# Ensure audit log files owner is configured

Necessity: Setting the owner of audit log files to 'root' is critical for maintaining the integrity and confidentiality of system audit trails. If an unprivileged user owns these files, they could potentially modify or delete logs to conceal malicious activity, disable auditing, or read sensitive information. This would render the audit system ineffective and blind administrators to security breaches.

Auditing and Remediation: The audit script verifies the current owner of the audit log directory, which is located by parsing the '/etc/audit/auditd.conf' file. The remediation script uses the 'chown' command to correct the ownership, ensuring that only the root user has control over these critical files.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is unequivocally 'root'. There is no secure alternative. This aligns with the principle of least privilege, where critical system components must be protected from unauthorized access or modification. Any ownership other than 'root' introduces an unacceptable security risk, as it would allow non-administrative users to tamper with the evidence of their actions on the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the `log_file` path from `/etc/audit/auditd.conf`, extracts the directory portion of that path, and then uses the `stat` command to find the owner of that directory. The script must output only the owner's username, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired owner username. The script must read the `log_file` path from `/etc/audit/auditd.conf`, extract the directory, and use the `chown` command to recursively set the ownership of that directory to the provided username. The script must output `true` on success and `false` on failure.

