🧹 Rework of Linux related queries focusing on robustness and using native resources

[mm-weber]

Improvement on many queries using native resources instead of the command resource.
More robustness due to using regular expressions instead of plain text .contains queries.

I intend to split auditd related queries into a separate block of scoring_queries: to avoid the repeated use of this construct:

file('/etc/audit/audit.rules').exists
      if (file('/etc/audit/audit.rules').exists) {
        <query>
}

Would that be preferable?

** Overview of Commits **
Signed-off-by: Manuel Weber manuel@mondoo.com

fixed,regex: Ensure auditing for processes that start prior to auditd is enabled++

fixed,regex: Ensure changes to system administration scope (sudoers) is collected

fixed,replaced command: Ensure changes to system administration scope (sudoers) is collected

added,regex: Ensure login and logout events are collected

fixed,regex: Ensure session initiation information is collected

fixed,regex: Ensure events that modify date and time information are collected

fixed,regex: Ensure events that modify the systems Mandatory Access Controls are collected

fixed,regex: Ensure events that modify the systems network environment are collected

fixed,regex: Ensure unsuccessful unauthorized file access attempts are collected

fixed,regex:Ensure discretionary access control permission modification events are collected

fixed,regex: Ensure events that modify user/group information are collected

fixed,regex: Ensure file deletion events by users are collected

fixed,regex: Ensure kernel module loading and unloading is collected

added: Ensure system administrator actions (sudolog) are collected

added: Ensure the audit configuration is immutable

regex start changed to include potential whitespace

regex end changed to include potential whitespace

fixed,regex: Ensure sudo logging is enabled

[tas50]

@mm-weber @atomic111 I'd love to get this one into tomorrow's release. It would really help with container and k8s node scanning.

[mm-weber]

Changing remediations to fit the checks