Enable auditing from boot with a large enough backlog

Description

Two kernel command line parameters:

• audit=1 turns auditing on as soon as the kernel starts, so every process gets an audit context, including those started before auditd;
• audit_backlog_limit={{ backlog_limit }} sizes the kernel queue of records waiting for auditd. The default of 64 overflows during boot, and records are then lost.

The fix adds both to GRUB_CMDLINE_LINUX through /etc/default/grub.d/60-cirsec-audit.cfg and regenerates the GRUB configuration. They apply at the next boot.

The check reads the running command line (/proc/cmdline) and, when GRUB is the boot loader, the generated /boot/grub/grub.cfg. Right after the fix the first check fails until the reboot.

Rationale

An attacker who gets code to run early in the boot, or who floods the audit queue, escapes auditing. Turning it on at boot and sizing the queue closes both gaps.

Impact

A reboot is needed. The backlog uses kernel memory only when records pile up.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Run cat /proc/cmdline. It must contain audit=1 and audit_backlog_limit= with a value of at least {{ backlog_limit }}.
2. Run grep -E '^\s*linux' /boot/grub/grub.cfg. Every line must contain the same two parameters, so they survive the next reboot.

Automated: every check must pass. Scanners report each check by its id.

running

Parameters of the running kernel.

script: |
  c=$(cat /proc/cmdline)
  b=$(printf '%s\n' "$c" | tr ' ' '\n' | sed -n 's/^audit_backlog_limit=//p' | tail -n 1)
  a=$(printf '%s\n' "$c" | tr ' ' '\n' | sed -n 's/^audit=//p' | tail -n 1)
  echo "audit=${a:-unset} audit_backlog_limit=${b:-unset}"
  [ "$a" = 1 ] && [ -n "$b" ] && [ "$b" -ge "$CB_BACKLOG_LIMIT" ]

grub

Parameters in every kernel entry of /boot/grub/grub.cfg.

script: |
  n=0 bad=0
  while IFS= read -r l; do
    [ -n "$l" ] || continue
    n=$((n + 1))
    b=$(printf '%s\n' $l | sed -n 's/^audit_backlog_limit=//p' | tail -n 1)
    case " $l " in *" audit=1 "*) ;; *) b= ;; esac
    if [ -z "$b" ] || [ "$b" -lt "$CB_BACKLOG_LIMIT" ]; then bad=$((bad + 1)); fi
  done <<EOF
  $(grep -E '^[[:space:]]*linux[[:space:]]' /boot/grub/grub.cfg 2>/dev/null)
  EOF
  echo "$n kernel entries, $bad without audit=1 audit_backlog_limit>=$CB_BACKLOG_LIMIT"
  [ "$n" -gt 0 ] && [ "$bad" = 0 ]

Remediation

1. Create /etc/default/grub.d/60-cirsec-audit.cfg with:

   GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX audit=1 audit_backlog_limit={{ backlog_limit }}"
   

2. Run update-grub, then reboot.

Rollback

Delete /etc/default/grub.d/60-cirsec-audit.cfg, run update-grub and reboot.

grub

f=/etc/default/grub.d/60-cirsec-audit.cfg
mkdir -p /etc/default/grub.d
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUDIT-012' \
  "GRUB_CMDLINE_LINUX=\"\$GRUB_CMDLINE_LINUX audit=1 audit_backlog_limit=$CB_BACKLOG_LIMIT\"" >"$f"
cb_backup /boot/grub/grub.cfg
update-grub 2>&1

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• The kernel's command-line parameters (audit, audit_backlog_limit) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• update-grub(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-011 Install and run the audit daemon

People and lifecycle