Merge "Set space_left_action in auditd [+Docs]"

defaults/main.yml

@@ -400,6 +400,10 @@ security_rhel7_auditd_disk_full_action: syslog               # RHEL-07-030340
 security_rhel7_auditd_network_failure_action: syslog         # RHEL-07-030340
 # Size of remaining disk space (in MB) that triggers alerts.
 security_rhel7_auditd_space_left: "{{ (ansible_mounts | selectattr('mount', 'equalto', '/') | map(attribute='size_total') | first * 0.25 / 1024 / 1024) | int }}" # RHEL-07-030350
+# Action to take when the space_left threshold is reached.
+security_rhel7_auditd_space_left_action: email               # RHEL-07-030351
+# Send auditd email alerts to this user.
+security_rhel7_auditd_action_mail_acct: root                 # RHEL-07-030352
 # Add audit rules for commands/syscalls.
 security_rhel7_audit_chsh: yes                               # RHEL-07-030525
 security_rhel7_audit_chage: yes                              # RHEL-07-030513

doc/metadata/rhel7/RHEL-07-030351.rst

@@ -1,7 +1,16 @@
 ---
 id: RHEL-07-030351
-status: not implemented
-tag: misc
+status: implemented
+tag: auditd
 ---
 
-This STIG requirement is not yet implemented.
+The ``space_left_action`` in the audit daemon configuration is set to
+``email``. This configuration causes the root user to receive an email when the
+``space_left`` threshold is reached.
+
+Deployers can customize this configuration by setting the following Ansible
+variable:
+
+.. code-block:: yaml
+
+    security_rhel7_auditd_space_left_action: email

vars/common.yml

@@ -31,7 +31,9 @@ auditd_config:
   - parameter: space_left
     value: "{{ security_rhel7_auditd_space_left }}"
     config: /etc/audit/auditd.conf
-
+  - parameter: space_left_action
+    value: "{{ security_rhel7_auditd_space_left_action }}"
+    config: /etc/audit/auditd.conf
 
 ## auditd rules
 # This variable is used in tasks/rhel7stig/auditd.yml to deploy auditd rules