OPENSCAP-4954, OPENSCAP-4955, OPENSCAP-4956, OPENSCAP-4957: Use audit_rules_watch template instead of audit_rules_usergroup_modification #13249

jan-cerny · 2025-03-28T14:43:41Z

The template audit_rules_usergroup_modification does roughly the same thing as the audit_rules_watch template. We will remove the audit_rules_usergroup_modification template and we will instead use the template audit_rules_watch everywhere this template is used. As a result, we will get the modern style watches on RHEL 10 because the audit_rules_watch template supports modern style watches, unlike audit_rules_usergroup_modification. Also, this change greatly reduces code duplication and prevents inconsistencies.

…ication The template audit_rules_usergroup_modification does roughly the same thing as the audit_rules_watch template. We will remove the audit_rules_usergroup_modification template and we will instead use the template audit_rules_watch everywhere this template is used. As a result, we will get the modern style watches on RHEL 10 because the audit_rules_watch template supports modern style watches, unlike audit_rules_usergroup_modification. Also, this change greatly reduces code duplication and prevents inconsistencies.

github-actions · 2025-03-28T14:48:15Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group'.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
@@ -3,23 +3,18 @@
 Record Events that Modify User/Group Information - /etc/group
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/group -p wa -k audit_rules_usergroup_modification
-       
-       
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /etc/group -p wa -k audit_rules_usergroup_modification
+
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/group -p wa -k audit_rules_usergroup_modification
+/etc/audit/audit.rules:
+
+-w /etc/group -p wa -k audit_rules_usergroup_modification
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group' differs.
--- oval:ssg-audit_rules_usergroup_modification_group:def:1
+++ oval:ssg-audit_rules_usergroup_modification_group:def:1
@@ -1,7 +1,7 @@
 criteria OR
 criteria AND
 extend_definition oval:ssg-audit_rules_augenrules:def:1
-criterion oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1
+criterion oval:ssg-test_audit_rules_usergroup_modification_group_augenrules:tst:1
 criteria AND
 extend_definition oval:ssg-audit_rules_auditctl:def:1
 criterion oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group' differs.
--- ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group" with the following command:
 
-$ sudo auditctl -l | grep -E '(/etc/group)'
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/group" with the following command:
 
--w /etc/group -p wa -k identity
+$ sudo auditctl -l | grep /etc/group
+
+-w /etc/group -p wa -k audit_rules_usergroup_modification
       Is it the case that the command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
@@ -2,6 +2,11 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group
@@ -19,7 +19,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Check if watch
@@ -50,7 +50,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Search /etc/audit/rules.d
@@ -83,7 +83,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
@@ -114,7 +114,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Use matched
@@ -145,7 +145,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Add watch
@@ -178,7 +178,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Check if watch
@@ -209,7 +209,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/group - Add watch
@@ -243,5 +243,5 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
+  - restrict_strategy

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow'.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
@@ -3,23 +3,18 @@
 Record Events that Modify User/Group Information - /etc/gshadow
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-       
-       
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
+
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
+/etc/audit/audit.rules:
+
+-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow' differs.
--- oval:ssg-audit_rules_usergroup_modification_gshadow:def:1
+++ oval:ssg-audit_rules_usergroup_modification_gshadow:def:1
@@ -1,7 +1,7 @@
 criteria OR
 criteria AND
 extend_definition oval:ssg-audit_rules_augenrules:def:1
-criterion oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1
+criterion oval:ssg-test_audit_rules_usergroup_modification_gshadow_augenrules:tst:1
 criteria AND
 extend_definition oval:ssg-audit_rules_auditctl:def:1
 criterion oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow' differs.
--- ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1
@@ -1,9 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow" with the following command:
 
-$ sudo auditctl -l | grep -E '(/etc/gshadow)'
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/gshadow" with the following command:
 
--w /etc/gshadow -p wa -k identity
+$ sudo auditctl -l | grep /etc/gshadow
 
-If the command does not return a line, or the line is commented out, this is a finding.
+-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
       Is it the case that the system is not configured to audit account changes?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
@@ -2,6 +2,11 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow
@@ -19,7 +19,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Check if
@@ -50,7 +50,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Search /etc/audit/rules.d
@@ -83,7 +83,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
@@ -114,7 +114,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Use matched
@@ -145,7 +145,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
@@ -178,7 +178,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Check if
@@ -209,7 +209,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
@@ -243,5 +243,5 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
+  - restrict_strategy

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
@@ -3,23 +3,18 @@
 Record Events that Modify User/Group Information - /etc/security/opasswd
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
-       
-       
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
+
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
+/etc/audit/audit.rules:
+
+-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd' differs.
--- oval:ssg-audit_rules_usergroup_modification_opasswd:def:1
+++ oval:ssg-audit_rules_usergroup_modification_opasswd:def:1
@@ -1,7 +1,7 @@
 criteria OR
 criteria AND
 extend_definition oval:ssg-audit_rules_augenrules:def:1
-criterion oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1
+criterion oval:ssg-test_audit_rules_usergroup_modification_opasswd_augenrules:tst:1
 criteria AND
 extend_definition oval:ssg-audit_rules_auditctl:def:1
 criterion oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd' differs.
--- ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command:
 
-$ sudo auditctl -l | grep -E '(/etc/security/opasswd)'
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/security/opasswd" with the following command:
 
--w /etc/security/opasswd -p wa -k identity
+$ sudo auditctl -l | grep /etc/security/opasswd
+
+-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
       Is it the case that the command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
@@ -2,6 +2,11 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd
@@ -19,7 +19,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -50,7 +50,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -83,7 +83,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -115,7 +115,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -146,7 +146,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -179,7 +179,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -210,7 +210,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/security/opasswd -
@@ -244,5 +244,5 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
+  - restrict_strategy

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
@@ -3,23 +3,18 @@
 Record Events that Modify User/Group Information - /etc/passwd
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/passwd -p wa -k audit_rules_usergroup_modification
-       
-       
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /etc/passwd -p wa -k audit_rules_usergroup_modification
+
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/passwd -p wa -k audit_rules_usergroup_modification
+/etc/audit/audit.rules:
+
+-w /etc/passwd -p wa -k audit_rules_usergroup_modification
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd' differs.
--- oval:ssg-audit_rules_usergroup_modification_passwd:def:1
+++ oval:ssg-audit_rules_usergroup_modification_passwd:def:1
@@ -1,7 +1,7 @@
 criteria OR
 criteria AND
 extend_definition oval:ssg-audit_rules_augenrules:def:1
-criterion oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1
+criterion oval:ssg-test_audit_rules_usergroup_modification_passwd_augenrules:tst:1
 criteria AND
 extend_definition oval:ssg-audit_rules_auditctl:def:1
 criterion oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd' differs.
--- ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd" with the following command:
 
-$  sudo auditctl -l | grep -E '(/etc/passwd)'
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/passwd" with the following command:
 
--w /etc/passwd -p wa -k identity
+$ sudo auditctl -l | grep /etc/passwd
+
+-w /etc/passwd -p wa -k audit_rules_usergroup_modification
       Is it the case that the command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
@@ -2,6 +2,11 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -62,7 +67,7 @@
         # with proper key
 
 
-        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" >> "$audit_rules_file"
+        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd" >> "$audit_rules_file"
 
     fi
 done
@@ -81,7 +86,7 @@
 
 # If the audit is 'augenrules', then check if rule is already defined
 # If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
-# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
+# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules' to list of files for inspection.
 
 readarray -t matches < <(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)
 
@@ -97,9 +102,9 @@
 # Case when particular audit rule isn't defined yet
 if [ "${#files_to_inspect[@]}" -eq "0" ]
 then
-    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
-    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
-    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
+    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules' into list of files for inspection
+    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules"
+    # If the audit_rules_usergroup_modification_passwd.rules file doesn't exist yet, create it with correct permissions
     if [ ! -e "$key_rule_file" ]
     then
         touch "$key_rule_file"
@@ -149,7 +154,7 @@
         # with proper key
 
 
-        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" >> "$audit_rules_file"
+        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd" >> "$audit_rules_file"
 
     fi
 done

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd
@@ -19,7 +19,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Check if
@@ -50,14 +50,14 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Search /etc/audit/rules.d
-    for other rules with specified key audit_rules_usergroup_modification
+    for other rules with specified key audit_rules_usergroup_modification_passwd
   find:
     paths: /etc/audit/rules.d
-    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
+    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification_passwd$
     patterns: '*.rules'
   register: find_watch_key
   when:
@@ -83,14 +83,14 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
-
-- name: Record Events that Modify User/Group Information - /etc/passwd - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Record Events that Modify User/Group Information - /etc/passwd - Use /etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules
     as the recipient for the rule
   set_fact:
     all_files:
-    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
+    - /etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel" in ansible_facts.packages'
@@ -114,7 +114,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Use matched
@@ -145,14 +145,14 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
     rule for /etc/passwd in /etc/audit/rules.d/
   lineinfile:
     path: '{{ all_files[0] }}'
-    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
+    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd
     create: true
     mode: '0600'
   when:
@@ -178,7 +178,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Check if
@@ -209,13 +209,13 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
     rule for /etc/passwd in /etc/audit/audit.rules
   lineinfile:
-    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
+    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd
     state: present
     dest: /etc/audit/audit.rules
     create: true
@@ -243,5 +243,5 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
+  - restrict_strategy

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow'.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
@@ -3,23 +3,18 @@
 Record Events that Modify User/Group Information - /etc/shadow
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/shadow -p wa -k audit_rules_usergroup_modification
-       
-       
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /etc/shadow -p wa -k audit_rules_usergroup_modification
+
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file, in order to capture events that modify
-account changes:
-
-       
-       -w /etc/shadow -p wa -k audit_rules_usergroup_modification
+/etc/audit/audit.rules:
+
+-w /etc/shadow -p wa -k audit_rules_usergroup_modification
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow' differs.
--- oval:ssg-audit_rules_usergroup_modification_shadow:def:1
+++ oval:ssg-audit_rules_usergroup_modification_shadow:def:1
@@ -1,7 +1,7 @@
 criteria OR
 criteria AND
 extend_definition oval:ssg-audit_rules_augenrules:def:1
-criterion oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1
+criterion oval:ssg-test_audit_rules_usergroup_modification_shadow_augenrules:tst:1
 criteria AND
 extend_definition oval:ssg-audit_rules_auditctl:def:1
 criterion oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow' differs.
--- ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd with the following command:
 
-$  sudo auditctl -l | grep -E '(/etc/shadow)'
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/shadow" with the following command:
 
--w /etc/shadow -p wa -k identity
+$ sudo auditctl -l | grep /etc/shadow
+
+-w /etc/shadow -p wa -k audit_rules_usergroup_modification
       Is it the case that command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
@@ -2,6 +2,11 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
+++ xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow
@@ -19,7 +19,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Check if
@@ -50,7 +50,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Search /etc/audit/rules.d
@@ -83,7 +83,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
@@ -114,7 +114,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Use matched
@@ -145,7 +145,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
@@ -178,7 +178,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Check if
@@ -209,7 +209,7 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
+  - no_reboot_needed
   - restrict_strategy
 
 - name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
@@ -243,5 +243,5 @@
   - low_complexity
   - low_disruption
   - medium_severity
-  - reboot_required
-  - restrict_strategy
+  - no_reboot_needed
+  - restrict_strategy

qlty-cloud-legacy · 2025-03-28T15:15:35Z

Code Climate has analyzed commit fa8c34f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.0% (0.0% change).

View more on Code Climate.

jan-cerny · 2025-03-28T15:24:58Z

/packit build

Mab879 · 2025-03-28T18:36:00Z

/retest

Mab879 · 2025-03-28T20:52:18Z

Automatus tests pass locally.

jan-cerny added Update Rule Issues or pull requests related to Rules updates. RHEL10 Red Hat Enterprise Linux 10 product related. labels Mar 28, 2025

jan-cerny added this to the 0.1.77 milestone Mar 28, 2025

Mab879 self-assigned this Mar 28, 2025

Mab879 approved these changes Mar 28, 2025

View reviewed changes

Mab879 merged commit fb57356 into ComplianceAsCode:master Mar 28, 2025
105 of 110 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

OPENSCAP-4954, OPENSCAP-4955, OPENSCAP-4956, OPENSCAP-4957: Use audit_rules_watch template instead of audit_rules_usergroup_modification #13249

OPENSCAP-4954, OPENSCAP-4955, OPENSCAP-4956, OPENSCAP-4957: Use audit_rules_watch template instead of audit_rules_usergroup_modification #13249

Uh oh!

jan-cerny commented Mar 28, 2025

Uh oh!

github-actions bot commented Mar 28, 2025

Uh oh!

qlty-cloud-legacy bot commented Mar 28, 2025

Uh oh!

jan-cerny commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Uh oh!

Uh oh!

OPENSCAP-4954, OPENSCAP-4955, OPENSCAP-4956, OPENSCAP-4957: Use audit_rules_watch template instead of audit_rules_usergroup_modification #13249

OPENSCAP-4954, OPENSCAP-4955, OPENSCAP-4956, OPENSCAP-4957: Use audit_rules_watch template instead of audit_rules_usergroup_modification #13249

Uh oh!

Conversation

jan-cerny commented Mar 28, 2025

Uh oh!

github-actions bot commented Mar 28, 2025

Uh oh!

qlty-cloud-legacy bot commented Mar 28, 2025

Uh oh!

jan-cerny commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Uh oh!

Uh oh!