script that completes the configuration once a partition is available. The script must accept the block device path (e.g., /dev/sdb1) as a single positional command-line argument. It should then perform the following actions: add the appropriate entry to `/etc/fstab` to mount the device at `/var/log/audit`, create the mount point directory, move existing audit data, mount the new partition, and set correct permissions. The script must return `true` on success and `false` on failure.

