# Ensure auditing for processes that start prior to auditd is enabled

Necessity: The Linux audit daemon (`auditd`) is responsible for writing audit records to disk. However, it is a user-space daemon that starts later in the boot process. Any auditable events that occur before `auditd` starts, such as actions by `initramfs` or early system services, will be lost. Enabling the `audit=1` kernel parameter instructs the kernel itself to buffer these pre-`auditd` events in memory. Once `auditd` starts, it retrieves this buffer, ensuring a complete and unbroken audit trail from the earliest moments of system boot. This is critical for forensic investigations and detecting boot-time malware or unauthorized configuration changes that could otherwise go unnoticed.

Auditing and Remediation: The audit script verifies that the system is configured to capture early boot-time audit events by checking the kernel command line in the GRUB configuration for the `audit=1` parameter. The remediation script uses the standard `grubby` tool to modify the kernel command line arguments, adding or removing `audit=1` as required. This method is the correct and persistent way to manage kernel boot parameters on CentOS and other RHEL-based systems.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Enabled'. This is a binary control with no valid intermediate state. For any system requiring a robust security posture, capturing the full audit trail is essential. Disabling this feature creates a significant blind spot in security monitoring. Therefore, authoritative security benchmarks like the CIS Benchmarks mandate this setting be enabled without exception. There is no security benefit to disabling it, and thus, it is consistently recommended for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the GRUB2 configuration file (`/boot/grub2/grub.cfg`) for the active kernel command line. The script must check if the `audit=1` parameter is present. If it is found, the script shall output the string 'Enabled'. Otherwise, it shall output 'Disabled'. The output must be limited to only one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must use the `grubby` command to add the `audit=1` argument to the default kernel boot parameters. If the argument is 'Disabled', it must remove the `audit=1` argument. A system reboot is required for the change to take effect. The script must return 'true' on success and 'false' on failure.

