Merge pull request #12359 from vojtapolasek/fix_audit_rhel10

Fix Audit related rules in RHEL 10
ComplianceAsCode · Sep 10, 2024 · d80b25c · d80b25c
2 parents ad62fc1 + daeb8e7
commit d80b25c
Show file tree

Hide file tree

Showing 87 changed files with 170 additions and 94 deletions.
diff --git a/...n/tests/syscalls_multiple_per_arg.pass.sh → ...uditctl_syscalls_multiple_per_arg.pass.sh b/...n/tests/syscalls_multiple_per_arg.pass.sh → ...uditctl_syscalls_multiple_per_arg.pass.sh
@@ -2,8 +2,7 @@
 # packages = audit
 # remediation = bash
 
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...cation/tests/syscalls_one_per_arg.pass.sh → ...sts/auditctl_syscalls_one_per_arg.pass.sh b/...cation/tests/syscalls_one_per_arg.pass.sh → ...sts/auditctl_syscalls_one_per_arg.pass.sh
@@ -2,8 +2,7 @@
 # packages = audit
 # remediation = bash
 
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...ation/tests/syscalls_one_per_line.pass.sh → ...ts/auditctl_syscalls_one_per_line.pass.sh b/...ation/tests/syscalls_one_per_line.pass.sh → ...ts/auditctl_syscalls_one_per_line.pass.sh
@@ -2,11 +2,9 @@
 # packages = audit
 # remediation = bash
 
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 
 # Delete everything that is not between "one per line" and "multiple per arg"
 sed '/# one per line/,/# multiple per arg/!d' test_audit.rules > /etc/audit/audit.rules
-
diff --git a/...t_rules_unsuccessful_file_modification/tests/augenrules_syscalls_multiple_per_arg.pass.sh b/...t_rules_unsuccessful_file_modification/tests/augenrules_syscalls_multiple_per_arg.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = audit
+# remediation = bash
+
+rm -f /etc/audit/rules.d/*
+
+# Deletes everything up do "one per line"
+# Then deletes everything from "one per arg" until end of file
+sed '/# one per line/,/# multiple per arg/d;/# one per arg/,$d' test_audit.rules > /etc/audit/rules.d/audit.rules
diff --git a/.../audit_rules_unsuccessful_file_modification/tests/augenrules_syscalls_one_per_arg.pass.sh b/.../audit_rules_unsuccessful_file_modification/tests/augenrules_syscalls_one_per_arg.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = audit
+# remediation = bash
+
+rm -f /etc/audit/rules.d/*
+
+# Delete everything that is between "one per line" and "one per arg"
+sed '/# one per line/,/# one per arg/d' test_audit.rules > /etc/audit/rules.d/audit.rules
diff --git a/...audit_rules_unsuccessful_file_modification/tests/augenrules_syscalls_one_per_line.pass.sh b/...audit_rules_unsuccessful_file_modification/tests/augenrules_syscalls_one_per_line.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = audit
+# remediation = bash
+
+rm -f /etc/audit/rules.d/*
+
+# Delete everything that is not between "one per line" and "multiple per arg"
+sed '/# one per line/,/# multiple per arg/!d' test_audit.rules > /etc/audit/rules.d/audit.rules
diff --git a/...oading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_multiple_per_arg.pass.sh b/...oading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_multiple_per_arg.pass.sh
@@ -1,9 +1,7 @@
 #!/bin/bash
 # packages = audit
 
-
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...ule_loading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_arg.pass.sh b/...ule_loading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_arg.pass.sh
@@ -1,9 +1,7 @@
 #!/bin/bash
 # packages = audit
 
-
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...le_loading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_line.pass.sh b/...le_loading/audit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_line.pass.sh
@@ -1,9 +1,7 @@
 #!/bin/bash
 # packages = audit
 
-
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...udit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_line_one_missing.fail.sh b/...udit_rules_kernel_module_loading/tests/auditctl_syscalls_one_per_line_one_missing.fail.sh
@@ -1,9 +1,7 @@
 #!/bin/bash
 # packages = audit
 
-
-# Use auditctl, on RHEL7, default is to use augenrules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 

diff --git a/...rules/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_correct.pass.sh b/...rules/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_correct.pass.sh
@@ -2,5 +2,7 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/log/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct.pass.sh
diff --git a/...s/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_correct_cis.pass.sh b/...s/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_correct_cis.pass.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct.pass.sh
diff --git a/..._events/audit_rules_login_events_faillock/tests/auditctl_correct_extra_permission.pass.sh b/..._events/audit_rules_login_events_faillock/tests/auditctl_correct_extra_permission.pass.sh
@@ -2,5 +2,7 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/log/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct_extra_permission.pass.sh
diff --git a/...nts/audit_rules_login_events_faillock/tests/auditctl_correct_extra_permission_cis.pass.sh b/...nts/audit_rules_login_events_faillock/tests/auditctl_correct_extra_permission_cis.pass.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct_extra_permission.pass.sh
diff --git a/...login_events/audit_rules_login_events_faillock/tests/auditctl_correct_without_key.pass.sh b/...login_events/audit_rules_login_events_faillock/tests/auditctl_correct_without_key.pass.sh
@@ -2,5 +2,7 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/log/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct_without_key.pass.sh
diff --git a/...n_events/audit_rules_login_events_faillock/tests/auditctl_correct_without_key_cis.pass.sh b/...n_events/audit_rules_login_events_faillock/tests/auditctl_correct_without_key_cis.pass.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_correct_without_key.pass.sh
diff --git a/...it_login_events/audit_rules_login_events_faillock/tests/auditctl_remove_all_rules.fail.sh b/...it_login_events/audit_rules_login_events_faillock/tests/auditctl_remove_all_rules.fail.sh
@@ -2,4 +2,6 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 . $SHARED/audit_rules_login_events/auditctl_remove_all_rules.fail.sh
diff --git a/...ogin_events/audit_rules_login_events_faillock/tests/auditctl_remove_all_rules_cis.fail.sh b/...ogin_events/audit_rules_login_events_faillock/tests/auditctl_remove_all_rules_cis.fail.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_remove_all_rules.fail.sh
diff --git a/...es/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule.fail.sh b/...es/audit_login_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule.fail.sh
@@ -2,5 +2,7 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/log/faillock"
 . $SHARED/audit_rules_login_events/auditctl_wrong_rule.fail.sh
diff --git a/...udit_login_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_cis.fail.sh b/...udit_login_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_cis.fail.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_wrong_rule.fail.sh
diff --git a/...in_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_without_key.fail.sh b/...in_events/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_without_key.fail.sh
@@ -2,5 +2,7 @@
 # packages = audit
 # platform = multi_platform_all
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/log/faillock"
 . $SHARED/audit_rules_login_events/auditctl_wrong_rule_without_key.fail.sh
diff --git a/...vents/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_without_key_cis.fail.sh b/...vents/audit_rules_login_events_faillock/tests/auditctl_wrong_rule_without_key_cis.fail.sh
@@ -3,5 +3,7 @@
 # platform = Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
 # profiles = xccdf_org.ssgproject.content_profile_cis
 
+{{{ setup_auditctl_environment() }}}
+
 path="/var/run/faillock"
 . $SHARED/audit_rules_login_events/auditctl_wrong_rule_without_key.fail.sh
diff --git a/.../audit_privileged_commands/audit_rules_privileged_commands/tests/auditctl_default.fail.sh b/.../audit_privileged_commands/audit_rules_privileged_commands/tests/auditctl_default.fail.sh
@@ -2,4 +2,4 @@
 # packages = audit
 # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8
 
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
diff --git a/...t_privileged_commands/audit_rules_privileged_commands/tests/auditctl_missing_rule.fail.sh b/...t_privileged_commands/audit_rules_privileged_commands/tests/auditctl_missing_rule.fail.sh
@@ -2,6 +2,7 @@
 # packages = audit
 # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8
 
+{{{ setup_auditctl_environment() }}}
+
 ./generate_privileged_commands_rule.sh {{{ uid_min }}} privileged /etc/audit/audit.rules
 sed -i '/newgrp/d' /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...audit_privileged_commands/audit_rules_privileged_commands/tests/auditctl_one_rule.fail.sh b/...audit_privileged_commands/audit_rules_privileged_commands/tests/auditctl_one_rule.fail.sh
@@ -2,5 +2,6 @@
 # packages = audit
 # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8
 
+{{{ setup_auditctl_environment() }}}
+
 echo "-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -k privileged" >> /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...ivileged_commands/audit_rules_privileged_commands/tests/auditctl_rules_configured.pass.sh b/...ivileged_commands/audit_rules_privileged_commands/tests/auditctl_rules_configured.pass.sh
@@ -2,5 +2,6 @@
 # packages = audit
 # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8
 
+{{{ setup_auditctl_environment() }}}
+
 ./generate_privileged_commands_rule.sh {{{ uid_min }}} privileged /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...eged_commands/audit_rules_privileged_commands/tests/auditctl_rules_without_perm_x.pass.sh b/...eged_commands/audit_rules_privileged_commands/tests/auditctl_rules_without_perm_x.pass.sh
@@ -2,6 +2,7 @@
 # packages = audit
 # platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8
 
+{{{ setup_auditctl_environment() }}}
+
 ./generate_privileged_commands_rule.sh {{{ uid_min }}} privileged /etc/audit/audit.rules
 sed -i -E 's/^(.*path=[[:graph:]]+) -F perm=x(.*$)/\1\2/' /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...it_rules_privileged_commands_modprobe/tests/auditclt_modprobe_correct_without_key.pass.sh b/...it_rules_privileged_commands_modprobe/tests/auditclt_modprobe_correct_without_key.pass.sh
diff --git a/...e/tests/auditclt_modprobe_correct.pass.sh → ...e/tests/auditctl_modprobe_correct.pass.sh b/...e/tests/auditclt_modprobe_correct.pass.sh → ...e/tests/auditctl_modprobe_correct.pass.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_auditctl_environment() }}}
+
 echo "-w /sbin/modprobe -p x -k modules" >> /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...it_rules_privileged_commands_modprobe/tests/auditctl_modprobe_correct_without_key.pass.sh b/...it_rules_privileged_commands_modprobe/tests/auditctl_modprobe_correct_without_key.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = audit
+
+{{{ setup_auditctl_environment() }}}
+
+echo "-w /sbin/modprobe -p x" >> /etc/audit/audit.rules
diff --git a/...audit_rules_privileged_commands_modprobe/tests/auditctl_modprobe_remove_all_rules.fail.sh b/...audit_rules_privileged_commands_modprobe/tests/auditctl_modprobe_remove_all_rules.fail.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_auditctl_environment() }}}
+
 rm -f /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...ests/auditclt_modprobe_wrong_rule.fail.sh → ...ests/auditctl_modprobe_wrong_rule.fail.sh b/...ests/auditclt_modprobe_wrong_rule.fail.sh → ...ests/auditctl_modprobe_wrong_rule.fail.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_auditctl_environment() }}}
+
 echo "-w /sbin/something -p x -k modules" >> /etc/audit/audit.rules
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
diff --git a/...uide/auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_correct.pass.sh b/...uide/auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_correct.pass.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-e 2" > /etc/audit/audit.rules
diff --git a/...uide/auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_missing.fail.sh b/...uide/auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_missing.fail.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "some value" > /etc/audit/audit.rules
diff --git a/.../auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_wrong_value.fail.sh b/.../auditing/auditd_configure_rules/audit_rules_immutable/tests/auditctl_wrong_value.fail.sh
@@ -2,7 +2,7 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-e 1" > /etc/audit/audit.rules
 
diff --git a/...diting/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_correct.pass.sh b/...diting/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_correct.pass.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /etc/selinux/ -p wa -k MAC-policy" > /etc/audit/audit.rules
diff --git a/...d_configure_rules/audit_rules_mac_modification/tests/auditctl_correct_without_key.pass.sh b/...d_configure_rules/audit_rules_mac_modification/tests/auditctl_correct_without_key.pass.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /etc/selinux/ -p wa" > /etc/audit/audit.rules
diff --git a/...diting/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_missing.fail.sh b/...diting/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_missing.fail.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "some value" > /etc/audit/audit.rules
diff --git a/...ng/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_wrong_value.fail.sh b/...ng/auditd_configure_rules/audit_rules_mac_modification/tests/auditctl_wrong_value.fail.sh
@@ -2,7 +2,7 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /etc/passwd -p w -k MAC-policy" > /etc/audit/audit.rules
 
diff --git a/...itd_configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_correct.pass.sh b/...itd_configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_correct.pass.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /usr/share/selinux/ -p wa -k MAC-policy" > /etc/audit/audit.rules
diff --git a/...e_rules/audit_rules_mac_modification_usr_share/tests/auditctl_correct_without_key.pass.sh b/...e_rules/audit_rules_mac_modification_usr_share/tests/auditctl_correct_without_key.pass.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /usr/share/selinux/ -p wa" > /etc/audit/audit.rules
diff --git a/...itd_configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_missing.fail.sh b/...itd_configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_missing.fail.sh
@@ -2,6 +2,6 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "some value" > /etc/audit/audit.rules
diff --git a/...configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_wrong_value.fail.sh b/...configure_rules/audit_rules_mac_modification_usr_share/tests/auditctl_wrong_value.fail.sh
@@ -2,7 +2,7 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 echo "-w /etc/passwd -p w -k MAC-policy" > /etc/audit/audit.rules
 
diff --git a/...nfigure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh b/...nfigure_rules/audit_rules_networkconfig_modification/tests/auditctl_correct_rules.pass.sh
@@ -3,7 +3,7 @@
 
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 
 rm -rf /etc/audit/rules.d/*

diff --git a/...s_networkconfig_modification/tests/auditctl_correct_rules_watch_rules_without_key.pass.sh b/...s_networkconfig_modification/tests/auditctl_correct_rules_watch_rules_without_key.pass.sh
@@ -3,7 +3,7 @@
 
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 
 rm -rf /etc/audit/rules.d/*

diff --git a/...auditing/auditd_configure_rules/audit_rules_session_events/tests/auditctl_correct.pass.sh b/...auditing/auditd_configure_rules/audit_rules_session_events/tests/auditctl_correct.pass.sh
@@ -2,7 +2,7 @@
 # packages = audit
 
 # use auditctl
-sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/auditctl%" /usr/lib/systemd/system/auditd.service
+{{{ setup_auditctl_environment() }}}
 
 rm -rf /etc/audit/rules.d/*
 rm /etc/audit/audit.rules