Some patches for review

[maage]

---

name: My modifications for review
about: Mixed, bugfixes, cleanups and changes

---

Describe the change
Collection of my patches for review.

Mostly my start target was to support all audit features Fedora 35 does support, or at least what I have used.

And then generate exactly the same file as F35 (and later F36-37) default was with comments and upcase/lowercase. This required to values to have default value, then none/empty value to generate default value.
I wanted to support audit rules from https://github.com/ComplianceAsCode/content/ and to do that I need to change rule generation some.

As my test has almost 200 audit rules, assert phase started to take about 10 minutes to run. I changed it to one multirule. It is not best solution as it usually does not provide exact error point and message is not best. I think these complex datastructures probably should be checked using python filter as It is only way I see to be speedy and possibility for exact error messages.

I tried to expand assert rules some. But not all combinations are tested and maybe there is some errors. It would be nice to generate config option assert rules from parameter description as they are mostly about the same but as it tries to support both yaml numbers and yaml strings it gets complex pretty fast.

Testing
This codebase is tested under F37 x64_64

audit-3.0.9-1.fc37.x86_64
ansible-6.4.0-1.fc37.noarch

As changes are extensive, most probably they fail on other distros, especially when they are missing configuration files.

[maage]

Force push was about some string cleanup.

[maage]

Fixed some minor issues. Split some patches per rule.
Some testing against Debian, Ubuntu and other distros.
Small additional features. Bugfixes. Test changes.

[maage]

I needed to implement auditd_config_deprecated_settings to skip configs that are not implement in certain auditd versions / implemented in some distros. I fixed "Load rules" to work right with molecule testing and fail if auditd can not start with tested config. I think it is essential to test that auditd actually starts with a tested configuration. Old versions do not have certain auditd.conf options and start fails. Also if value is wrong, start fails too. Because containerized test env, auditd configuration can not be tested fully as any option requiring extra capabilities fails. Also auditd can no reload configuration via netlink because of missing capabilities, so solution was to kill auditd.service and then start it again and check if it was able to start.

You will need to have these in molecule with podman to able to start auditd.

      # This enables us to test it in unprivileged container as no priority
      # boost means no nice syscall with negative parameter and no need for
      # CAP_SYS_NICE capability.
      # https://github.com/linux-audit/audit-userspace/blob/a437ce5d488d8072237dce1c3e818d41758024df/src/auditd.c#L725
      auditd_priority_boost: 0
      # This is needed in container setups as it allows auditd to start but not
      # notify and fail and die. Needed CAP_NET_AUDIT
      auditd_local_events: "no"
      # This enables us to cheat. Needed CAP_AUDIT_CONTROL
      auditd_molecule_container_testing: true

This now passes my simple test suite (not included) for all distros in line with supported platforms. I don't have docker to run existing test suite. Essentially it just sets all variable values to some value and adds one rule. I guess there should be another test with 200 rules.

Auditd / auditctl are both missing functionality to test rule / configuration file syntax. This makes implementing ansible module harder than necessary.