Audit Configuration Files Must Be Owned By Group root
Ensures the audit configuration directory /etc/audit is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/audit directory holds auditd.conf and the rule files (audit.rules, rules.d/*.rules) that decide which events are recorded. Without restricting who can change them, unauthorized personnel could disable the auditing of critical events, or misconfigure the rules so the log fills up and degrades performance, making it harder to correlate and investigate an incident. Group ownership by root (gid 0) keeps control of the audit policy with privileged users only.
What Pavois checks
Pavois reads the real group id of /etc/audit via InSpec's file resource and asserts gid == 0. It checks the effective ownership on disk, so drift on the directory (and, by extension, the rule files it contains) is detected regardless of what a deployment template believes.
only_if { file('/etc/audit').exist? }
describe file('/etc/audit') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /etc/audit. Expected output: root 0. Check the files too: find /etc/audit -printf '%g %p\n' | grep -v '^0 ' should print nothing.
Inspect & investigate
Add an auditd watch, auditctl -w /etc/audit -p wa -k auditconfig, and changes to the directory or its rule files appear in /var/log/audit/audit.log (grep 'key="auditconfig"' /var/log/audit/audit.log). Rule reloads are also reported by journalctl -u auditd.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp -R 0 /etc/audit. Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /etc/audit |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root group on the audit config could let an attacker silently disable rules. Resetting the group to root is safe, auditd runs as root and reads these files at start-up. No service breaks. Precaution: keep the directory mode at 0750 and the rule files at 0640; reload rules with augenrules --load (or systemctl reload auditd) after any legitimate change so the running policy matches the files.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.4.7, 6.3.4.7 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-653075, UBTU-24-900060 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.