resource/auditd_rules: update rule list format

[arlimus]

See: https://docs.chef.io/inspec_reference.html

describe auditd_rules do
  its('LIST_RULES') { should eq [
    'exit,always syscall=rmdir,unlink',
    'exit,always auid=1001 (0x3e9) syscall=open',
    'exit,always watch=/etc/group perm=wa',
    'exit,always watch=/etc/passwd perm=wa',
    'exit,always watch=/etc/shadow perm=wa',
    'exit,always watch=/etc/sudoers perm=wa',
    'exit,always watch=/etc/secret_directory perm=r',
  ] }
end

it should be always,exit?

[srenatus]

Actually, our mock does not at all resemble what CentOS 7.1. auditctl -l returns:

[vagrant@default-centos-71 ~]$ sudo /sbin/auditctl -l
-a always,exit -F arch=b32 -S open,openat -F exit=-EACCES -F key=access

[srenatus]

https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-October/006237.html This is how/when it happened.

[srenatus]

[root@default-centos-67 audit-2.3.7]# auditctl -l
-w /var/log/audit/ -p rwxa -k LOG_audit
-w /etc/audit/ -p wa -k CFG_audit
-w /etc/sysconfig/auditd -p wa -k CFG_auditd.conf
-w /etc/libaudit.conf -p wa -k CFG_libaudit.conf
-w /etc/audisp/ -p wa -k CFG_audisp
-a always,exit -F arch=i386 -S mknod,mknodat
-a always,exit -F arch=x86_64 -S mknod,mknodat

Looks like the old syntax is gone. auditd_rules needs an update.

[chris-rock]

@arlimus @srenatus is this done?

[srenatus]

@chris-rock yup 😄