# Ensure audit configuration files owner is configured

Necessity: The Linux Auditing System (`auditd`) is critical for tracking security-relevant events. Its configuration files in `/etc/audit/` dictate what is logged and where. If these files are not owned by `root`, a non-privileged user could potentially modify them to disable auditing, alter rules to ignore malicious activity, or redirect logs. This would compromise the system's integrity and accountability, making it impossible to perform forensic analysis after a security breach. Ensuring `root` ownership is a fundamental step in preventing unauthorized tampering with the system's security monitoring capabilities. Auditing and Remediation: The audit script recursively inspects all files within the `/etc/audit/` directory and reports the owner. The remediation script utilizes the `chown` command to recursively reset the ownership of the entire `/etc/audit/` directory structure to a specified user, which should always be `root`. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly `['root']`. There is no viable, secure alternative. System configuration files integral to security must be owned exclusively by the superuser (`root`) to maintain a secure chain of trust. Any other ownership level introduces an unacceptable risk of unauthorized modification. This is a binary control; it is either correctly configured (`root`) or it is a critical vulnerability. This standard is mandated by security hardening benchmarks like CIS for all levels of security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the ownership of all files in `/etc/audit/` and its subdirectories. If all files are owned by `root`, the script should output 'root'. If any file is not owned by `root`, it should output the owner of the first non-compliant file it finds. The output must contain only the owner's name and no other text.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired owner username. The script must recursively change the ownership of all files and directories within `/etc/audit/` to the specified user. The script must output `true` if the operation is successful and `false` if it fails.

