# Ensure auditing for processes that start prior to auditd is enabled

Necessity: The auditd service starts partway through the system boot process. Any processes or actions that occur before auditd is active will not be logged. Enabling auditing at the kernel level with the `audit=1` boot parameter ensures that all system activities, even those from the earliest stages of the boot process, are recorded. This mitigates the risk of early-boot malware or unauthorized configuration changes going undetected, which could compromise the entire system before standard logging services are operational. The primary risk of misconfiguration is a critical gap in the security audit trail.

Auditing and Remediation: The audit script directly inspects the currently running kernel's command-line parameters via `/proc/cmdline` to see if `audit=1` is active. The remediation script modifies the GRUB bootloader's default configuration file (`/etc/default/grub`) to permanently add or remove this parameter for all subsequent boots, applying the change by running `update-grub`.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict security levels is 'enabled'. This is a binary setting with no intermediate states. Basic security requires closing this fundamental logging gap, as recommended by CIS and other security benchmarks. Since there is no security benefit to disabling this feature on a system requiring a robust audit trail, and no 'more enabled' state exists, the Moderate and Strict levels also mandate that it be enabled to ensure a complete and unbroken record of system activity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the output of `cat /proc/cmdline` to determine if the `audit=1` kernel parameter is present. If it is found, the script must return the string 'enabled'. If it is not found, it must return 'disabled'. The output must only contain the state value with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add or ensure `audit=1` is present in the `GRUB_CMDLINE_LINUX` variable within the `/etc/default/grub` file and then execute `update-grub`. If the argument is 'disabled', it must remove the `audit=1` parameter from the same variable and update GRUB. The script must return `true` on successful modification and `false` on failure. Note that a system reboot is required for the change to take effect, but the script itself should not perform the reboot.

