# Ensure successful file system mounts are collected

Necessity: Auditing successful file system mounts is crucial for security monitoring. It provides a trail for tracking when new file systems, such as USB drives, network shares, or disk images, are attached to the system. This is vital for detecting unauthorized access, potential data exfiltration, or the introduction of malicious media. Failure to log these events creates a significant blind spot, hindering forensic investigations and real-time threat detection.

Auditing and Remediation: The audit script inspects the running `auditd` configuration to verify that rules exist to capture successful `mount` syscalls for both 32-bit and 64-bit architectures. The remediation script adds these specific rules to the persistent `auditd` configuration, typically in a file under `/etc/audit/rules.d/`, ensuring that monitoring for this activity survives a system reboot.

Recommended State Rationale: 
- Basic: The recommended state is `'Present'`. This is the fundamental requirement to establish an audit trail for system changes, aligning with security benchmarks like CIS. 
- Moderate & Strict: These levels also require the state to be `'Present'`. For this particular control, the configuration is binary; the rule is either active or it is not. There is no intermediate or stricter configuration. The presence of the rule is the only acceptable state for any level of security hardening as it provides an essential security logging capability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Present']` |
| **Moderate** | `['Present']` |
| **Strict** | `['Present']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `auditd` rules to determine if a rule for collecting successful file system mounts exists. The script should use `auditctl -l` to list the current rules and check for the presence of a rule containing `-S mount` and an identifying key (e.g., `-k mounts`). The script must return only `'Present'` if the rule is found, or `'Absent'` if it is not.

## Remediation Script Working

Bash script that accepts one argument: `'Present'`. If the argument is `'Present'`, the script must ensure that the `auditd` rules for logging successful file system mounts are configured. It should add the lines `-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts` and `-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts` to a rule file in `/etc/audit/rules.d/` if they do not already exist, and then reload the rules. The script must return `true` upon successful addition of the rules or if they already exist, and `false` otherwise.

