DRAFT: fix remediations for file_permissions_audit_configuration_stig

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/ansible/shared.yml

@@ -0,0 +1,69 @@
+# platform = multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+# Copied and modified from `file_permissions/ansible.yml` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
+
+- name: Set /etc/audit/audit.rules and /etc/audit/auditd.conf to 0600, owned by root
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop:
+    - /etc/audit/audit.rules
+    - /etc/audit/auditd.conf
+  failed_when: false
+
+- name: Set /etc/audit/rules.d/*.rules files to 0600, owned by root
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  with_fileglob:
+    - /etc/audit/rules.d/*.rules
+
+- name: Install ExecStartPost dropin on auditd.service
+  block:
+    - name: Create dropin directory /etc/systemd/system/auditd.service.d
+      ansible.builtin.file:
+        path: /etc/systemd/system/auditd.service.d
+        state: directory
+        mode: '0755'
+
+    - name: Install /etc/systemd/system/auditd.service.d/permissions.conf
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/auditd.service.d/permissions.conf
+        content: |
+          [Service]
+          ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+        mode: '0644'
+
+    - name: Restore SELinux context on /etc/systemd/system/auditd.service.d/permissions.conf
+      ansible.builtin.command: restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+      changed_when: false
+
+    - name: Reload systemd daemon to pick up permissions.conf
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    # IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
+    # !!!USE `service` module instead of `systemd` module to avoid 
+    # "Operation refused" error, see https://access.redhat.com/solutions/2664811
+    - name: Restart auditd.service
+      ansible.builtin.service:
+        name: auditd.service
+        state: restarted
+
+  when:
+    - '"audit" in ansible_facts.packages'
+    - '"kernel-core" in ansible_facts.packages'

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/bash/shared.sh

@@ -0,0 +1,37 @@
+# platform = multi_platform_rhel
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+# Copied and modified from `file_permissions/bash.template` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
+
+find /etc/audit/ -maxdepth 1 -type f \
+    -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+find /etc/audit/rules.d/ -maxdepth 1 -type f -name '*.rules' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
+
+mkdir -p /etc/systemd/system/auditd.service.d
+chmod 0755 /etc/systemd/system/auditd.service.d
+
+cat > /etc/systemd/system/auditd.service.d/permissions.conf << 'EOF'
+[Service]
+ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+EOF
+chmod 0644 /etc/systemd/system/auditd.service.d/permissions.conf
+restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+
+systemctl daemon-reload
+service restart auditd # IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
+
+fi

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml

@@ -29,6 +29,10 @@ ocil: |-
     {{{ describe_file_permissions(file="/etc/audit/", perms="0600") }}}
     {{{ describe_file_permissions(file="/etc/audit/rules.d/", perms="0600") }}}
 
+warnings:
+    - general: |-
+        <tt>augenrules --load</tt> resets permissions of <tt>/etc/audit/audit.rules</tt> to <tt>0640</tt>, undoing remediation (<tt>0600</tt>). Fix: A systemd dropin for <tt>audit</tt> service is installed at <tt>/etc/systemd/system/auditd.service.d/permissions.conf</tt>with <tt>ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules</tt>. This dropin is necessary to restore <tt>0600</tt> permissions after <tt>augenrules</tt> runs and rewrites the <tt>/etc/audit/audit.rules</tt> file. systemd runs both commands in order, restoring <tt>0600</tt>. Use <tt>service auditd restart</tt> to reload and apply the drop-in when remediating manually.
+
 template:
     name: file_permissions
     vars:

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/tests/correct_permissions.pass.sh

@@ -3,7 +3,11 @@
 
 export TESTFILE=/etc/audit/rules.d/test_rule.rules
 export AUDITFILE=/etc/audit/auditd.conf
-touch $TESTFILE
-touch $AUDITFILE
-chmod 0600 $TESTFILE
-chmod 0600 $AUDITFILE
+# Create a dummy rule file to trigger a rewrite of audit.rules.
+echo '-a always,exit -F arch=b64 -S getuid -k test_execstartpost_2' > "$TESTFILE"
+
+augenrules --load # augenrules --load hardcodes chmod 0640 on audit.rules on every rewrite of the rules.d files.
+# we override this with a systemd dropin that runs chmod 0600 after augenrules finishes.
+
+chmod 0600 "$TESTFILE"
+chmod 0600 "$AUDITFILE"