Stabilization: Use symbolic file mode for /etc/audit/auditd.conf

[jan-cerny]

Keeps permissions intact if they are already stricter than expected. Also, avoids the implicit conversion of the file mode from octal number (0640) to decimal number (416).

Fixes: failing rule file_permissions_audit_configuration_stig in contest tests /hardening/ansible/stig, /hardening/host-os/ansible/stig on RHEL 8.10, 9.2 and 9.9.

This PR is a backport of #15074 to the stabilization branch.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action
@@ -28,7 +28,7 @@
     regexp: ^\s*disk_error_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig
@@ -26,7 +26,7 @@
     regexp: ^\s*disk_error_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action
@@ -28,7 +28,7 @@
     regexp: ^\s*disk_full_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig
@@ -26,7 +26,7 @@
     regexp: ^\s*disk_full_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
@@ -31,7 +31,7 @@
     line: action_mail_acct = {{ var_auditd_action_mail_acct }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
@@ -33,7 +33,7 @@
     regexp: ^\s*admin_space_left_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage
@@ -27,7 +27,7 @@
     regexp: ^\s*admin_space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_flush' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_flush
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_flush
@@ -25,7 +25,7 @@
     line: flush = {{ var_auditd_flush }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file
@@ -26,7 +26,7 @@
     line: max_log_file = {{ var_auditd_max_log_file }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action
@@ -29,7 +29,7 @@
     regexp: ^\s*max_log_file_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig
@@ -27,7 +27,7 @@
     regexp: ^\s*max_log_file_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs
@@ -27,7 +27,7 @@
     regexp: ^\s*num_logs\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left
@@ -30,7 +30,7 @@
     regexp: ^\s*space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
@@ -33,7 +33,7 @@
     regexp: ^\s*space_left_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage
@@ -29,7 +29,7 @@
     regexp: ^\s*space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_freq' differs.
--- xccdf_org.ssgproject.content_rule_auditd_freq
+++ xccdf_org.ssgproject.content_rule_auditd_freq
@@ -24,7 +24,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -35,7 +35,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -44,7 +44,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: freq = {{ var_auditd_freq }}
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_local_events' differs.
--- xccdf_org.ssgproject.content_rule_auditd_local_events
+++ xccdf_org.ssgproject.content_rule_auditd_local_events
@@ -20,7 +20,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -31,7 +31,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -40,7 +40,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: local_events = yes
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_log_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_log_format
+++ xccdf_org.ssgproject.content_rule_auditd_log_format
@@ -21,7 +21,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -32,7 +32,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -41,7 +41,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: log_format = ENRICHED
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_name_format
+++ xccdf_org.ssgproject.content_rule_auditd_name_format
@@ -49,6 +49,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -59,6 +60,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -67,6 +69,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       line: name_format = {{ auditd_name_format_split }}
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_overflow_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_overflow_action
+++ xccdf_org.ssgproject.content_rule_auditd_overflow_action
@@ -20,6 +20,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -30,6 +31,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -38,6 +40,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       line: overflow_action = syslog
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_write_logs' differs.
--- xccdf_org.ssgproject.content_rule_auditd_write_logs
+++ xccdf_org.ssgproject.content_rule_auditd_write_logs
@@ -19,7 +19,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -30,7 +30,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -39,7 +39,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: write_logs = yes
       state: present
   when:

[Mab879]

/packit rebuild-failed

[vojtapolasek]

LGTM