# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.
#
# Optimized for: Debian 12/13 on EC2 (x86_64 and arm64)
# - No 32-bit (arch=b32) rules: EC2 is 64-bit only
# - No legacy syscalls: modern glibc uses *at variants
# - File watches disabled on arm64 due to auditd 4.0.2 bug (Debian #1111161)

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 320

# Feel free to add below this line. See auditctl man page

# CIS 4.1.4 - Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time-change
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/localtime -p wa -k time-change
<% end -%>

# CIS 4.1.5 - Identity changes
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
<% else -%>
# WARN: Identity file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.6 - System locale
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
<% else -%>
# WARN: System locale file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.7 - MAC policy (AppArmor for Debian, SELinux kept for compatibility)
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
-w /etc/selinux/ -p wa -k MAC-policy
-w /usr/share/selinux/ -p wa -k MAC-policy
<% else -%>
# WARN: MAC-policy file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.8 - Login events
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
<% else -%>
# WARN: Login file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.9 - Session events
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins
<% else -%>
# WARN: Session file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.10 - Permission modifications
# Using *at variants only - modern glibc uses these internally
-a always,exit -F arch=b64 -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchown -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod

# CIS 4.4.11 - Unauthorized access attempts
# Using openat/ftruncate only - modern glibc uses these internally
-a always,exit -F arch=b64 -S openat -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S openat -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

# CIS 4.1.12 - Privileged commands
# This rule causes chef-client run to time out in file systems with large number of files
# It has been temporarily disabled as part of ticket WIZ-724
#<%= @ciscat_privileged_command_rules %>

# CIS 4.1.13 - Mount operations (added umount2 for completeness)
-a always,exit -F arch=b64 -S mount -S umount2 -F auid>=1000 -F auid!=4294967295 -k mounts

# CIS 4.1.14 - File deletion events
# Using *at variants only - modern glibc uses these internally
-a always,exit -F arch=b64 -S unlinkat -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

# CIS 4.1.15 - Sudoers changes
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
<% else -%>
# WARN: Sudoers file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.16 - Sudo log
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /var/log/sudo.log -p wa -k actions
<% else -%>
# WARN: sudo.log file watch skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 4.1.17 - Kernel module loading
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
<% else -%>
# WARN: Module binary watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>
-a always,exit -F arch=b64 -S init_module -S delete_module -S finit_module -k modules

# =============================================================================
# ADDITIONAL RULES - Beyond CIS baseline for enhanced security monitoring
# =============================================================================

# SSH Configuration - Critical for EC2 (primary access method)
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/sshd_config.d/ -p wa -k sshd_config
-w /etc/ssh/ssh_config -p wa -k ssh_config
-w /etc/ssh/ssh_config.d/ -p wa -k ssh_config
<% else -%>
# WARN: SSH config file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# PAM Configuration - Authentication system changes
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/pam.d/ -p wa -k pam_config
-w /etc/security/limits.conf -p wa -k pam_config
-w /etc/security/limits.d/ -p wa -k pam_config
-w /etc/security/access.conf -p wa -k pam_config
<% else -%>
# WARN: PAM config file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Cron/Scheduled Tasks - Common persistence mechanism
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/cron.d/ -p wa -k cron
-w /etc/cron.daily/ -p wa -k cron
-w /etc/cron.hourly/ -p wa -k cron
-w /etc/cron.weekly/ -p wa -k cron
-w /etc/cron.monthly/ -p wa -k cron
-w /etc/crontab -p wa -k cron
-w /var/spool/cron/ -p wa -k cron
<% else -%>
# WARN: Cron file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Systemd Service/Timer Changes - Modern persistence mechanism
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/systemd/system/ -p wa -k systemd
-w /usr/lib/systemd/system/ -p wa -k systemd
-w /run/systemd/system/ -p wa -k systemd
<% else -%>
# WARN: Systemd file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Network Configuration Changes
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/network/ -p wa -k network_config
-w /etc/netplan/ -p wa -k network_config
-w /etc/NetworkManager/ -p wa -k network_config
-w /etc/resolv.conf -p wa -k network_config
<% else -%>
# WARN: Network config file watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Suspicious Syscalls - Exploitation and privilege escalation indicators
# ptrace: process injection, debugging, container escapes
# personality: can disable ASLR (security feature)
-a always,exit -F arch=b64 -S ptrace -F auid>=1000 -F auid!=4294967295 -k tracing
-a always,exit -F arch=b64 -S personality -F auid>=1000 -F auid!=4294967295 -k suspicious

# BPF - eBPF can be used for rootkits and security bypass
-a always,exit -F arch=b64 -S bpf -k bpf

# Process Execution - Track all executed commands (high volume but valuable)
# Uncomment if you want full command logging (increases log volume significantly)
#-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=4294967295 -k exec

# Package Management - Detect unauthorized software installation
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /usr/bin/apt -p x -k package_mgmt
-w /usr/bin/apt-get -p x -k package_mgmt
-w /usr/bin/dpkg -p x -k package_mgmt
-w /usr/bin/aptitude -p x -k package_mgmt
<% else -%>
# WARN: Package management watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Audit Log Protection - Monitor access to audit logs themselves
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /var/log/audit/ -p wa -k audit_log
-w /etc/audit/ -p wa -k audit_config
<% else -%>
# WARN: Audit log watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# Shell Configuration - Persistence via shell profiles
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/profile -p wa -k shell_config
-w /etc/profile.d/ -p wa -k shell_config
-w /etc/bash.bashrc -p wa -k shell_config
-w /etc/bashrc -p wa -k shell_config
-w /etc/zsh/ -p wa -k shell_config
<% else -%>
# WARN: Shell config watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# LD Preload - Common rootkit/library injection technique
<% if node['kernel']['machine'] == 'x86_64' -%>
-w /etc/ld.so.conf -p wa -k ld_preload
-w /etc/ld.so.conf.d/ -p wa -k ld_preload
-w /etc/ld.so.preload -p wa -k ld_preload
<% else -%>
# WARN: LD preload watches skipped on arm64 due to auditd 4.0.2 bug (Debian #1111161)
<% end -%>

# CIS 5.2.18 - Make audit configuration immutable (uncomment when ready)
#-e 2