# Ensure audit configuration files group owner is configured

The necessity of this control is to protect the integrity of the system's auditing configuration. The auditd service is critical for logging security-relevant events, and its configuration files dictate what is monitored. If a non-privileged user or group can modify these files, they could disable specific audit rules to hide malicious activity, alter log destinations, or even crash the audit service, rendering the system blind to attacks. The audit script checks the group ownership of the audit configuration files, while the remediation script sets it to the correct group, typically 'root'. All recommendation levels (Basic, Moderate, and Strict) mandate 'root' as the group owner. This is a foundational security setting with no permissible deviation, as allowing any other group introduces an unacceptable risk of tampering. This aligns with security benchmarks like CIS and STIG, which require these critical system files to be owned exclusively by the root user and group to ensure they cannot be altered by unauthorized principals.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the group owner of the auditd configuration directory '/etc/audit/'. The script must output only the group name of the directory (e.g., 'root') with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument for the desired group name. The script must recursively set the group ownership for the '/etc/audit/' directory and all its contents to the specified group name. The script must output 'true' on success and 'false' on failure.

