rhel8,rhel9: DISA STIG v2r8/v2r9, RHEL-08-030610/RHEL-09-653110 - update remediations and warning in the rule

Author: macko1

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/ansible/shared.yml

@@ -5,45 +5,53 @@
 # disruption = low
 
 # Copied and modified from `file_permissions/ansible.yml` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
 
-- name: Ensure audit config files are not more permissive than 0600
+- name: Set /etc/audit/audit.rules and /etc/audit/auditd.conf to 0600, owned by root
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop:
+    - /etc/audit/audit.rules
+    - /etc/audit/auditd.conf
+  failed_when: false
+
+- name: Set /etc/audit/rules.d/*.rules files to 0600, owned by root
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  with_fileglob:
+    - /etc/audit/rules.d/*.rules
+
+- name: Install ExecStartPost dropin on auditd.service
   block:
-    - name: Set /etc/audit/audit.rules and /etc/audit/auditd.conf to 0600
-      ansible.builtin.file:
-        path: "{{ item }}"
-        mode: '0600'
-        state: file
-      loop:
-        - /etc/audit/audit.rules
-        - /etc/audit/auditd.conf
-      failed_when: false
-
-    - name: Set /etc/audit/rules.d/*.rules files to 0600
-      ansible.builtin.file:
-        path: "{{ item }}"
-        mode: '0600'
-        state: file
-      with_fileglob:
-        - /etc/audit/rules.d/*.rules
-
-    # augenrules --load hardcodes chmod 0640 on audit.rules on every rewrite of the rules.d files.
-    # Install ExecStartPost in auditd.service to restore 0600 after each run.
-    # Runs inside the auditd_t SELinux domain which has write access to auditd_etc_t files.
-    # On RHEL 8/9, augenrules is called via ExecStartPost in auditd.service directly.
     - name: Create dropin directory /etc/systemd/system/auditd.service.d
       ansible.builtin.file:
         path: /etc/systemd/system/auditd.service.d
         state: directory
         mode: '0755'
 
-    - name: Install /etc/systemd/system/auditd.service.d/permissions.conf - chmod audit.rules to 0600 after augenrules runs
+    - name: Install /etc/systemd/system/auditd.service.d/permissions.conf
       ansible.builtin.copy:
         dest: /etc/systemd/system/auditd.service.d/permissions.conf
         content: |
           [Service]
           ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
         mode: '0644'
 
+    - name: Restore SELinux context on /etc/systemd/system/auditd.service.d/permissions.conf
+      ansible.builtin.command: restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+      changed_when: false
+
     - name: Reload systemd daemon to pick up permissions.conf
       ansible.builtin.systemd:
         daemon_reload: true

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/bash/shared.sh

@@ -5,20 +5,22 @@
 # disruption = low
 
 # Copied and modified from `file_permissions/bash.template` template
-
-if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
 
 find /etc/audit/ -maxdepth 1 -type f \
     -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' \
-    -exec chmod 0600 {} \;
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
 
 find /etc/audit/rules.d/ -maxdepth 1 -type f -name '*.rules' \
-    -exec chmod 0600 {} \;
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
 
-# augenrules --load hardcodes chmod 0640 on audit.rules on every rewrite of the rules.d files.
-# Install ExecStartPost in auditd.service to restore 0600 after each run.
-# Runs inside the auditd_t SELinux domain which has write access to auditd_etc_t files.
-# On RHEL 8/9, augenrules is called via ExecStartPost in auditd.service directly.
 mkdir -p /etc/systemd/system/auditd.service.d
 chmod 0755 /etc/systemd/system/auditd.service.d
 
@@ -27,9 +29,8 @@ cat > /etc/systemd/system/auditd.service.d/permissions.conf << 'EOF'
 ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
 EOF
 chmod 0644 /etc/systemd/system/auditd.service.d/permissions.conf
+restorecon /etc/systemd/system/auditd.service.d/permissions.conf
 
 systemctl daemon-reload
 
-else
-    >&2 echo 'Remediation is not applicable, nothing was done'
 fi

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/rule.yml

@@ -29,6 +29,34 @@ ocil: |-
     {{{ describe_file_permissions(file="/etc/audit/", perms="0600") }}}
     {{{ describe_file_permissions(file="/etc/audit/rules.d/", perms="0600") }}}
 
+warnings:
+    - general: |-
+        On RHEL 8 and RHEL 9, the <tt>augenrules</tt> script unconditionally
+        runs <tt>chmod 0640 /etc/audit/audit.rules</tt> every time it rewrites
+        the file due to a rule change.  <tt>auditd.service</tt> calls
+        <tt>augenrules --load</tt> via <tt>ExecStartPost</tt> on every
+        <tt>auditd</tt> restart, which resets <tt>/etc/audit/audit.rules</tt>
+        to <tt>0640</tt> and undoes the <tt>0600</tt> permission set by
+        remediation.
+        The remediation installs a dropin at
+        <tt>/etc/systemd/system/auditd.service.d/permissions.conf</tt> with a
+        second <tt>ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules</tt>.
+        systemd runs both <tt>ExecStartPost</tt> commands in order —
+        <tt>augenrules --load</tt> first, then the <tt>chmod 0600</tt> — so
+        the correct mode is restored on every <tt>auditd</tt> restart.
+        The dropin runs in the <tt>auditd_t</tt> SELinux domain, which has
+        write access to <tt>auditd_etc_t</tt> files; no SELinux policy changes
+        are needed.
+        Note: <tt>auditd.service</tt> sets <tt>RefuseManualStart=yes</tt>.
+        Restarting with <tt>systemctl restart auditd</tt> fails with
+        "Operation refused".  Use <tt>service auditd restart</tt> instead,
+        which calls systemctl with <tt>--ignore-dependencies</tt> and bypasses
+        that restriction.
+        Calling <tt>augenrules --load</tt> directly outside of systemd still
+        resets the mode to <tt>0640</tt> until the upstream
+        <tt>audit-userspace</tt> package is patched to preserve existing
+        permissions.  Repeated scans detect the non-<tt>0600</tt> state.
+
 template:
     name: file_permissions
     vars: