Ensure the audit-libs package as a part of audit Subsystem is installed
Ensures the audit-libs package (the shared libraries that auditd and its tools link against) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
audit-libs provides libaudit, the runtime library every audit component depends on (auditctl, ausearch, PAM's pam_tty_audit, etc.). If it is missing, the audit subsystem cannot function and PAM modules that link it may fail, leaving the host without a working security audit trail, contrary to CIS 6.3.1.1.
What Pavois checks
Pavois asks the package database (via dpkg/rpm) whether audit-libs is installed using the InSpec package resource. Checking the effective package state confirms the dependency is actually present rather than assumed from auditd being installed.
describe package('libaudit1') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q audit-libs (RHEL-family) or dpkg -s libaudit1 (Debian/Ubuntu, where the library ships as libaudit1), expected the package present.
Inspect & investigate
rpm -q audit-libs/dpkg -l libaudit1confirm installation.- The library itself produces no logs, but failures to load it surface when audit tools run; audit activity itself is in
/var/log/audit/audit.log.
Remediation
Pavois's harden plan installs the audit-libs package (package resource, install action) with pavois harden apply. It is normally pulled in automatically as a dependency of the audit package.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libaudit1 |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing a shared library is low-risk and non-disruptive. Removing it, by contrast, would break auditd, audit CLI tools and any PAM stack using pam_tty_audit, so never uninstall it on its own.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.3.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.