From 92a71955fef085adab06d6d8886394da5cb97378 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Fri, 14 Aug 2026 13:55:05 +0200 Subject: [PATCH 1/2] Create new rule audit_rules_cron_execution Create new rule `audit_rules_cron_execution` that aligns with RHEL 9 STIG requirement RHEL-09-654097 The requirement was updated in RHEL 9 STIG V2R9. The previous versions of STIG watched for modifications of `/etc/cron.d` `/var/spool/cron`. The V2R9 requires to watch any system call made by cron and requires to use different audit rules than the previous versions. --- components/audit.yml | 1 + .../ansible/shared.yml | 53 +++++++++ .../audit_rules_cron_execution/bash/shared.sh | 23 ++++ .../oval/shared.xml | 110 ++++++++++++++++++ .../policy/stig/shared.yml | 30 +++++ .../audit_rules_cron_execution/rule.yml | 47 ++++++++ .../tests/correct_value.pass.sh | 8 ++ .../tests/missing_arch.fail.sh | 6 + .../tests/missing_auid_rules.fail.sh | 6 + .../tests/missing_euid0_rules.fail.sh | 6 + .../tests/no_rules.fail.sh | 5 + products/rhel9/controls/stig_rhel9.yml | 4 +- shared/references/cce-redhat-avail.txt | 1 - .../data/profile_stability/rhel9/stig.profile | 3 +- .../profile_stability/rhel9/stig_gui.profile | 3 +- 15 files changed, 298 insertions(+), 8 deletions(-) create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/ansible/shared.yml create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/bash/shared.sh create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/oval/shared.xml create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/policy/stig/shared.yml create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/rule.yml create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/correct_value.pass.sh create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_arch.fail.sh create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_auid_rules.fail.sh create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_euid0_rules.fail.sh create mode 100644 linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/no_rules.fail.sh diff --git a/components/audit.yml b/components/audit.yml index 018ead72842..a61b3a7cdae 100644 --- a/components/audit.yml +++ b/components/audit.yml @@ -338,6 +338,7 @@ rules: - package_audit-libs_installed - package_audit_installed - service_auditd_enabled +- audit_rules_cron_execution - audit_rules_etc_cron_d - audit_rules_var_spool_cron templates: diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/ansible/shared.yml new file mode 100644 index 00000000000..9360a4a477f --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/ansible/shared.yml @@ -0,0 +1,53 @@ +# platform = multi_platform_rhel +# reboot = false +# strategy = restrict +# complexity = low +# disruption = low + +{{% set rx_beg = "^[\s]*-a[\s]+always,exit[\s]+" %}} +{{% set rx_b32 = "-F[\s]+arch=b32[\s]+" %}} +{{% set rx_b64 = "-F[\s]+arch=b64[\s]+" %}} +{{% set rx_execve_crond = "-S[\s]+execve[\s]+-F[\s]+subj_type=crond_t[\s]+" %}} +{{% set rx_euid0 = "-F[\s]+euid=0[\s]+" %}} +{{% set rx_auid = "-F[\s]+auid>=" ~ uid_min ~ "[\s]+-F[\s]+auid!=unset[\s]+" %}} +{{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}} + +- name: "{{{ rule_title }}} - Service facts" + ansible.builtin.service_facts: + +- name: "{{{ rule_title }}} - Set cron_exec_audit_rules fact" + ansible.builtin.set_fact: + cron_exec_audit_rules: + - rule: '-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec' + regex: {{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}} + - rule: '-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec' + regex: {{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}} + - rule: '-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec' + regex: {{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}} + - rule: '-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec' + regex: {{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}} + +- name: "{{{ rule_title }}} - Update /etc/audit/rules.d/cron_exec.rules to audit cron execution" + ansible.builtin.lineinfile: + path: /etc/audit/rules.d/cron_exec.rules + line: "{{ item.rule }}" + regexp: "{{ item.regex }}" + create: yes + mode: 0600 + when: + - '"auditd.service" in ansible_facts.services' + register: augenrules_cron_exec_update_result + with_items: "{{ cron_exec_audit_rules }}" + +- name: "{{{ rule_title }}} - Update /etc/audit/audit.rules to audit cron execution" + ansible.builtin.lineinfile: + path: /etc/audit/audit.rules + line: "{{ item.rule }}" + regexp: "{{ item.regex }}" + create: yes + mode: 0600 + when: + - '"auditd.service" in ansible_facts.services' + register: auditctl_cron_exec_update_result + with_items: "{{ cron_exec_audit_rules }}" + diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/bash/shared.sh new file mode 100644 index 00000000000..50f4ee62067 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/bash/shared.sh @@ -0,0 +1,23 @@ +# platform = multi_platform_rhel + +[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64") + +for ARCH in "${RULE_ARCHS[@]}" +do + ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH" + SYSCALL="execve" + KEY="cron_exec" + + # euid=0 rules + OTHER_FILTERS="-F subj_type=crond_t -F euid=0" + AUID_FILTERS="" + SYSCALL_GROUPING="" + {{{ bash_fix_audit_syscall_rule("augenrules", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} + {{{ bash_fix_audit_syscall_rule("auditctl", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} + + # auid>={{{ uid_min }}} rules + OTHER_FILTERS="-F subj_type=crond_t" + AUID_FILTERS="-F auid>={{{ uid_min }}} -F auid!=unset" + {{{ bash_fix_audit_syscall_rule("augenrules", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} + {{{ bash_fix_audit_syscall_rule("auditctl", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}} +done diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/oval/shared.xml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/oval/shared.xml new file mode 100644 index 00000000000..c6dc0e703f8 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/oval/shared.xml @@ -0,0 +1,110 @@ +{{% set rx_beg = "^[\s]*-a[\s]+always,exit[\s]+" %}} +{{% set rx_b32 = "-F[\s]+arch=b32[\s]+" %}} +{{% set rx_b64 = "-F[\s]+arch=b64[\s]+" %}} +{{% set rx_execve_crond = "-S[\s]+execve[\s]+-F[\s]+subj_type=crond_t[\s]+" %}} +{{% set rx_euid0 = "-F[\s]+euid=0[\s]+" %}} +{{% set rx_auid = "-F[\s]+auid>=" ~ uid_min ~ "[\s]+-F[\s]+auid!=unset[\s]+" %}} +{{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}} + + + {{{ oval_metadata("Ensure audit rules for cron execution by root or privileged users are configured", rule_title=rule_title) }}} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ^/etc/audit/rules\.d/.*\.rules$ + {{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}} + 1 + + + + + + + ^/etc/audit/rules\.d/.*\.rules$ + {{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}} + 1 + + + + + + + + ^/etc/audit/rules\.d/.*\.rules$ + {{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}} + 1 + + + + + + + ^/etc/audit/rules\.d/.*\.rules$ + {{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}} + 1 + + + + + + + + /etc/audit/audit.rules + {{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}} + 1 + + + + + + + /etc/audit/audit.rules + {{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}} + 1 + + + + + + + + /etc/audit/audit.rules + {{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}} + 1 + + + + + + + /etc/audit/audit.rules + {{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}} + 1 + + diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/policy/stig/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/policy/stig/shared.yml new file mode 100644 index 00000000000..be3dd4adf61 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/policy/stig/shared.yml @@ -0,0 +1,30 @@ +srg_requirement: |- + {{{ full_name }}} must audit any script or executable called by cron as root or by any privileged user. + +fixtext: |- + Configure {{{ full_name }}} to audit the execution of any system call made by cron as root or by any privileged user. + + Add or update the following file system rules to "/etc/audit/rules.d/audit.rules": + + -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec + -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec + -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec + -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec + + To load the rules to the kernel immediately, use the following command: + + $ sudo augenrules --load + +checktext: |- + Verify {{{ full_name }}} is configured to audit the execution of any system call made by cron as root or by any privileged user with the following command: + + $ sudo auditctl -l | grep crond_t + -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec + -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec + -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec + -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec + + If this command does not return the expected output, or the lines are commented out, this is a finding. + +vuldiscussion: |- + Any script or executable called by cron as root or by any privileged user must be owned by that user. It must also have the permissions 755 or more restrictive and should have no extended rights that allow any nonprivileged user to modify the script or executable. diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/rule.yml new file mode 100644 index 00000000000..b82358623b1 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/rule.yml @@ -0,0 +1,47 @@ +documentation_complete: true + +title: 'Audit Any Script or Executable Called by Cron as Root or by Any Privileged User' + +description: |- + {{{ full_name }}} must audit any script or executable called by cron as root + or by any privileged user. + + Add or update the following audit rules to "/etc/audit/rules.d/audit.rules": + + 
-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+ 
-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+ 
-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+ 
-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+ + To load the rules to the kernel immediately, use the following command: + + 
$ sudo augenrules --load
+ +rationale: |- + Any script or executable called by cron as root or by any privileged user + must be owned by that user. It must also have the permissions 755 or more + restrictive and should have no extended rights that allow any nonprivileged + user to modify the script or executable. + +severity: medium + +identifiers: + cce@rhel9: CCE-86730-9 + +references: + srg: SRG-OS-000471-GPOS-00215 + +ocil_clause: 'the command does not return the expected output, or the lines are commented out' + +ocil: |- + Verify {{{ full_name }}} is configured to audit the execution of any system call made by cron as root or by any privileged user with the following command: + + 
$ sudo auditctl -l | grep crond_t
+ 
-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+ 
-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+ 
-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+ 
-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+ + If this command does not return the expected output, or the lines are commented out, this is a finding. + +platform: machine diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/correct_value.pass.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/correct_value.pass.sh new file mode 100644 index 00000000000..06daaa1bdea --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/correct_value.pass.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# packages = audit +# platform = multi_platform_rhel + +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_arch.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_arch.fail.sh new file mode 100644 index 00000000000..febb0c3c873 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_arch.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = audit +# platform = multi_platform_rhel + +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_auid_rules.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_auid_rules.fail.sh new file mode 100644 index 00000000000..fa2a516b73b --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_auid_rules.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = audit +# platform = multi_platform_rhel + +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_euid0_rules.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_euid0_rules.fail.sh new file mode 100644 index 00000000000..a49ec8de465 --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_euid0_rules.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = audit +# platform = multi_platform_rhel + +echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules +echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/no_rules.fail.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/no_rules.fail.sh new file mode 100644 index 00000000000..1743b5da5ab --- /dev/null +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/no_rules.fail.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# packages = audit +# platform = multi_platform_rhel + +rm -f /etc/audit/rules.d/cron_exec.rules diff --git a/products/rhel9/controls/stig_rhel9.yml b/products/rhel9/controls/stig_rhel9.yml index 98357ade126..52e4d9a0e43 100644 --- a/products/rhel9/controls/stig_rhel9.yml +++ b/products/rhel9/controls/stig_rhel9.yml @@ -3616,11 +3616,9 @@ controls: title: RHEL 9 must audit any script or executable called by cron as root or by any privileged user. rules: - - audit_rules_etc_cron_d - - audit_rules_var_spool_cron + - audit_rules_cron_execution status: automated - - id: RHEL-09-654100 levels: - medium diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 4d2d0b65baa..3d61d6d61ee 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -52,7 +52,6 @@ CCE-86712-7 CCE-86713-5 CCE-86726-7 CCE-86728-3 -CCE-86730-9 CCE-86743-2 CCE-86745-7 CCE-86752-3 diff --git a/tests/data/profile_stability/rhel9/stig.profile b/tests/data/profile_stability/rhel9/stig.profile index fe05c5a565a..7f8d6a009f3 100644 --- a/tests/data/profile_stability/rhel9/stig.profile +++ b/tests/data/profile_stability/rhel9/stig.profile @@ -55,6 +55,7 @@ audit_privileged_commands_init audit_privileged_commands_poweroff audit_privileged_commands_reboot audit_privileged_commands_shutdown +audit_rules_cron_execution audit_rules_dac_modification_chmod audit_rules_dac_modification_chown audit_rules_dac_modification_fchmod @@ -70,7 +71,6 @@ audit_rules_dac_modification_removexattr audit_rules_dac_modification_setxattr audit_rules_dac_modification_umount audit_rules_dac_modification_umount2 -audit_rules_etc_cron_d audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_semanage @@ -124,7 +124,6 @@ audit_rules_usergroup_modification_gshadow audit_rules_usergroup_modification_opasswd audit_rules_usergroup_modification_passwd audit_rules_usergroup_modification_shadow -audit_rules_var_spool_cron auditd_audispd_configure_sufficiently_large_partition auditd_data_disk_error_action_stig auditd_data_disk_full_action_stig diff --git a/tests/data/profile_stability/rhel9/stig_gui.profile b/tests/data/profile_stability/rhel9/stig_gui.profile index 426f1ef3b06..1b07a17b956 100644 --- a/tests/data/profile_stability/rhel9/stig_gui.profile +++ b/tests/data/profile_stability/rhel9/stig_gui.profile @@ -55,6 +55,7 @@ audit_privileged_commands_init audit_privileged_commands_poweroff audit_privileged_commands_reboot audit_privileged_commands_shutdown +audit_rules_cron_execution audit_rules_dac_modification_chmod audit_rules_dac_modification_chown audit_rules_dac_modification_fchmod @@ -70,7 +71,6 @@ audit_rules_dac_modification_removexattr audit_rules_dac_modification_setxattr audit_rules_dac_modification_umount audit_rules_dac_modification_umount2 -audit_rules_etc_cron_d audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_semanage @@ -124,7 +124,6 @@ audit_rules_usergroup_modification_gshadow audit_rules_usergroup_modification_opasswd audit_rules_usergroup_modification_passwd audit_rules_usergroup_modification_shadow -audit_rules_var_spool_cron auditd_audispd_configure_sufficiently_large_partition auditd_data_disk_error_action_stig auditd_data_disk_full_action_stig From 7b0ff0496d4ac992242588384770e5a20a1664f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Fri, 14 Aug 2026 15:26:07 +0200 Subject: [PATCH 2/2] Change audit watches to "modern" style in RHEL 9 RHEL 9 rules that use the `audit_rules_watch` template will start using the "modern" style of audit watches. The reason for this change is that RHEL 9 STIG V2R9 started to use the "modern" style in their requirements. Also, RHEL 9 CIS Benchmark will switch to the "modern" style in the next release of the RHEL 9 CIS Benchmark. --- products/rhel9/product.yml | 1 + tests/data/product_stability/rhel9.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/products/rhel9/product.yml b/products/rhel9/product.yml index e7d03db1b08..6be9285f77c 100644 --- a/products/rhel9/product.yml +++ b/products/rhel9/product.yml @@ -61,3 +61,4 @@ centos_major_version: "9" journald_conf_dir_path: /etc/systemd/journald.conf.d sysctl_remediate_drop_in_file: true +audit_watches_style: modern diff --git a/tests/data/product_stability/rhel9.yml b/tests/data/product_stability/rhel9.yml index 714160795fb..d6b28c1a50c 100644 --- a/tests/data/product_stability/rhel9.yml +++ b/tests/data/product_stability/rhel9.yml @@ -16,7 +16,7 @@ audit_binaries: - /sbin/auditd - /sbin/augenrules - /sbin/audisp-syslog -audit_watches_style: legacy +audit_watches_style: modern auid: 1000 aux_pkg_release: 6229229e aux_pkg_version: 5a6340b3