Skip to content

fix: add auditd config existence checks to linux security policy#2313

Open
tas50 wants to merge 1 commit intomainfrom
fix-auditd-existence-checks
Open

fix: add auditd config existence checks to linux security policy#2313
tas50 wants to merge 1 commit intomainfrom
fix-auditd-existence-checks

Conversation

@tas50
Copy link
Copy Markdown
Member

@tas50 tas50 commented Apr 1, 2026

Summary

  • Adds file("/etc/audit/auditd.conf").exists precondition to all auditd rule checks in the Linux security policy
  • Prevents confusing errors on systems where auditd is not installed

Test plan

  • Run cnspec policy lint content/mondoo-linux-security.mql.yaml
  • Verify checks pass on systems with auditd installed
  • Verify checks gracefully handle systems without auditd

🤖 Generated with Claude Code

Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adds auditd config existence checks as preconditions to audit policy queries; looks correct and consistent.

Comment thread content/mondoo-linux-security.mql.yaml
Comment thread content/mondoo-linux-security.mql.yaml
Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Straightforward addition of auditd config existence checks; no bugs or security issues found.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 1, 2026

Test Results

  1 files  ±0   38 suites  ±0   1m 16s ⏱️ -16s
709 tests ±0  708 ✅ ±0  1 💤 ±0  0 ❌ ±0 
710 runs  ±0  709 ✅ ±0  1 💤 ±0  0 ❌ ±0 

Results for commit 229a22b. ± Comparison against base commit 7f9a92a.

♻️ This comment has been updated with latest results.

Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test assertions relaxed to handle Kubernetes namespace auto-discovery producing multiple reports.

Comment thread content/bundles_test.go
@tas50 tas50 force-pushed the fix-auditd-existence-checks branch 2 times, most recently from 71c791e to 5b6a44f Compare April 23, 2026 18:32
Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adds auditd config existence pre-checks to Linux security policy queries, preventing errors on systems without auditd installed.

Comment thread policy/scan/local_scanner_test.go
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@tas50 tas50 force-pushed the fix-auditd-existence-checks branch from 5b6a44f to 229a22b Compare April 28, 2026 05:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant