{
  "id": "CB-UBU-AUDIT-014",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-014",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-014.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-AUDIT-014.yml",
  "profiles_effective": [
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUDIT-014",
    "title": "Decide and configure what happens when the audit disk fills up",
    "finding": {
      "title": "The system keeps running without recording audit events when the audit log space runs out",
      "description": "With the Ubuntu defaults, auditd only suspends itself when the disk is full, and actions continue unrecorded."
    },
    "status": "active",
    "profiles": [
      "server-hardened",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "auditd",
      "availability"
    ],
    "description": "`/etc/audit/auditd.conf` sets what auditd does as the partition holding `/var/log/audit` fills\nup. Ubuntu ships `space_left_action = SYSLOG`, `admin_space_left_action = SUSPEND`,\n`disk_full_action = SUSPEND` and `disk_error_action = SUSPEND`: audit stops and the system\ncarries on, and nobody is warned.\n\nThe `disk_full_policy` parameter records the choice of the organization:\n\n- `stop-system` (default, accountability first): nothing may happen unrecorded. When the\n  partition is almost full (`admin_space_left`) or full, the system goes to single user mode or\n  halts (`{{ admin_space_left_action }}` / `{{ disk_full_action }}`). Remote sessions and services\n  stop until an administrator frees space at the console.\n- `keep-running` (availability first): auditd suspends itself (`suspend`) and the system keeps\n  serving. Actions done while the partition is full are not recorded.\n\nIn both cases `space_left_action` must warn someone early (`email`, `exec`, `single` or `halt`;\nfix: `{{ space_left_action }}`), and `disk_error_action` must be `syslog`, `single` or `halt`\n(fix: `{{ disk_error_action }}`).\n",
    "rationale": "Accountability requires that nothing happens without being recorded: on systems that must prove\nwho did what (regulated, high-value), `stop-system` is the right choice. On systems where an\noutage is worse than a gap in the audit trail, `keep-running` is acceptable, provided the early\nwarning reaches someone. What is never acceptable is the Ubuntu default, which stops auditing\nwithout warning anybody.\n",
    "impact": "With `stop-system`, a full audit partition stops remote sessions and services: SSH becomes\nunreachable, recovery needs the console. This is why the fix is disabled by default in generated\nartifacts (`lockout_risk`); enable it once the policy is chosen. With `keep-running`, the system\nstays up but the audit trail has a gap. In both cases, monitor the free space and archive audit\nlogs in time. `email` needs a working local mail transport, otherwise only a syslog message is\nwritten.\n",
    "setting": {
      "location": "/etc/audit/auditd.conf",
      "default_value": "space_left_action = SYSLOG, admin_space_left_action, disk_full_action and disk_error_action = SUSPEND",
      "recommended_value": "space_left_action = {{ space_left_action }}, admin_space_left_action = {{ admin_space_left_action }}, disk_full_action = {{ disk_full_action }}, disk_error_action = {{ disk_error_action }}"
    },
    "parameters": [
      {
        "name": "disk_full_policy",
        "type": "enum",
        "description": "stop-system: halt or single user mode when the audit disk is full (accountability first). keep-running: suspend auditing and keep the system up (availability first).",
        "allowed": [
          "stop-system",
          "keep-running"
        ],
        "default": "stop-system"
      },
      {
        "name": "space_left_action",
        "type": "enum",
        "description": "Action when free space drops below space_left.",
        "allowed": [
          "email",
          "exec",
          "single",
          "halt"
        ],
        "default": "email"
      },
      {
        "name": "admin_space_left_action",
        "type": "enum",
        "description": "Action when free space drops below admin_space_left, used with disk_full_policy stop-system.",
        "allowed": [
          "single",
          "halt"
        ],
        "default": "single"
      },
      {
        "name": "disk_full_action",
        "type": "enum",
        "description": "Action when the partition is full, used with disk_full_policy stop-system.",
        "allowed": [
          "single",
          "halt"
        ],
        "default": "single"
      },
      {
        "name": "disk_error_action",
        "type": "enum",
        "description": "Action when writing the audit log fails.",
        "allowed": [
          "syslog",
          "single",
          "halt"
        ],
        "default": "syslog"
      }
    ],
    "audit": {
      "manual": "Run `grep -Ei '^\\s*(space_left|admin_space_left|disk_full|disk_error)_action' /etc/audit/auditd.conf`.\n`space_left_action` must be email, exec, single or halt and `disk_error_action` syslog, single\nor halt. With `disk_full_policy` = `stop-system`, `admin_space_left_action` and\n`disk_full_action` must be single or halt; with `keep-running`, suspend is also accepted.\n",
      "checks": [
        {
          "id": "actions",
          "engine": "shell",
          "description": "Disk space actions in auditd.conf.",
          "spec": {
            "script": "f=/etc/audit/auditd.conf\n[ -r \"$f\" ] || { echo \"$f not found: auditd is not installed\"; exit 1; }\nget() { sed -n \"s/^[[:space:]]*$1[[:space:]]*=[[:space:]]*\\([^[:space:]]*\\).*/\\1/p\" \"$f\" | tail -n 1 | tr 'A-Z' 'a-z'; }\nrc=0\nstop=single,halt\n[ \"$CB_DISK_FULL_POLICY\" = keep-running ] && stop=suspend,single,halt\necho \"disk_full_policy=$CB_DISK_FULL_POLICY\"\nfor kv in space_left_action:email,exec,single,halt admin_space_left_action:$stop \\\n  disk_full_action:$stop disk_error_action:syslog,single,halt; do\n  k=${kv%%:*} v=$(get \"${kv%%:*}\")\n  echo \"$k=${v:-unset}\"\n  case \",${kv#*:},\" in *\",${v:-unset},\"*) ;; *) rc=1 ;; esac\ndone\nexit \"$rc\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Choose the policy, `stop-system` or `keep-running` (see the description), and record it in\n   the tailoring file as `disk_full_policy`.\n2. In `/etc/audit/auditd.conf`, set `space_left_action = {{ space_left_action }}` and\n   `disk_error_action = {{ disk_error_action }}`.\n3. With `stop-system`, set `admin_space_left_action = {{ admin_space_left_action }}` and\n   `disk_full_action = {{ disk_full_action }}`; with `keep-running`, set both to `suspend`.\n4. Run `systemctl restart auditd`.\n",
      "effects": {
        "restart": "service",
        "services": [
          "auditd"
        ],
        "disruption": "high",
        "lockout_risk": true
      },
      "rollback": "Set the four actions back to `SYSLOG` / `SUSPEND` in `/etc/audit/auditd.conf` and restart auditd.\n",
      "scripts": [
        {
          "id": "auditd-conf",
          "engine": "shell",
          "content": "f=/etc/audit/auditd.conf\n[ -f \"$f\" ] || { echo \"$f not found: auditd is not installed\" >&2; exit 1; }\ncb_backup \"$f\"\nset_kv() {\n  sed -i \"/^[[:space:]]*$1[[:space:]]*=/d\" \"$f\"\n  printf '%s = %s\\n' \"$1\" \"$2\" >>\"$f\"\n}\nset_kv space_left_action \"$CB_SPACE_LEFT_ACTION\"\nif [ \"$CB_DISK_FULL_POLICY\" = keep-running ]; then\n  set_kv admin_space_left_action suspend\n  set_kv disk_full_action suspend\nelse\n  set_kv admin_space_left_action \"$CB_ADMIN_SPACE_LEFT_ACTION\"\n  set_kv disk_full_action \"$CB_DISK_FULL_ACTION\"\nfi\nset_kv disk_error_action \"$CB_DISK_ERROR_ACTION\"\n"
        }
      ]
    },
    "references": [
      {
        "title": "auditd.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/auditd.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R73",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-5(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.012"
      },
      {
        "framework": "cwe",
        "id": "CWE-778"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-AUDIT-011",
        "type": "requires"
      },
      {
        "id": "CB-UBU-AUDIT-013",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fix enabled with CB_ENABLE_CB_UBU_AUDIT_014=1 (stop-system policy); fails on stock auditd.conf, passes after fix and reboot. Disk-full action not triggered."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fix enabled with CB_ENABLE_CB_UBU_AUDIT_014=1 (stop-system policy); fails on stock auditd.conf, passes after fix and reboot. Disk-full action not triggered."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fix enabled with CB_ENABLE_CB_UBU_AUDIT_014=1 (stop-system policy); fails on stock auditd.conf, passes after fix and reboot. Disk-full action not triggered."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fix enabled with CB_ENABLE_CB_UBU_AUDIT_014=1 (stop-system policy); fails on stock auditd.conf, passes after fix and reboot. Disk-full action not triggered."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}