Configure audit=1 for more accurate auid auditing

[jaredledvina]

Is your feature request related to a problem? Please describe.
Currently, in the default audit logs from this project, there's a ton of events with auid=4294967295 which is because they start before the audit daemon is up.

ausearch --uid-effective 4294967295 --just-one
----
time->Tue Jan  7 01:12:46 2020
type=DAEMON_START msg=audit(1578359566.985:2837): op=start ver=2.8.4 format=raw kernel=4.19.0-6-amd64 auid=4294967295 pid=28320 uid=0 ses=4294967295 subj=unconfined  res=success

Describe the solution you'd like
Add audit=1 as an additional grub kernel parameter

Describe alternatives you've considered
N/A at that time

Additional context
See https://manpages.debian.org/testing/auditd/auditd.8.en.html

NOTES
A boot param of audit=1 should be added to ensure that all processes that run before the audit daemon starts is marked as auditable by the kernel. Not doing that will make a few processes impossible to properly audit.

[rndmh3ro]

Hey @jaredledvina,

I don't know if I want to start configuring grub (and grub2, syslinux?) with this role. That'd be a lot of overhead (testing with docker would be impossible) for such a "small" feature.
However adding this to the README is something I could get behind.

What do you think?

[jaredledvina]

Hey @rndmh3ro,

Yeah, I think that's fair. That way folks who are looking to improve the logging accuracy can simply configure it. It also requires a reboot to take effect, so I think that's totally fair.

[rndmh3ro]

Good to hear! :) Do you want to create a PR for this?

[jaredledvina]

Yep!