Audit Configuration Files Must Be Owned By Root
Ensures the audit configuration directory /etc/audit is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/audit directory holds auditd.conf and the rule files (audit.rules, rules.d/) that decide which security events are recorded. If a non-root user owns this directory, they can rewrite the rules to stop auditing critical events, disable the audit trail entirely, or flood it to mask their activity, making it far harder to detect, correlate and attribute an incident. Restricting ownership to root (uid 0) ensures only the superuser controls what gets audited.
What Pavois checks
Pavois asserts that the live directory /etc/audit has owner uid 0, skipping via only_if when audit is not present. It reads the effective owner from the filesystem (stat) rather than a deployment manifest, so any out-of-band chown on the audit config, a classic way to prepare tampering with the rules, is detected.
only_if { file('/etc/audit').exist? }
describe file('/etc/audit') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/audit. Expected output: root 0. To cover the contents too, run find /etc/audit -not -user root, it should print nothing.
Inspect & investigate
Ownership has no running log; query it with stat /etc/audit. The audit subsystem logs to /var/log/audit/audit.log; if /etc/audit is watched (auditctl -w /etc/audit/ -p wa -k auditconfig), changes appear there, grep the raw log: grep auditconfig /var/log/audit/audit.log.
Remediation
No automated harden plan is defined, so apply it manually: chown root:root /etc/audit and, to be thorough, chown -R root:root /etc/audit. Reinstalling the auditd/audit package also restores root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/audit |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/audit can neutralize your audit policy and hide their tracks. Restoring root ownership is safe and does not affect the running auditd, which already runs as root. Precaution: if you recurse with chown -R, do not also change permissions, the rule files should stay readable only by root (mode 0640/0600); loosening them would let attackers read which events are monitored and design around them.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.4.6, 6.3.4.6 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-653070, UBTU-24-900050 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.