Ensure audit logs are group-owned by root

lg=$(grep -iE '^[[:space:]]*log_group[[:space:]]*=' /etc/audit/auditd.conf 2>/dev/null | tail -1 | cut -d= -f2 | tr -d '[:space:]')
[ "$lg" = "root" ] || { echo "FAIL: log_group is '${lg:-unset}', expected root"; exit 1; }
# ubuntu24 additionally requires existing audit log files be root-group-owned.
lf=$(grep -iE '^[[:space:]]*log_file[[:space:]]*=' /etc/audit/auditd.conf 2>/dev/null | tail -1 | cut -d= -f2 | tr -d '[:space:]')
d=$(dirname "${lf:-/var/log/audit/audit.log}")
bad=$(find "$d" -maxdepth 1 -type f ! -group root 2>/dev/null)
[ -z "$bad" ] || { echo "FAIL: audit log files not group-owned by root:"; printf '%s\n' "$bad"; exit 1; }
echo "OK: log_group=root and audit logs are root-group-owned"; exit 0

expected_exit:

0

note:

Set 'log_group = root' in /etc/audit/auditd.conf, then reload auditd (systemctl kill auditd -s SIGHUP) so existing files are re-grouped.