Verify that audit tools are owned by group root
Ensures the audit tools (here /sbin/auditctl) are owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Protecting audit information also means protecting the tools used to view and manipulate log data. The audit binaries (auditctl, auditd, ausearch, aureport, autrace, augenrules) load and query the kernel audit subsystem. If a non-privileged group owns /sbin/auditctl, a member could replace it with a trojaned version that disables rules or hides events, defeating the audit trail. Group ownership by root (gid 0) ensures only privileged users can operate the audit tooling.
What Pavois checks
Pavois reads the real group id of /sbin/auditctl via InSpec's file resource and asserts gid == 0. It inspects the effective ownership of the binary on disk, catching a tampered or repackaged audit tool with a loosened group, something a check that trusts the package database would miss.
only_if { file('/sbin/auditctl').exist? }
describe file('/sbin/auditctl') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /sbin/auditctl. Expected output: root 0. Check the whole set with for b in auditctl auditd ausearch aureport autrace augenrules; do stat -c '%n %G' $(command -v $b 2>/dev/null) 2>/dev/null; done.
Inspect & investigate
Confirm package-provided ownership with dpkg -V auditd | grep auditctl (Debian/Ubuntu) or rpm -V audit (RHEL family), empty output means no integrity drift. An auditd watch (auditctl -w /sbin/auditctl -p wa -k audit_tools) records changes in /var/log/audit/audit.log.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /sbin/auditctl (and the other audit binaries). Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /sbin/auditctl |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A loosely-owned audit binary could be swapped for a trojaned version that silences the audit trail. Resetting the group to root is safe, these tools require root to talk to the kernel audit subsystem anyway, so non-privileged users lose nothing. No service interruption. Precaution: keep the binaries' mode at 0755 and do not stop auditd while changing ownership.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.4.10, 6.3.4.10 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-24-901250 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.