# Ensure actions as another user are always logged

Necessity: Logging actions where a user or process attempts to change identity (e.g., via `setuid` or `setgid`) is critical for detecting privilege escalation attacks. Attackers who gain initial access often exploit vulnerabilities to elevate their permissions to a more powerful account, like root. These syscalls are the mechanism for that change. Without auditing these events, an organization has a major blind spot and cannot reliably trace or detect an attacker's lateral movement or privilege escalation within a compromised system.

Auditing and Remediation: The audit script inspects the live kernel audit ruleset via `auditctl` to confirm that specific rules are active to monitor identity-change syscalls. The remediation script ensures these rules are permanently configured by writing them to a file in `/etc/audit/rules.d/` and then signaling the `auditd` service to reload its rule configuration, making the change effective immediately.

Recommended State Rationale: 
- Basic, Moderate, and Strict: The recommended state for all levels is 'Configured'. This is a foundational security control that is either enabled or not; there is no meaningful intermediate state. The configuration, derived from CIS benchmarks, is essential for any level of security hardening. It specifically targets non-system user accounts (auid>=1000) to focus on actions by human users or user-level services, which are the primary subjects of this monitoring. Ensuring rules exist for both 32-bit and 64-bit architectures provides comprehensive coverage on all modern systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the loaded auditd rules using `auditctl -l`. The script must check for the presence of rules that log the `setuid`, `setgid`, `setreuid`, `setregid`, `setresuid`, `setresgid`, `setfsuid`, and `setfsgid` syscalls for both 32-bit and 64-bit architectures, specifically for audit user IDs (auid) greater than or equal to 1000. It should output 'Configured' if all required rules are present, and 'Not Configured' otherwise. The output must not contain any other text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument: 'Configured'. If the argument is 'Configured', the script must add the necessary auditd rules to a file within `/etc/audit/rules.d/` to log the `setuid`, `setgid`, `setreuid`, `setregid`, `setresuid`, `setresgid`, `setfsuid`, and `setfsgid` syscalls for both 32-bit and 64-bit architectures for UIDs >= 1000. After adding the rules, it must reload the auditd configuration to apply them. The script must output `true` on successful application of the rules and `false` on failure.

