## V8.13.096.2025.10.09

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/9996_auditd.chroot

@@ -362,8 +362,13 @@ printf '%s\0' "${rules[@]}" \
     printf '\n' >> "${tmp}"
   done
 
-install -m 0600 -o root -g root "${tmp}" /etc/audit/audit.rules
-rm -f "${tmp}"
+# shellcheck disable=2155
+declare tmp_stripped="$(mktemp)"
+sed -e '/^[[:space:]]*#/d' -e '/^[[:space:]]*$/d' "${tmp}" > "${tmp_stripped}"
+sed -E 's/[[:space:]]+#.*$//' -i "${tmp_stripped}"
+
+install -m 0600 -o root -g root "${tmp_stripped}" /etc/audit/audit.rules
+rm -f "${tmp}" "${tmp_stripped}"
 
 if ! grep -Eq '(^-a|^-w|^-e[[:space:]]+1|^-e[[:space:]]+2)' /etc/audit/audit.rules; then
   log "WARN: /etc/audit/audit.rules contains no -a/-w rules or '-e 1/2'; is this intended?"