# Ensure the running and on disk configuration is the same

Necessity: It is critical that the running auditd configuration matches the on-disk configuration stored in '/etc/audit/rules.d/'. A mismatch indicates that the currently enforced security auditing rules are different from what is intended to be persistent across reboots. This discrepancy can occur due to manual, temporary changes or, more maliciously, an attacker altering the running configuration to evade detection without leaving a persistent trace. Ensuring they are synchronized guarantees that the intended audit policies are active and will be correctly re-applied after a system restart, maintaining the integrity of the security monitoring framework.

Auditing and Remediation: The audit script uses the 'augencmp' utility to perform a direct comparison between the audit rules currently loaded in the kernel and the rule files on disk. It reports 'same' if they match and 'different' if there is any discrepancy. The remediation script uses the 'augenrules --load' command, which compiles the rules from the '/etc/audit/rules.d/' directory and loads them into the kernel, effectively overwriting the running configuration to match the persistent on-disk files.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'same'. This is a binary security condition with no acceptable intermediate state. A desynchronized configuration represents a failure in the system's audit integrity. Any deviation from the defined, persistent policy is a security risk, regardless of the overall hardening level. Therefore, the only acceptable state is for the running and on-disk configurations to be identical.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['same']` |
| **Moderate** | `['same']` |
| **Strict** | `['same']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes 'augencmp --check'. The script must check the exit code of this command. If the exit code is 0, the script should output the string 'same'. If the exit code is non-zero, it should output 'different'. The script must not produce any other text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which will be the desired state. If the argument is the string 'same', the script should execute 'augenrules --load'. The script must then check the exit code of the 'augenrules' command and output 'true' for success (exit code 0) or 'false' for failure (any other exit code).

