From 298d5215e3b5c7ea9a2c9ee398f50c8428e99ffd Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Thu, 10 Sep 2026 10:06:46 +0100
Subject: [PATCH 1/5] Allow space-starting entries in audit.conf

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../ansible/shared.yml                        |  2 +-
 .../bash/shared.sh                            | 10 +++++-----
 .../tests/correct_value.pass.sh               | 12 ++++++-----
 .../tests/wrong_value.fail.sh                 | 20 +++++++++++--------
 .../oval/auditd_conf_log_file_not_set.xml     |  4 ++--
 5 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
index 58a7de295388..8d2d4c4081bb 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
@@ -5,7 +5,7 @@
 # disruption = low
 
 - name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
-  ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+  ansible.builtin.command: grep -iE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf
   check_mode: False
   failed_when: false
   changed_when: false
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
index 0f74bf2767b3..2308a7a400c6 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
@@ -1,8 +1,8 @@
 # platform = multi_platform_all
 
-if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
-    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
-    chown root $FILE*
-else
-    chown root /var/log/audit/audit.log*
+if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
+    FILE=$(awk -F "=" '/^[[:space:]]*log_file[[:space:]]*=/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
 fi
+
+FILE=${FILE:-/var/log/audit/audit.log}
+chown root "$(dirname "$FILE")"/*
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
index 4309570778f8..cf1e73bd21b1 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
@@ -4,15 +4,17 @@
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
 echo "log_file = /var/log/audit/audit2.log" >> /etc/audit/auditd.conf
 
-if grep -iwq "log_file" /etc/audit/auditd.conf; then
-    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
-else
-    FILE="/var/log/audit/audit.log"
+if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
+    FILE=$(awk -F "=" '/^[[:space:]]*log_file[[:space:]]*=/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
 fi
 
+FILE=${FILE:-/var/log/audit/audit.log}
+
 useradd testuser_123
 touch "/var/log/audit/audit2.log"
 touch "/var/log/audit/audit.log"
 
-chown root $FILE*
+for f in $FILE; do
+    chown root "${f}"*
+done
 chown testuser_123 "/var/log/audit/audit.log"
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
index d597ca07f139..1aa9085060fb 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
@@ -4,21 +4,25 @@
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
 echo "log_file = /var/log/audit/audit2.log" >> /etc/audit/auditd.conf
 
-if grep -iwq "log_file" /etc/audit/auditd.conf; then
-    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
-else
-    FILE="/var/log/audit/audit.log"
+if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
+    FILE=$(awk -F "=" '/^[[:space:]]*log_file[[:space:]]*=/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
 fi
 
+FILE=${FILE:-/var/log/audit/audit.log}
+
 useradd testuser_123
 
 touch "/var/log/audit/audit.log"
 chown root "/var/log/audit/audit.log"
 
 {{% if product in ["ol8", "rhel8"] %}}
-touch $FILE
-chown testuser_123 $FILE
+for f in $FILE; do
+    touch "$f"
+    chown testuser_123 "$f"
+done
 {{% else %}}
-touch $FILE.1
-chown testuser_123 $FILE.1
+for f in $FILE; do
+    touch "${f}.1"
+    chown testuser_123 "${f}.1"
+done
 {{% endif %}}
diff --git a/shared/checks/oval/auditd_conf_log_file_not_set.xml b/shared/checks/oval/auditd_conf_log_file_not_set.xml
index dc7a5be9bf30..76e4fb67e96c 100644
--- a/shared/checks/oval/auditd_conf_log_file_not_set.xml
+++ b/shared/checks/oval/auditd_conf_log_file_not_set.xml
@@ -20,12 +20,12 @@
 
   <ind:textfilecontent54_object id="object_auditd_conf_log_file" version="1">
     <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^(log_file\s*=\s*.*)$</ind:pattern>
+    <ind:pattern operation="pattern match">^\s*(log_file\s*=\s*.*)$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <local_variable id="audit_log_file_path" datatype="string" version="1" comment="path to audit log files">
-    <regex_capture pattern="^log_file\s*=\s*(.*)">
+    <regex_capture pattern="^\s*log_file\s*=\s*(.*)">
       <object_component item_field="subexpression" object_ref="object_auditd_conf_log_file" />
     </regex_capture>
   </local_variable>

From a2385a07bda6e373c9040c51ca3dd45ecc9aec3b Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Thu, 10 Sep 2026 14:01:13 +0100
Subject: [PATCH 2/5] Check effective log file in oval for Ubuntu

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../oval/shared.xml                           | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
index 15495801308c..7af6c35c5c0b 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/oval/shared.xml
@@ -6,7 +6,7 @@
         <extend_definition comment="log_file not set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" negate="true" />
         <criterion comment="audit log files are root owned" test_ref="test_user_ownership_audit_log_files" />
       </criteria>
-      {{% if "ol" in families or "rhel" in product %}}
+      {{% if "ol" in families or "rhel" in product or "ubuntu" in product %}}
       <criteria operator="AND" comment="log_file not set">
         <extend_definition comment="log_file not set in auditd.conf"
           definition_ref="auditd_conf_log_file_not_set"/>
@@ -18,17 +18,31 @@
       {{% endif %}}
     </criteria>
   </definition>
-  
+
   <unix:file_test check="all" check_existence="none_exist" comment="audit log files uid root" id="test_user_ownership_audit_log_files" version="1">
     <unix:object object_ref="object_user_ownership_audit_log_files" />
   </unix:file_test>
 
   <unix:file_object comment="audit log files" id="object_user_ownership_audit_log_files" version="1">
+    {{% if "ubuntu" in product %}}
+    <unix:filepath operation="pattern match" var_ref="audit_log_file_path_regex" />
+    {{% else %}}
     <unix:filepath operation="pattern match" var_ref="audit_log_file_path" />
+    {{% endif %}}
     <filter action="include">state_owner_not_root_var_log_audit</filter>
   </unix:file_object>
-  
-  {{% if "ol" in families or "rhel" in product %}}
+
+    <local_variable id="audit_log_file_path_regex" datatype="string" version="1" comment="regex matching base audit log path and rotated files">
+    <concat>
+        <literal_component>^</literal_component>
+        <escape_regex>
+        <variable_component var_ref="audit_log_file_path" />
+        </escape_regex>
+        <literal_component>.*$</literal_component>
+    </concat>
+    </local_variable>
+
+  {{% if "ol" in families or "rhel" in product or "ubuntu" in product %}}
   <unix:file_test check="all" check_existence="none_exist"
       comment="var/log/audit/audit.log file uid root"
       id="test_user_ownership_audit_default_log_files" version="1">
@@ -37,7 +51,12 @@
 
   <unix:file_object comment="audit log files" id="object_user_ownership_audit_default_log_files"
       version="1">
+    {{% if "ol" in families or "rhel" in product %}}
     <unix:filepath operation="equals">/var/log/audit/audit.log</unix:filepath>
+    {{% else %}}
+    <unix:path>/var/log/audit</unix:path>
+    <unix:filename operation="pattern match">^audit\.log.*$</unix:filename>
+    {{% endif %}}
     <filter action="include">state_owner_not_root_var_log_audit</filter>
   </unix:file_object>
   {{% else %}}

From 17ef8fee46a1867fd3fd31eb727407cce8441ac3 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Thu, 10 Sep 2026 16:54:11 +0100
Subject: [PATCH 3/5] Simplfy test scripts

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../tests/correct_value.pass.sh               | 18 +++++----------
 .../tests/correct_value_default_file.pass.sh  |  8 +++++--
 .../tests/wrong_value.fail.sh                 | 22 ++++++-------------
 .../tests/wrong_value_default_file.fail.sh    |  2 ++
 4 files changed, 21 insertions(+), 29 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
index cf1e73bd21b1..4e9c27be43bd 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
@@ -4,17 +4,11 @@
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
 echo "log_file = /var/log/audit/audit2.log" >> /etc/audit/auditd.conf
 
-if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
-    FILE=$(awk -F "=" '/^[[:space:]]*log_file[[:space:]]*=/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
-fi
-
-FILE=${FILE:-/var/log/audit/audit.log}
-
 useradd testuser_123
-touch "/var/log/audit/audit2.log"
-touch "/var/log/audit/audit.log"
+mkdir -p /var/log/audit
+touch /var/log/audit/audit2.log
+touch /var/log/audit/audit2.log.1
+touch /var/log/audit/audit.log
 
-for f in $FILE; do
-    chown root "${f}"*
-done
-chown testuser_123 "/var/log/audit/audit.log"
+chown root /var/log/audit/audit2.log*
+chown testuser_123 /var/log/audit/audit.log
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
index 0c30387f65f3..433159dfe54b 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
@@ -3,8 +3,12 @@
 # packages = audit
 
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
+
 useradd testuser_123
+mkdir -p /var/log/audit
+touch /var/log/audit/audit.log
+touch /var/log/audit/audit.log.1
 touch "/var/log/audit/audit2.log"
 
-chown root "/var/log/audit/audit.log"
-chown testuser_123 "/var/log/audit/audit2.log"
+chown root /var/log/audit/audit.log*
+chown testuser_123 /var/log/audit/audit2.log
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
index 1aa9085060fb..677dedaba5f0 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value.fail.sh
@@ -4,25 +4,17 @@
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
 echo "log_file = /var/log/audit/audit2.log" >> /etc/audit/auditd.conf
 
-if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
-    FILE=$(awk -F "=" '/^[[:space:]]*log_file[[:space:]]*=/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
-fi
-
-FILE=${FILE:-/var/log/audit/audit.log}
+FILE="/var/log/audit/audit2.log"
 
 useradd testuser_123
+mkdir -p /var/log/audit
 
 touch "/var/log/audit/audit.log"
 chown root "/var/log/audit/audit.log"
 
-{{% if product in ["ol8", "rhel8"] %}}
-for f in $FILE; do
-    touch "$f"
-    chown testuser_123 "$f"
-done
-{{% else %}}
-for f in $FILE; do
-    touch "${f}.1"
-    chown testuser_123 "${f}.1"
-done
+touch "$FILE"
+chown testuser_123 "$FILE"
+{{% if product not in ["ol8", "rhel8"] %}}
+touch "$FILE.1"
+chown testuser_123 "$FILE.1"
 {{% endif %}}
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
index 681f60bfb066..515dcf554d3a 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
@@ -3,7 +3,9 @@
 # packages = audit
 
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
+
 useradd testuser_123
+mkdir -p /var/log/audit
 touch "/var/log/audit/audit2.log"
 touch "/var/log/audit/audit.log"
 

From dc3f5aa2bb8b0666a50f29fe27b9ec5fff5e5f83 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Thu, 10 Sep 2026 16:57:38 +0100
Subject: [PATCH 4/5] Enable test scripts for ubuntu

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../tests/correct_value.pass.sh                                 | 1 +
 .../tests/correct_value_default_file.pass.sh                    | 2 +-
 .../tests/wrong_value_default_file.fail.sh                      | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
index 4e9c27be43bd..49b42c898a58 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value.pass.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_ubuntu
 # packages = audit
 
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
index 433159dfe54b..6d54a15c40b8 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/correct_value_default_file.pass.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
+# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_ubuntu
 # packages = audit
 
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
index 515dcf554d3a..8269f6d88381 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/tests/wrong_value_default_file.fail.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux
+# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_ubuntu
 # packages = audit
 
 sed -i "/^\s*log_file.*/d" /etc/audit/auditd.conf

From bca81c31760839e6e7ecae1d40f193f6440014f6 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Tue, 15 Sep 2026 19:17:06 +0100
Subject: [PATCH 5/5] Touch only the configured log filenames

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../file_ownership_var_log_audit_stig/bash/shared.sh            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
index 2308a7a400c6..0c4131a73216 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/bash/shared.sh
@@ -5,4 +5,4 @@ if LC_ALL=C grep -iqE '^[[:space:]]*log_file\b' /etc/audit/auditd.conf; then
 fi
 
 FILE=${FILE:-/var/log/audit/audit.log}
-chown root "$(dirname "$FILE")"/*
+chown root "$(dirname "$FILE")"/"${FILE}"*