Restrict access to the audit configuration and tools

Description

• The configuration files /etc/audit/*.conf, /etc/audit/*.rules, /etc/audit/rules.d/*.rules and /etc/audit/plugins.d/*.conf must be owned by root:root with mode 0640 or stricter.
• The audit tools auditctl, auditd, augenrules, aureport, ausearch and autrace in /usr/sbin/ must be owned by root:root with mode 0755 or stricter.

autrace is no longer shipped by auditd 4 (Debian 13); its check is then not applicable.

Rationale

Writable rules or settings let a user disable auditing; a writable tool can be replaced by one that hides records. Readable rules tell an attacker what is watched.

Impact

None known. Debian installs these files with these permissions.

Setting

Audit

1. Run stat -c '%n %U:%G %a' /etc/audit/*.conf /etc/audit/*.rules /etc/audit/rules.d/*.rules /etc/audit/plugins.d/*.conf. Each file must be root:root with mode 0640 or stricter.
2. Run stat -c '%n %U:%G %a' /usr/sbin/auditctl /usr/sbin/auditd /usr/sbin/augenrules /usr/sbin/aureport /usr/sbin/ausearch /usr/sbin/autrace. Each file must be root:root with mode 0755 or stricter.

Automated: every check must pass. Scanners report each check by its id.

conf

Owner, group and mode of /etc/audit/*.conf.

path: /etc/audit/*.conf
owner: root
group: root
mode: '0640'

rules

Owner, group and mode of /etc/audit/*.rules.

path: /etc/audit/*.rules
owner: root
group: root
mode: '0640'

rules-d

Owner, group and mode of /etc/audit/rules.d/*.rules.

path: /etc/audit/rules.d/*.rules
owner: root
group: root
mode: '0640'

plugins-d

Owner, group and mode of /etc/audit/plugins.d/*.conf.

path: /etc/audit/plugins.d/*.conf
owner: root
group: root
mode: '0640'

auditctl

Owner, group and mode of /usr/sbin/auditctl.

path: /usr/sbin/auditctl
owner: root
group: root
mode: '0755'

auditd

Owner, group and mode of /usr/sbin/auditd.

path: /usr/sbin/auditd
owner: root
group: root
mode: '0755'

augenrules

Owner, group and mode of /usr/sbin/augenrules.

path: /usr/sbin/augenrules
owner: root
group: root
mode: '0755'

aureport

Owner, group and mode of /usr/sbin/aureport.

path: /usr/sbin/aureport
owner: root
group: root
mode: '0755'

ausearch

Owner, group and mode of /usr/sbin/ausearch.

path: /usr/sbin/ausearch
owner: root
group: root
mode: '0755'

autrace

Owner, group and mode of /usr/sbin/autrace.

path: /usr/sbin/autrace
owner: root
group: root
mode: '0755'

Remediation

Run chown root:root and chmod 640 on the configuration files, and chown root:root and chmod 755 on the tools.

Rollback

No rollback needed; these are the Debian defaults.

conf

Generated from check conf: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rules

Generated from check rules: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rules-d

Generated from check rules-d: the engine writes the fix for every output, it sets the expected value and the check runs again after.

plugins-d

Generated from check plugins-d: the engine writes the fix for every output, it sets the expected value and the check runs again after.

auditctl

Generated from check auditctl: the engine writes the fix for every output, it sets the expected value and the check runs again after.

auditd

Generated from check auditd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

augenrules

Generated from check augenrules: the engine writes the fix for every output, it sets the expected value and the check runs again after.

aureport

Generated from check aureport: the engine writes the fix for every output, it sets the expected value and the check runs again after.

ausearch

Generated from check ausearch: the engine writes the fix for every output, it sets the expected value and the check runs again after.

autrace

Generated from check autrace: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• auditctl(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• auditd.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-011 Install and run the audit daemon

People and lifecycle