# Ensure the audit configuration is immutable

Necessity: Setting the audit configuration to immutable is a critical security control. If an attacker gains root access, one of their first actions is often to disable or modify logging and auditing systems to cover their tracks. An immutable configuration (`-e 2`) prevents the audit rules from being altered or the audit daemon from being stopped without rebooting the machine. This ensures that any actions taken by an attacker, even with the highest privileges, are logged, providing a reliable trail for forensic analysis. A mutable configuration can be trivially disabled, rendering the entire audit system ineffective against a sophisticated adversary.

Auditing and Remediation: The audit script directly queries the audit daemon's runtime status using `auditctl` to determine if it is in the immutable state (value '2'). The remediation script modifies the persistent audit rules files, typically by ensuring the `-e 2` flag is the last directive processed when the audit service starts. This guarantees the setting is applied on every boot.

Recommended State Rationale: For this control, the recommended state is consistently '2' (immutable) across all security levels. 
- Basic, Moderate, and Strict: `['2']`. There is no secure alternative. A state of '0' (disabled) offers no auditing. A state of '1' (enabled but mutable) provides a false sense of security, as it can be easily disabled by an attacker. Therefore, the only acceptable configuration for any security-conscious system is immutable, as recommended by security benchmarks like CIS. This leaves no room for a tiered recommendation; the setting is either secure (immutable) or it is not.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2']` |
| **Moderate** | `['2']` |
| **Strict** | `['2']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes the command `auditctl -s | grep 'enabled' | awk '{print $2}'`. The script must only output the numeric value representing the auditd enabled state (e.g., '0', '1', or '2') and nothing else.

## Remediation Script Working

Bash script that accepts a single positional numeric argument ('1' for enabled, '2' for immutable). The script should ensure a line `-e [argument]` exists and is the final active configuration line in the `/etc/audit/rules.d/99-finalize.rules` file (or a similar persistent rules file), removing or correcting any conflicting `-e` entries. The script must return `true` on successful modification or if the state is already correct, and `false` on failure.

