Handle immutability of config
james-stocks opened this issue · comments
This cookbook (at least if you set the cis rules) will include -e 2 config, making the auditd config immutable.
This means that if the cookbook is run repeatedly in Chef runs; the notified restart of the auditd service will have no effect on the current config.
When auditd is configured to be immutable; a restart of the host is needed.
This cookbook should possibly do something to address this.
Maybe a warning/failure if this happens. Maybe control over the immutability through attributes.
I think we can notify the host to reboot if needed; but this should definitely be attribute controlled and disabled by default!
Agreed. We had to duplicate the service 'auditd' resource and add an ignore_failure to it in a wrapper cookbook as a workaround.