# Ensure audit configuration files mode is configured

Necessity: The auditd configuration files, located in `/etc/audit/`, define what system events are logged. Protecting these files from unauthorized modification is critical to maintaining the integrity of the system's audit trail. If an attacker can modify these files, they could disable specific audit rules to hide their malicious activities, stop the audit service entirely, or alter logging parameters, rendering forensic analysis impossible and blinding security monitoring tools. Misconfiguration risks a complete loss of accountability and visibility on the system. 

Auditing and Remediation: The audit script systematically checks the file permissions (mode) for every file in the `/etc/audit/` directory, confirming they align with security policies. The remediation script uses the `chmod` command to enforce the specified secure permissions on these files, effectively locking them down against unauthorized access. 

Recommended State Rationale: 
- Basic: `['0640']` sets read/write permissions for the owner (root) and read-only for the group. This is the widely accepted baseline (e.g., in CIS benchmarks) that prevents modification by non-privileged users while allowing administrative tools or users in the root group to read the configuration. 
- Moderate: `['0600']` increases security by removing read access for the group. This configuration ensures that only the root user can read or write the files, adhering strictly to the principle of least privilege. 
- Strict: `['0600']` is also the strictest recommendation because it provides the most secure practical file mode. Any further hardening, such as making files immutable, is an operational decision that goes beyond standard permission settings and can complicate administrative updates.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0600']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat` command to find all files within the `/etc/audit/` directory and its subdirectories. For each file, the script should retrieve its permissions in octal format (e.g., '640'). The script must return a JSON object where keys are the file paths and values are their corresponding octal permission strings.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired file mode in octal format (e.g., '640'). The script must use the `find` and `chmod` commands to recursively apply this mode to all configuration files within the `/etc/audit/` directory. The script must return 'true' on successful application of permissions and 'false' if an error occurs.

