SLE15 directory permissions and file ownership rules for var log audit

linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml

@@ -0,0 +1,43 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+  ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+  check_mode: False
+  failed_when: false
+  register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+  ansible.builtin.set_fact:
+      log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+  ansible.builtin.set_fact:
+      log_file_dir: "/var/log/audit"
+  when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file_dir from log_file_line if configured"
+  ansible.builtin.set_fact:
+      log_file_dir: "{{ log_file_line | dirname}}"
+  when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get audit log group"
+  ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
+  check_mode: False
+  failed_when: false
+  register: log_group_exists
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0700"
+  ansible.builtin.file:
+      path: "{{ log_file_dir }}"
+      mode: 0700
+  when: log_group_exists.stdout | length == 0
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0750"
+  ansible.builtin.file:
+      path: "{{ log_file_dir }}"
+      mode: 0750
+  when: log_group_exists.stdout | length > 0

linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh

@@ -1,4 +1,4 @@
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_fedora
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 
 if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
   DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)

linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml

@@ -0,0 +1,124 @@
+<def-group>
+  <definition class="compliance" id="directory_permissions_var_log_audit" version="1">
+    {{{ oval_metadata("Checks for correct permissions for audit logs.", rule_title=rule_title) }}}
+    <criteria operator="OR">
+      <criteria operator="AND" comment="log_file set">
+        <extend_definition comment="log file set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" negate="true" />
+
+        <criteria operator="OR">
+          <criteria operator="AND" comment="log_file set and log_group set to not root">
+            <criterion comment="log_group in auditd.conf is set" test_ref="test_auditd_conf_log_group_not_set" negate="true"/>
+            <criterion comment="default log_file and log_group set" test_ref="test_permissions_audit_log_directory_not_root"/>
+          </criteria>
+          <criteria operator="AND" comment="log_file set and log_group root">
+            <criterion comment="log_group in auditd.conf is not set" test_ref="test_auditd_conf_log_group_not_set"/>
+            <criterion comment="default log_file and log_group root" test_ref="test_permissions_audit_log_directory_root"/>
+          </criteria>
+        </criteria>
+
+      </criteria>
+      <criteria operator="AND" comment="log_file not set">
+        <extend_definition comment="log file not set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" />
+
+        <criteria operator="OR">
+          <criteria operator="AND" comment="default log_file and log_group set to not root">
+            <criterion comment="log_group in auditd.conf is set" test_ref="test_auditd_conf_log_group_not_set" negate="true"/>
+            <criterion comment="default log_file and log_group set" test_ref="test_permissions_default_audit_log_directory_not_root"/>
+          </criteria>
+          <criteria operator="AND" comment="default log_file and log_group root">
+            <criterion comment="log_group in auditd.conf is not set" test_ref="test_auditd_conf_log_group_not_set"/>
+            <criterion comment="default log_file and log_group root" test_ref="test_permissions_default_audit_log_directory_root"/>
+          </criteria>
+        </criteria>
+
+      </criteria>
+    </criteria>
+  </definition>
+
+
+  <ind:textfilecontent54_object id="object_auditd_conf_log_group_configured" comment="log_group is set" version="1">
+    <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ](\w+)$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test id="test_auditd_conf_log_group_not_set" check="all" check_existence="none_exist" comment="log_group not set" version="1">
+    <ind:object object_ref="object_auditd_conf_log_group_configured" />
+  </ind:textfilecontent54_test>
+
+  <local_variable id="audit_log_dir" datatype="string" version="1" comment="path to audit log directory">
+    <regex_capture pattern="^(.*)\/([^\/]+$)">
+      <variable_component var_ref="audit_log_file_path" />
+    </regex_capture>
+  </local_variable>
+
+  <!-- non default file and state 0700 -->
+  <unix:file_test check="all" check_existence="all_exist" comment="non default audit log dir mode 0700" id="test_permissions_audit_log_directory_root" version="1">
+    <unix:object object_ref="object_var_log_audit_directory_non_default_root" />
+    <unix:state state_ref="state_mode_0700" />
+  </unix:file_test>
+  <unix:file_object comment="non default audit log dir" id="object_var_log_audit_directory_non_default_root" version="1">
+    <unix:path operation="equals" var_ref="audit_log_dir" />
+    <unix:filename xsi:nil="true" />
+  </unix:file_object>
+
+  <!-- non default file and state 0750 -->
+  <unix:file_test check="all" check_existence="all_exist" comment="non default audit log dir mode 0700" id="test_permissions_audit_log_directory_not_root" version="1">
+    <unix:object object_ref="object_var_log_audit_directory_non_default_not_root" />
+    <unix:state state_ref="state_mode_0750" />
+  </unix:file_test>
+  <unix:file_object comment="non default audit log dir" id="object_var_log_audit_directory_non_default_not_root" version="1">
+    <unix:path operation="equals" var_ref="audit_log_dir" />
+    <unix:filename xsi:nil="true" />
+  </unix:file_object>
+
+  <!-- default file and state 0700 -->
+  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit mode 0700" id="test_permissions_default_audit_log_directory_root" version="1">
+    <unix:object object_ref="object_var_log_audit_directory_root" />
+    <unix:state state_ref="state_mode_0700" />
+  </unix:file_test>
+  <unix:file_object comment="/var/log/audit dir" id="object_var_log_audit_directory_root" version="1">
+    <unix:path>/var/log/audit</unix:path>
+    <unix:filename xsi:nil="true" />
+  </unix:file_object>
+
+  <!-- default file and state 0750 -->
+  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit mode 0750" id="test_permissions_default_audit_log_directory_not_root" version="1">
+    <unix:object object_ref="object_var_log_audit_directory_non_root" />
+    <unix:state state_ref="state_mode_0750" />
+  </unix:file_test>
+  <unix:file_object comment="/var/log/audit dir" id="object_var_log_audit_directory_non_root" version="1">
+    <unix:path>/var/log/audit</unix:path>
+    <unix:filename xsi:nil="true"/>
+  </unix:file_object>
+
+  <unix:file_state id="state_mode_0700" operator="AND" version="3">
+    <unix:suid datatype="boolean">false</unix:suid>
+    <unix:sgid datatype="boolean">false</unix:sgid>
+    <unix:sticky datatype="boolean">false</unix:sticky>
+    <unix:uread datatype="boolean">true</unix:uread>
+    <unix:uwrite datatype="boolean">true</unix:uwrite>
+    <unix:uexec datatype="boolean">true</unix:uexec>
+    <unix:gread datatype="boolean">false</unix:gread>
+    <unix:gwrite datatype="boolean">false</unix:gwrite>
+    <unix:gexec datatype="boolean">false</unix:gexec>
+    <unix:oread datatype="boolean">false</unix:oread>
+    <unix:owrite datatype="boolean">false</unix:owrite>
+    <unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+
+  <unix:file_state id="state_mode_0750" operator="AND" version="3">
+    <unix:suid datatype="boolean">false</unix:suid>
+    <unix:sgid datatype="boolean">false</unix:sgid>
+    <unix:sticky datatype="boolean">false</unix:sticky>
+    <unix:uread datatype="boolean">true</unix:uread>
+    <unix:uwrite datatype="boolean">true</unix:uwrite>
+    <unix:uexec datatype="boolean">true</unix:uexec>
+    <unix:gread datatype="boolean">true</unix:gread>
+    <unix:gwrite datatype="boolean">false</unix:gwrite>
+    <unix:gexec datatype="boolean">true</unix:gexec>
+    <unix:oread datatype="boolean">false</unix:oread>
+    <unix:owrite datatype="boolean">false</unix:owrite>
+    <unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+</def-group>

linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml

@@ -0,0 +1,42 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+  ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+  check_mode: False
+  failed_when: false
+  register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+  ansible.builtin.set_fact:
+      log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+  ansible.builtin.set_fact:
+      log_file: "/var/log/audit/audit.log"
+  when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file from log_file_line if configured"
+  ansible.builtin.set_fact:
+      log_file: "{{ log_file_line }}"
+  when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get all audit backup log file(s)"
+  ansible.builtin.find:
+      path: "{{ log_file | dirname }}"
+      patterns: "{{ log_file | basename }}.*"
+  register: backup_files
+
+- name: "{{{ rule_title }}} - Set root as owner to all audit backup log file(s)"
+  ansible.builtin.file:
+      path: "{{ item }}"
+      owner: root
+  loop: "{{ backup_files.files| map(attribute='path') | list }}"
+
+- name: "{{{ rule_title }}} - Set root as owner to audit log file"
+  ansible.builtin.file:
+      path: "{{ log_file }}"
+      owner: root

linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml

@@ -74,13 +74,13 @@ fixtext: |-
 
     If the log_group is not defined or it is set to root, configure the permissions the following way:
 
-    $ sudo chmod 0640 $log_file
-    $ sudo chmod 0440 $log_file.*
+    $ sudo chmod 0600 $log_file
+    $ sudo chmod 0400 $log_file.*
 
     Otherwise, configure the permisssions the following way:
 
-    $ sudo chmod 0600 $log_file
-    $ sudo chmod 0400 $log_file.*
+    $ sudo chmod 0640 $log_file
+    $ sudo chmod 0440 $log_file.*
 
 srg_requirement: |-
    {{{ full_name }}} audit log file must have mode 0640 or less permissive to prevent unauthorized access to the audit log.