# Ensure audit tools owner is configured

Necessity: The audit tools (`auditctl`, `auditd`, etc.) are critical components for system security monitoring and forensic analysis. They control the kernel's audit framework. If an unauthorized user gains ownership of these files, they could modify or replace them with malicious versions. This could lead to the complete disabling of the audit system, manipulation of audit logs to hide malicious activity, or privilege escalation, rendering the system's security monitoring capabilities useless. The risk is a total loss of system integrity and accountability. 

Auditing and Remediation: The audit script systematically verifies the ownership of each critical audit binary, ensuring it is set to the `root` user. The remediation script uses the `chown` command to authoritatively reset the ownership of these files to `root`, correcting any unauthorized changes. 

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is consistently `['root']`. There is no acceptable level of deviation for this control. The audit system operates with high privileges to monitor all system activity, and its binaries must be protected from any form of tampering. Any owner other than `root` presents a critical security flaw. Therefore, the principle of least privilege dictates that only the superuser can own these files, and this standard is non-negotiable across all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that iterates through the following files: `/sbin/auditctl`, `/sbin/aureport`, `/sbin/ausearch`, `/sbin/autrace`, `/sbin/auditd`, `/sbin/audispd`, and `/sbin/augenrules`. The script must check the owner of each file. If any file is not owned by `root`, the script must immediately output the owner's username for that file and exit. If all files are owned by `root`, the script must output the string `root`.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired owner username. The script must use the `chown` command to set the ownership of the following files to the provided username: `/sbin/auditctl`, `/sbin/aureport`, `/sbin/ausearch`, `/sbin/autrace`, `/sbin/auditd`, `/sbin/audispd`, and `/sbin/augenrules`. The script must output `true` upon successful completion of all ownership changes, or `false` if any change fails.

