# Ensure the audit configuration is immutable

Necessity: Making the auditd configuration immutable is a critical security control. It prevents a privileged user or an attacker who has gained root access from disabling or modifying the audit rules. If an attacker can alter the audit rules, they can effectively cover their tracks by stopping the logging of their malicious activities, rendering forensic analysis impossible. Immutability ensures that the defined logging policy remains in effect, safeguarding the integrity of audit trails.

Auditing and Remediation: The audit script directly queries the running audit daemon (`auditctl`) to check its immutability status flag. The 'enabled' flag can be 0 (mutable), 1 (immutable until reboot), or 2 (permanently immutable). The remediation script modifies the persistent rule file (`/etc/audit/audit.rules`) by adding or modifying the `-e 2` flag. This change takes effect upon the next reboot or service restart, locking the configuration from that point forward.

Recommended State Rationale:
- Basic: `['1']` sets the rules to be immutable for the current session. This prevents tampering with the live configuration but is nullified upon reboot. It's a foundational step against runtime modification.
- Moderate: `['2']` aligns with CIS benchmarks and represents the best practice. It makes the audit configuration permanently immutable. Once these rules are loaded, they cannot be changed without booting the system into a different runlevel (e.g., single-user mode) to edit the rule file. This provides a robust defense against attackers trying to disable auditing.
- Strict: `['2']` is also the strictest setting, as there is no higher level of immutability provided by auditd. This state is essential for high-security environments where the integrity of audit logs is paramount for compliance and incident response.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['2']` |
| **Strict** | `['2']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the current auditd status for its immutability level. The script must execute `auditctl -s | grep enabled` and parse the output to return only the numeric value of the enabled flag (e.g., 0, 1, or 2), with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single numeric argument (must be 2) to set the audit configuration to immutable. The script must modify the `/etc/audit/audit.rules` file to include the line `-e 2`. If a line starting with `-e` already exists, it should be replaced. The script must not restart any services and should return `true` on successful modification or `false` on failure.

