Verify that audit tools Have Mode 0755 or less
Ensures the audit tooling (here /sbin/auditctl) is not group/other-writable and carries no setuid, setgid or sticky bit, i.e. mode 0755 or stricter.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Protecting audit information means protecting the tools used to view and control it. The audit binaries (auditctl, auditd, ausearch, aureport, autrace, augenrules, audisp-*) must not be group/other-writable, nor carry setuid/setgid bits. A writable audit tool could be replaced with a trojaned version that silently disables logging or hides events; an unexpected setuid bit would let any user run it with elevated rights. Mode 0755 or stricter keeps modification and special privileges in root's hands.
What Pavois checks
Pavois inspects the binary's live mode bits with the InSpec file resource, the actual setuid/setgid/write bits the kernel honors at exec time, instead of trusting the package's shipped mode. This catches a binary whose permissions were altered after install (a classic tampering technique to weaken auditing). The only_if guard skips the check when /sbin/auditctl is absent (audit not installed).
only_if { file('/sbin/auditctl').exist? }
describe file('/sbin/auditctl') do
it { should_not be_setuid }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_writable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%a %U %G %n' /sbin/auditctl (and the other audit binaries). Expected output is 755 root root /sbin/auditctl or stricter, with no leading 4/2 setuid/setgid digit.
Inspect & investigate
The audit framework itself logs to /var/log/audit/audit.log; check its health with auditctl -s and systemctl status auditd. Tampering with the binaries can be tracked by adding an auditd watch on them and grepping /var/log/audit/audit.log for the matching key.
Remediation
No automated remediation is defined, so apply it manually: chmod 0755 /sbin/auditctl (and the other audit binaries: auditd, ausearch, aureport, autrace, augenrules, audisp-*), removing any setuid/setgid/sticky and group/other write bits. Many distributions ship these correctly; a failure usually means a binary was modified post-install.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0755 |
|---|---|
| path | /sbin/auditctl |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a tampered or setuid audit tool can disable logging or escalate privileges, blinding incident response. Precautions: setting mode 0755 is non-disruptive, these tools are run by root and need only standard execute permission. Do not strip the execute bit (x) for owner/group/other system use, and avoid going below the package default, as some helper services invoke ausearch/aureport as their own service user.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.4.8, 6.3.4.8 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-232035, UBTU-24-901230 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.