Enable Auditing for Processes Which Start Prior to the Audit Daemon
Adds the kernel boot parameter audit=1 so every process is auditable from the very start of boot, before auditd is running.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Each process carries an "auditable" flag that determines whether its activity can be recorded. auditd enables this for processes that start after it, but everything launched during early boot would otherwise escape auditing. The audit=1 kernel argument sets the flag for every process from PID 1 onward, closing the blind spot an attacker could exploit by acting before the audit daemon comes up.
What Pavois checks
Pavois reads /proc/cmdline, the line the running kernel actually booted with, and checks for audit=1. This is stronger than inspecting /etc/default/grub: those config files state intent for the next boot, while /proc/cmdline proves the flag is active now. A failed update-grub/grub2-mkconfig or a conflicting drop-in would leave the file correct but the kernel running without it.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )audit=1( |$)/) }
end
describe command("grep -hwsF 'audit=1' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains audit=1. A configuration change only shows here after a reboot, since it is a boot-time kernel argument.
Inspect & investigate
Audit records are written to /var/log/audit/audit.log; auditctl -s reports the runtime audit state. The kernel ring buffer (dmesg | grep -i audit) shows audit subsystem messages from early boot.
Remediation
pavois harden apply uses the kernel_cmdline resource to add audit=1 to the bootloader (GRUB) configuration and regenerate it. As a kernel boot parameter it is flagged reboot_required: it only appears in /proc/cmdline after the next restart.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | audit=1 |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Minimal: enabling the auditable flag for all early processes has negligible performance cost. Precautions: it requires a reboot to take effect; verify the bootloader regenerated correctly so you do not boot an unintended kernel line. Combine with an adequate audit_backlog_limit so early-boot events are not dropped before auditd drains the queue.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 10.7.2, 6.2.1.3, 6.3.1.2, 6.3.1.3 | direct | per OS, see the benchmark table | high |
| NIST | 3.3.1, AC-17(1), AU-10, AU-14(1), CM-6(a), IR-5(1) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 10.7.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-212015, UBTU-24-102010 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.