# Ensure successful file system mounts are collected

Necessity: Auditing successful file system mount events is crucial for security monitoring and system integrity. It allows administrators to track when and by whom file systems are attached to the system. This is vital for detecting unauthorized access, such as the mounting of a malicious USB drive or an external file system containing malware, which could be used to exfiltrate data or compromise the host. Failure to log these events creates a significant blind spot in the system's audit trail, hindering forensic analysis during an incident investigation.

Auditing and Remediation: The audit script inspects the currently loaded `auditd` rules via `auditctl` to verify that rules exist to watch for the 'mount' syscall on both 32-bit and 64-bit architectures. The remediation script adds (or removes) a dedicated rule file in `/etc/audit/rules.d/` to ensure this logging is persistent across reboots and then reloads the audit daemon to apply the change immediately.

Recommended State Rationale: 
- Basic: ['Enabled']. This is the fundamental recommendation based on CIS Benchmarks. Enabling this rule provides an essential audit trail for system configuration changes, which is a core requirement for any secure environment.
- Moderate: ['Enabled']. For a moderately hardened system, this logging is non-negotiable. There is no intermediate state; the visibility provided by this rule is essential for maintaining security posture and compliance.
- Strict: ['Enabled']. In a strict security environment, comprehensive and immutable logging is paramount. This rule must be enabled to ensure a complete and verifiable record of all system modifications, which is critical for high-security systems and for meeting stringent regulatory requirements.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses `auditctl -l` to list all loaded audit rules. The script must then filter this list to count how many rules match the pattern for auditing successful 'mount' syscalls for both 32-bit and 64-bit architectures (`-S mount`). The script must output only the integer count of matching rules found.

## Remediation Script Working

Bash script that accepts a single argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must create or update a rule file in `/etc/audit/rules.d/` with the lines `-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts` and `-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k mounts`. If the argument is 'Disabled', it must remove this specific rule file. After modifying the file, the script must reload the auditd rules using `augenrules --load`. The script must output `true` on success and `false` on failure.

