Install the audit-rules package (auditctl/augenrules)
On el10 (RHEL 10, AlmaLinux 10, Rocky 10) and recent Fedora, the audit userspace was split: the audit package ships the auditd daemon, while auditctl, augenrules and the rule loader moved to a separate audit-rules package. Install auditd alone and the daemon runs with no ruleset at all: every audit-* rule Pavois writes to /etc/audit/rules.d/ is never loaded.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The Pavois audit rules are loaded by augenrules at boot, through augenrules.service. On el10 that binary lives in audit-rules, which installing auditd does not pull in: the file-system audit trail (identity changes, privileged commands, MAC and DAC modifications) is then simply absent, and with it the evidence every audit control depends on.
What Pavois checks
Pavois asserts that audit-rules is present in the RPM inventory. This is an inventory-state control: it proves the rule-loading tooling is installed, not that a ruleset is loaded. A host can hold the package and still run auditctl -l returning No rules. Read this rule as a prerequisite check, the one that explains why every other audit rule fails on an el10 box, and check the loaded ruleset separately (auditctl -l, auditctl -s).
describe package('audit-rules') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q audit-rules and confirm a version is printed rather than package audit-rules is not installed:
$ rpm -q audit-rules
audit-rules-4.0.3-1.el10.x86_64
Then confirm the tooling does its job: augenrules --check reports whether /etc/audit/rules.d/ differs from the loaded set, and auditctl -l must list the rules (an empty No rules on a hardened host means they were never loaded).
Inspect & investigate
The package itself logs nothing: it is a set of binaries and unit files. What it enables is the entire audit trail, /var/log/audit/audit.log, where every rule fires with its key= tag. Rule loading is traced in the journal (journalctl -u augenrules), and a loader failure appears there as a non-zero exit on that unit, which is exactly what you see when the binaries are missing. Note that ausearch is an unreliable way to confirm an event landed: grep the raw log for key="<name>" instead.
Remediation
The Pavois harden plan installs the audit-rules package with the system package manager (package resource, action install, so dnf install audit-rules on el10 and Fedora). Pavois writes the ruleset itself in its own audit controls; this rule only guarantees the loader is there to read it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | audit-rules |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without audit-rules on el10, the host has an audit daemon and no audit: the rule files exist on disk, nothing loads them, and the machine silently loses the traceability that CIS 6.3.x and every forensic investigation rely on. Installing it is safe (no daemon, no configuration change), but be aware of what follows once the rules do load: the audit trail starts writing for real, so /var/log/audit/ grows and must be sized and rotated, and if the ruleset ends with -e 2 (immutable), changing a rule afterwards requires a reboot. Size the audit partition before you turn the trail on, not after.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.3.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.