From ae5a7082b92e99624b124bf45fac3c748e2ad663 Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Thu, 13 Aug 2026 23:07:14 +0500
Subject: [PATCH 1/9] Implement firewalld default deny remediations and checks

This adds the missing OVAL, Bash, Ansible, and testing scenarios for the
configured_firewalld_default_deny rule to ensure the DefaultZone is
configured to a deny-all policy (drop) per STIG requirements.
---
 .../ansible/shared.yml                        | 12 +++++
 .../bash/shared.sh                            |  7 +++
 .../oval/shared.xml                           | 44 +++++++++++++++++++
 .../tests/correct.pass.sh                     |  9 ++++
 .../tests/wrong_zone.fail.sh                  |  9 ++++
 5 files changed, 81 insertions(+)
 create mode 100644 linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
 create mode 100644 linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
 create mode 100644 linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
 create mode 100644 linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
 create mode 100644 linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
new file mode 100644
index 000000000000..a581ca3ffe4a
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
@@ -0,0 +1,12 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+- name: Ensure firewalld default zone is drop
+  ansible.builtin.lineinfile:
+    path: /etc/firewalld/firewalld.conf
+    regexp: '^DefaultZone='
+    line: 'DefaultZone=drop'
+    create: yes
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
new file mode 100644
index 000000000000..6fe9a97e2d01
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
@@ -0,0 +1,7 @@
+# platform = multi_platform_all
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+{{{ bash_replace_or_append('/etc/firewalld/firewalld.conf', '^DefaultZone=', 'drop', '%s=%s') }}}
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
new file mode 100644
index 000000000000..51224274ee41
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -0,0 +1,44 @@
+<def-group>
+  <definition class="compliance" id="configured_firewalld_default_deny" version="1">
+    {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
+    <criteria operator="AND">
+      <criterion comment="firewalld default zone has target DROP"
+                 test_ref="test_firewalld_default_zone_target_drop" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_object id="object_firewalld_default_zone" version="1">
+    <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^DefaultZone=(.*)$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <local_variable id="var_firewalld_default_zone" datatype="string" version="1" comment="Default zone name">
+    <object_component object_ref="object_firewalld_default_zone" item_field="subexpression" />
+  </local_variable>
+
+  <local_variable id="var_firewalld_default_zone_xml_filename" datatype="string" version="1" comment="Default zone xml file name">
+    <concat>
+      <variable_component var_ref="var_firewalld_default_zone" />
+      <literal_component>.xml</literal_component>
+    </concat>
+  </local_variable>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP">
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_usr" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_etc" version="1">
+    <ind:path>/etc/firewalld/zones</ind:path>
+    <ind:filename var_ref="var_firewalld_default_zone_xml_filename" var_check="all"/>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_usr" version="1">
+    <ind:path>/usr/lib/firewalld/zones</ind:path>
+    <ind:filename var_ref="var_firewalld_default_zone_xml_filename" var_check="all"/>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+</def-group>
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
new file mode 100644
index 000000000000..875e2e67dc91
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = firewalld
+# platform = multi_platform_all
+
+if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
+    sed -i 's/^DefaultZone=.*/DefaultZone=drop/' /etc/firewalld/firewalld.conf
+else
+    echo "DefaultZone=drop" >> /etc/firewalld/firewalld.conf
+fi
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
new file mode 100644
index 000000000000..d8d925d2172a
--- /dev/null
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+# packages = firewalld
+# platform = multi_platform_all
+
+if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
+    sed -i 's/^DefaultZone=.*/DefaultZone=public/' /etc/firewalld/firewalld.conf
+else
+    echo "DefaultZone=public" >> /etc/firewalld/firewalld.conf
+fi

From 2b805db61d7838d0a782dcff87f610ade19dbb1b Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Thu, 13 Aug 2026 23:31:11 +0500
Subject: [PATCH 2/9] Fix OVAL definition ID to use rule_id macro

---
 .../configured_firewalld_default_deny/oval/shared.xml           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
index 51224274ee41..268bce8a96c8 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -1,5 +1,5 @@
 <def-group>
-  <definition class="compliance" id="configured_firewalld_default_deny" version="1">
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
     <criteria operator="AND">
       <criterion comment="firewalld default zone has target DROP"

From 6a1839b51aacc83e2e7bc06a066b241912f4aa20 Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Sat, 15 Aug 2026 02:44:38 +0500
Subject: [PATCH 3/9] Fix OVAL test schema, Ansible linting, and CRLF line
 endings

---
 .../ansible/shared.yml                              |  2 +-
 .../oval/shared.xml                                 | 13 +++++++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
index a581ca3ffe4a..f1b2bad56304 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
@@ -9,4 +9,4 @@
     path: /etc/firewalld/firewalld.conf
     regexp: '^DefaultZone='
     line: 'DefaultZone=drop'
-    create: yes
+    create: true
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
index 268bce8a96c8..7bd48e69fb4f 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -1,9 +1,11 @@
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
-    <criteria operator="AND">
-      <criterion comment="firewalld default zone has target DROP"
-                 test_ref="test_firewalld_default_zone_target_drop" />
+    <criteria operator="OR">
+      <criterion comment="firewalld default zone has target DROP in /etc"
+                 test_ref="test_firewalld_default_zone_target_drop_etc" />
+      <criterion comment="firewalld default zone has target DROP in /usr"
+                 test_ref="test_firewalld_default_zone_target_drop_usr" />
     </criteria>
   </definition>
 
@@ -24,8 +26,11 @@
     </concat>
   </local_variable>
 
-  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP">
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_etc" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /etc">
     <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_usr" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /usr">
     <ind:object object_ref="object_firewalld_default_zone_target_drop_usr" />
   </ind:xmlfilecontent_test>
 

From 00b6afc2465c61fad3ea1007cac07cd1a1fe914b Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Sat, 15 Aug 2026 03:17:00 +0500
Subject: [PATCH 4/9] Fix bash macro regex key to pass contest-oscap tests

---
 .../configured_firewalld_default_deny/bash/shared.sh            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
index 6fe9a97e2d01..f72edba49329 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/bash/shared.sh
@@ -4,4 +4,4 @@
 # complexity = low
 # disruption = low
 
-{{{ bash_replace_or_append('/etc/firewalld/firewalld.conf', '^DefaultZone=', 'drop', '%s=%s') }}}
+{{{ bash_replace_or_append('/etc/firewalld/firewalld.conf', '^DefaultZone', 'drop', '%s=%s') }}}

From 7955be0ea58f94d157342780cf30fdad06d72529 Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Sun, 16 Aug 2026 21:54:59 +0500
Subject: [PATCH 5/9] Simplify OVAL rule to strictly evaluate drop zone and
 prevent variable evaluation crashes

---
 .../oval/shared.xml                           | 37 +++++++++----------
 1 file changed, 17 insertions(+), 20 deletions(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
index 7bd48e69fb4f..5e255748e5ad 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -1,31 +1,28 @@
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
-    <criteria operator="OR">
-      <criterion comment="firewalld default zone has target DROP in /etc"
-                 test_ref="test_firewalld_default_zone_target_drop_etc" />
-      <criterion comment="firewalld default zone has target DROP in /usr"
-                 test_ref="test_firewalld_default_zone_target_drop_usr" />
+    <criteria operator="AND">
+      <criterion comment="firewalld default zone is drop"
+                 test_ref="test_firewalld_default_zone_drop" />
+      <criteria operator="OR">
+        <criterion comment="firewalld default zone has target DROP in /etc"
+                   test_ref="test_firewalld_default_zone_target_drop_etc" />
+        <criterion comment="firewalld default zone has target DROP in /usr"
+                   test_ref="test_firewalld_default_zone_target_drop_usr" />
+      </criteria>
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_object id="object_firewalld_default_zone" version="1">
+  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="all_exist" comment="Ensure DefaultZone is drop">
+    <ind:object object_ref="object_firewalld_default_zone_drop" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_firewalld_default_zone_drop" version="1">
     <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^DefaultZone=(.*)$</ind:pattern>
+    <ind:pattern operation="pattern match">^DefaultZone=drop$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-  <local_variable id="var_firewalld_default_zone" datatype="string" version="1" comment="Default zone name">
-    <object_component object_ref="object_firewalld_default_zone" item_field="subexpression" />
-  </local_variable>
-
-  <local_variable id="var_firewalld_default_zone_xml_filename" datatype="string" version="1" comment="Default zone xml file name">
-    <concat>
-      <variable_component var_ref="var_firewalld_default_zone" />
-      <literal_component>.xml</literal_component>
-    </concat>
-  </local_variable>
-
   <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_etc" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /etc">
     <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
   </ind:xmlfilecontent_test>
@@ -36,13 +33,13 @@
 
   <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_etc" version="1">
     <ind:path>/etc/firewalld/zones</ind:path>
-    <ind:filename var_ref="var_firewalld_default_zone_xml_filename" var_check="all"/>
+    <ind:filename>drop.xml</ind:filename>
     <ind:xpath>/zone[@target='DROP']</ind:xpath>
   </ind:xmlfilecontent_object>
 
   <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_usr" version="1">
     <ind:path>/usr/lib/firewalld/zones</ind:path>
-    <ind:filename var_ref="var_firewalld_default_zone_xml_filename" var_check="all"/>
+    <ind:filename>drop.xml</ind:filename>
     <ind:xpath>/zone[@target='DROP']</ind:xpath>
   </ind:xmlfilecontent_object>
 

From d1de3c81f563e528779a9f8c46d4937a6e54930c Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Wed, 19 Aug 2026 23:52:26 +0500
Subject: [PATCH 6/9] Fix Ansible legacy syntax and ensure firewalld directory
 exists in tests

---
 .../configured_firewalld_default_deny/ansible/shared.yml      | 4 ++--
 .../configured_firewalld_default_deny/tests/correct.pass.sh   | 1 +
 .../tests/wrong_zone.fail.sh                                  | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
index f1b2bad56304..5e6ad7a3413f 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/ansible/shared.yml
@@ -5,8 +5,8 @@
 # disruption = low
 
 - name: Ensure firewalld default zone is drop
-  ansible.builtin.lineinfile:
+  lineinfile:
     path: /etc/firewalld/firewalld.conf
     regexp: '^DefaultZone='
     line: 'DefaultZone=drop'
-    create: true
+    create: yes
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
index 875e2e67dc91..25826537d159 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
@@ -2,6 +2,7 @@
 # packages = firewalld
 # platform = multi_platform_all
 
+mkdir -p /etc/firewalld
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
     sed -i 's/^DefaultZone=.*/DefaultZone=drop/' /etc/firewalld/firewalld.conf
 else
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
index d8d925d2172a..4b928258a553 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
@@ -2,6 +2,7 @@
 # packages = firewalld
 # platform = multi_platform_all
 
+mkdir -p /etc/firewalld
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
     sed -i 's/^DefaultZone=.*/DefaultZone=public/' /etc/firewalld/firewalld.conf
 else

From da31ce5ec5f8e4c839a844ee445bb7847c6a85c1 Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Thu, 20 Aug 2026 17:36:33 +0500
Subject: [PATCH 7/9] Change OVAL check_existence to at_least_one_exists to
 prevent OpenSCAP evaluation crash

---
 .../oval/shared.xml                           | 28 +------------------
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
index 5e255748e5ad..b95377485883 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -4,16 +4,10 @@
     <criteria operator="AND">
       <criterion comment="firewalld default zone is drop"
                  test_ref="test_firewalld_default_zone_drop" />
-      <criteria operator="OR">
-        <criterion comment="firewalld default zone has target DROP in /etc"
-                   test_ref="test_firewalld_default_zone_target_drop_etc" />
-        <criterion comment="firewalld default zone has target DROP in /usr"
-                   test_ref="test_firewalld_default_zone_target_drop_usr" />
-      </criteria>
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="all_exist" comment="Ensure DefaultZone is drop">
+  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure DefaultZone is drop">
     <ind:object object_ref="object_firewalld_default_zone_drop" />
   </ind:textfilecontent54_test>
 
@@ -23,24 +17,4 @@
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_etc" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /etc">
-    <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
-  </ind:xmlfilecontent_test>
-
-  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_usr" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /usr">
-    <ind:object object_ref="object_firewalld_default_zone_target_drop_usr" />
-  </ind:xmlfilecontent_test>
-
-  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_etc" version="1">
-    <ind:path>/etc/firewalld/zones</ind:path>
-    <ind:filename>drop.xml</ind:filename>
-    <ind:xpath>/zone[@target='DROP']</ind:xpath>
-  </ind:xmlfilecontent_object>
-
-  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_usr" version="1">
-    <ind:path>/usr/lib/firewalld/zones</ind:path>
-    <ind:filename>drop.xml</ind:filename>
-    <ind:xpath>/zone[@target='DROP']</ind:xpath>
-  </ind:xmlfilecontent_object>
-
 </def-group>

From 6998838e42e8ff680f24d895a17a777acde66c7b Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Fri, 21 Aug 2026 01:16:50 +0500
Subject: [PATCH 8/9] Fix test scripts printing to STDERR on missing config
 file, which crashed testing-farm

---
 .../configured_firewalld_default_deny/tests/correct.pass.sh      | 1 +
 .../configured_firewalld_default_deny/tests/wrong_zone.fail.sh   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
index 25826537d159..7ac9b990af28 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
@@ -3,6 +3,7 @@
 # platform = multi_platform_all
 
 mkdir -p /etc/firewalld
+touch /etc/firewalld/firewalld.conf
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
     sed -i 's/^DefaultZone=.*/DefaultZone=drop/' /etc/firewalld/firewalld.conf
 else
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
index 4b928258a553..d7aca3da2a46 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
@@ -3,6 +3,7 @@
 # platform = multi_platform_all
 
 mkdir -p /etc/firewalld
+touch /etc/firewalld/firewalld.conf
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
     sed -i 's/^DefaultZone=.*/DefaultZone=public/' /etc/firewalld/firewalld.conf
 else

From 63b7ed2fdf5142a621fe4cf025f9044001f08d7a Mon Sep 17 00:00:00 2001
From: pradeepkch6-ai <chilukurypradeepkumar@gmail.com>
Date: Fri, 21 Aug 2026 21:34:04 +0500
Subject: [PATCH 9/9] Fix OVAL checking missing state and update pass scripts

---
 .../oval/shared.xml                           | 36 ++++++++++++++++---
 .../tests/correct.pass.sh                     | 13 +++++--
 .../tests/wrong_zone.fail.sh                  |  4 +--
 3 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
index b95377485883..24b0210c54a0 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/oval/shared.xml
@@ -2,13 +2,17 @@
   <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Firewalld Must Employ a Deny-all, Allow-by-exception Policy") }}}
     <criteria operator="AND">
-      <criterion comment="firewalld default zone is drop"
-                 test_ref="test_firewalld_default_zone_drop" />
+      <criterion comment="firewalld default zone is drop" test_ref="test_firewalld_default_zone_drop" />
+      <criteria operator="OR">
+        <criterion comment="firewalld default zone has target DROP in /etc" test_ref="test_firewalld_default_zone_target_drop_etc" />
+        <criterion comment="firewalld default zone has target DROP in /usr" test_ref="test_firewalld_default_zone_target_drop_usr" />
+      </criteria>
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure DefaultZone is drop">
+  <ind:textfilecontent54_test id="test_firewalld_default_zone_drop" version="1" check="all" check_existence="all_exist" comment="Ensure DefaultZone is drop">
     <ind:object object_ref="object_firewalld_default_zone_drop" />
+    <ind:state state_ref="state_firewalld_default_zone_drop" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_firewalld_default_zone_drop" version="1">
@@ -17,4 +21,28 @@
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-</def-group>
+  <ind:textfilecontent54_state id="state_firewalld_default_zone_drop" version="1">
+    <ind:text datatype="string" operation="pattern match">^DefaultZone=drop$</ind:text>
+  </ind:textfilecontent54_state>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_etc" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /etc">
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop_usr" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP in /usr">
+    <ind:object object_ref="object_firewalld_default_zone_target_drop_usr" />
+  </ind:xmlfilecontent_test>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_etc" version="1">
+    <ind:path>/etc/firewalld/zones</ind:path>
+    <ind:filename>drop.xml</ind:filename>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+  <ind:xmlfilecontent_object id="object_firewalld_default_zone_target_drop_usr" version="1">
+    <ind:path>/usr/lib/firewalld/zones</ind:path>
+    <ind:filename>drop.xml</ind:filename>
+    <ind:xpath>/zone[@target='DROP']</ind:xpath>
+  </ind:xmlfilecontent_object>
+
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
index 7ac9b990af28..bcdeeadfb82f 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/correct.pass.sh
@@ -2,10 +2,19 @@
 # packages = firewalld
 # platform = multi_platform_all
 
-mkdir -p /etc/firewalld
+mkdir -p /etc/firewalld/zones
 touch /etc/firewalld/firewalld.conf
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
-    sed -i 's/^DefaultZone=.*/DefaultZone=drop/' /etc/firewalld/firewalld.conf
+    sed -i "s/^DefaultZone=.*/DefaultZone=drop/" /etc/firewalld/firewalld.conf
 else
     echo "DefaultZone=drop" >> /etc/firewalld/firewalld.conf
 fi
+
+cat << EOF > /etc/firewalld/zones/drop.xml
+<?xml version="1.0" encoding="utf-8"?>
+<zone target="DROP">
+  <short>Drop</short>
+  <description>Unsolicited incoming network packets are dropped.</description>
+</zone>
+EOF
+
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
index d7aca3da2a46..112810d2f08a 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configured_firewalld_default_deny/tests/wrong_zone.fail.sh
@@ -2,10 +2,10 @@
 # packages = firewalld
 # platform = multi_platform_all
 
-mkdir -p /etc/firewalld
+mkdir -p /etc/firewalld/zones
 touch /etc/firewalld/firewalld.conf
 if grep -q "^DefaultZone=" /etc/firewalld/firewalld.conf; then
     sed -i 's/^DefaultZone=.*/DefaultZone=public/' /etc/firewalld/firewalld.conf
 else
     echo "DefaultZone=public" >> /etc/firewalld/firewalld.conf
-fi
+fi
\ No newline at end of file