RHEL 9 STIG audit rules changes

components/audit.yml

@@ -1,5 +1,5 @@
 groups:
 - audit_dac_actions
 - audit_execution_acl_commands
 - audit_execution_selinux_commands
 - audit_file_deletion_events
@@ -13,12 +13,12 @@
 - configure_auditd_data_retention
 name: audit
 packages:
 - audispd-plugins
 - audit
 - audit-audispd-plugins
 - audit-libs
 rules:
 - audit_access_failed
 - audit_access_failed_aarch64
 - audit_access_failed_ppc64le
 - audit_access_success
@@ -338,10 +338,11 @@
 - package_audit-libs_installed
 - package_audit_installed
 - service_auditd_enabled
+- audit_rules_cron_execution
 - audit_rules_etc_cron_d
 - audit_rules_var_spool_cron
 templates:
 - audit_file_contents
 - audit_rules_dac_modification
 - audit_rules_file_deletion_events
 - audit_rules_login_events

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/ansible/shared.yml

@@ -0,0 +1,53 @@
+# platform = multi_platform_rhel
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{% set rx_beg = "^[\s]*-a[\s]+always,exit[\s]+" %}}
+{{% set rx_b32 = "-F[\s]+arch=b32[\s]+" %}}
+{{% set rx_b64 = "-F[\s]+arch=b64[\s]+" %}}
+{{% set rx_execve_crond = "-S[\s]+execve[\s]+-F[\s]+subj_type=crond_t[\s]+" %}}
+{{% set rx_euid0 = "-F[\s]+euid=0[\s]+" %}}
+{{% set rx_auid = "-F[\s]+auid>=" ~ uid_min ~ "[\s]+-F[\s]+auid!=unset[\s]+" %}}
+{{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}}
+
+- name: "{{{ rule_title }}} - Service facts"
+  ansible.builtin.service_facts:
+
+- name: "{{{ rule_title }}} - Set cron_exec_audit_rules fact"
+  ansible.builtin.set_fact:
+    cron_exec_audit_rules:
+      - rule: '-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec'
+        regex: {{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}}
+      - rule: '-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec'
+        regex: {{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}}
+      - rule: '-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec'
+        regex: {{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}}
+      - rule: '-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec'
+        regex: {{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}}
+
+- name: "{{{ rule_title }}} - Update /etc/audit/rules.d/cron_exec.rules to audit cron execution"
+  ansible.builtin.lineinfile:
+    path: /etc/audit/rules.d/cron_exec.rules
+    line: "{{  item.rule  }}"
+    regexp: "{{ item.regex }}"
+    create: yes
+    mode: 0600
+  when:
+    - '"auditd.service" in ansible_facts.services'
+  register: augenrules_cron_exec_update_result
+  with_items: "{{ cron_exec_audit_rules }}"
+
+- name: "{{{ rule_title }}} - Update /etc/audit/audit.rules to audit cron execution"
+  ansible.builtin.lineinfile:
+    path: /etc/audit/audit.rules
+    line: "{{  item.rule  }}"
+    regexp: "{{ item.regex }}"
+    create: yes
+    mode: 0600
+  when:
+    - '"auditd.service" in ansible_facts.services'
+  register: auditctl_cron_exec_update_result
+  with_items: "{{ cron_exec_audit_rules }}"
+

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/bash/shared.sh

@@ -0,0 +1,23 @@
+# platform = multi_platform_rhel
+
+[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
+
+for ARCH in "${RULE_ARCHS[@]}"
+do
+    ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
+    SYSCALL="execve"
+    KEY="cron_exec"
+
+    # euid=0 rules
+    OTHER_FILTERS="-F subj_type=crond_t -F euid=0"
+    AUID_FILTERS=""
+    SYSCALL_GROUPING=""
+    {{{ bash_fix_audit_syscall_rule("augenrules", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
+    {{{ bash_fix_audit_syscall_rule("auditctl", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
+
+    # auid>={{{ uid_min }}} rules
+    OTHER_FILTERS="-F subj_type=crond_t"
+    AUID_FILTERS="-F auid>={{{ uid_min }}} -F auid!=unset"
+    {{{ bash_fix_audit_syscall_rule("augenrules", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
+    {{{ bash_fix_audit_syscall_rule("auditctl", "$ACTION_ARCH_FILTERS", "$OTHER_FILTERS", "$AUID_FILTERS", "$SYSCALL", "$SYSCALL_GROUPING", "$KEY") }}}
+done

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/oval/shared.xml

@@ -0,0 +1,110 @@
+{{% set rx_beg = "^[\s]*-a[\s]+always,exit[\s]+" %}}
+{{% set rx_b32 = "-F[\s]+arch=b32[\s]+" %}}
+{{% set rx_b64 = "-F[\s]+arch=b64[\s]+" %}}
+{{% set rx_execve_crond = "-S[\s]+execve[\s]+-F[\s]+subj_type=crond_t[\s]+" %}}
+{{% set rx_euid0 = "-F[\s]+euid=0[\s]+" %}}
+{{% set rx_auid = "-F[\s]+auid>=" ~ uid_min ~ "[\s]+-F[\s]+auid!=unset[\s]+" %}}
+{{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}}
+<def-group>
+  <definition class="compliance" id="audit_rules_cron_execution" version="1">
+    {{{ oval_metadata("Ensure audit rules for cron execution by root or privileged users are configured", rule_title=rule_title) }}}
+
+    <criteria operator="OR">
+
+      <!-- Test the augenrules case -->
+      <criteria operator="AND">
+        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
+        <criterion comment="audit augenrules 32-bit crond_t euid=0" test_ref="test_32bit_cron_exec_euid0_augenrules" />
+        <criterion comment="audit augenrules 64-bit crond_t euid=0" test_ref="test_64bit_cron_exec_euid0_augenrules" />
+        <criterion comment="audit augenrules 32-bit crond_t auid" test_ref="test_32bit_cron_exec_auid_augenrules" />
+        <criterion comment="audit augenrules 64-bit crond_t auid" test_ref="test_64bit_cron_exec_auid_augenrules" />
+      </criteria>
+
+      <!-- OR test the auditctl case -->
+      <criteria operator="AND">
+        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
+        <criterion comment="audit auditctl 32-bit crond_t euid=0" test_ref="test_32bit_cron_exec_euid0_auditctl" />
+        <criterion comment="audit auditctl 64-bit crond_t euid=0" test_ref="test_64bit_cron_exec_euid0_auditctl" />
+        <criterion comment="audit auditctl 32-bit crond_t auid" test_ref="test_32bit_cron_exec_auid_auditctl" />
+        <criterion comment="audit auditctl 64-bit crond_t auid" test_ref="test_64bit_cron_exec_auid_auditctl" />
+      </criteria>
+
+    </criteria>
+  </definition>
+
+  <!-- augenrules: euid=0 rules -->
+  <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit crond_t euid=0" id="test_32bit_cron_exec_euid0_augenrules" version="1">
+    <ind:object object_ref="object_32bit_cron_exec_euid0_augenrules" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_32bit_cron_exec_euid0_augenrules" version="1">
+    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit crond_t euid=0" id="test_64bit_cron_exec_euid0_augenrules" version="1">
+    <ind:object object_ref="object_64bit_cron_exec_euid0_augenrules" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_64bit_cron_exec_euid0_augenrules" version="1">
+    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <!-- augenrules: auid rules -->
+  <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit crond_t auid" id="test_32bit_cron_exec_auid_augenrules" version="1">
+    <ind:object object_ref="object_32bit_cron_exec_auid_augenrules" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_32bit_cron_exec_auid_augenrules" version="1">
+    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit crond_t auid" id="test_64bit_cron_exec_auid_augenrules" version="1">
+    <ind:object object_ref="object_64bit_cron_exec_auid_augenrules" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_64bit_cron_exec_auid_augenrules" version="1">
+    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <!-- auditctl: euid=0 rules -->
+  <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit crond_t euid=0" id="test_32bit_cron_exec_euid0_auditctl" version="1">
+    <ind:object object_ref="object_32bit_cron_exec_euid0_auditctl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_32bit_cron_exec_euid0_auditctl" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b32 + rx_execve_crond + rx_euid0 + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit crond_t euid=0" id="test_64bit_cron_exec_euid0_auditctl" version="1">
+    <ind:object object_ref="object_64bit_cron_exec_euid0_auditctl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_64bit_cron_exec_euid0_auditctl" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b64 + rx_execve_crond + rx_euid0 + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <!-- auditctl: auid rules -->
+  <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit crond_t auid" id="test_32bit_cron_exec_auid_auditctl" version="1">
+    <ind:object object_ref="object_32bit_cron_exec_auid_auditctl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_32bit_cron_exec_auid_auditctl" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b32 + rx_execve_crond + rx_auid + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit crond_t auid" id="test_64bit_cron_exec_auid_auditctl" version="1">
+    <ind:object object_ref="object_64bit_cron_exec_auid_auditctl" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_64bit_cron_exec_auid_auditctl" version="1">
+    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
+    <ind:pattern operation="pattern match">{{{ rx_beg + rx_b64 + rx_execve_crond + rx_auid + rx_end }}}</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/policy/stig/shared.yml

@@ -0,0 +1,30 @@
+srg_requirement: |-
+    {{{ full_name }}} must audit any script or executable called by cron as root or by any privileged user.
+
+fixtext: |-
+    Configure {{{ full_name }}} to audit the execution of any system call made by cron as root or by any privileged user.
+
+    Add or update the following file system rules to "/etc/audit/rules.d/audit.rules":
+
+    -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+    -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+    -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+    -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+
+    To load the rules to the kernel immediately, use the following command:
+
+    $ sudo augenrules --load
+
+checktext: |-
+    Verify {{{ full_name }}} is configured to audit the execution of any system call made by cron as root or by any privileged user with the following command:
+
+    $ sudo auditctl -l | grep crond_t
+    -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+    -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec
+    -a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+    -a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>={{{ uid_min }}} -F auid!=unset -k cron_exec
+
+    If this command does not return the expected output, or the lines are commented out, this is a finding.
+
+vuldiscussion: |-
+    Any script or executable called by cron as root or by any privileged user must be owned by that user. It must also have the permissions 755 or more restrictive and should have no extended rights that allow any nonprivileged user to modify the script or executable.

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/rule.yml

@@ -0,0 +1,47 @@
+documentation_complete: true
+
+title: 'Audit Any Script or Executable Called by Cron as Root or by Any Privileged User'
+
+description: |-
+    {{{ full_name }}} must audit any script or executable called by cron as root
+    or by any privileged user.
+
+    Add or update the following audit rules to "/etc/audit/rules.d/audit.rules":
+
+    <pre>-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid&gt;={{{ uid_min }}} -F auid!=unset -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid&gt;={{{ uid_min }}} -F auid!=unset -k cron_exec</pre>
+
+    To load the rules to the kernel immediately, use the following command:
+
+    <pre>$ sudo augenrules --load</pre>
+
+rationale: |-
+    Any script or executable called by cron as root or by any privileged user
+    must be owned by that user. It must also have the permissions 755 or more
+    restrictive and should have no extended rights that allow any nonprivileged
+    user to modify the script or executable.
+
+severity: medium
+
+identifiers:
+    cce@rhel9: CCE-86730-9
+
+references:
+    srg: SRG-OS-000471-GPOS-00215
+
+ocil_clause: 'the command does not return the expected output, or the lines are commented out'
+
+ocil: |-
+    Verify {{{ full_name }}} is configured to audit the execution of any system call made by cron as root or by any privileged user with the following command:
+
+    <pre>$ sudo auditctl -l | grep crond_t</pre>
+    <pre>-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid&gt;={{{ uid_min }}} -F auid!=unset -k cron_exec</pre>
+    <pre>-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid&gt;={{{ uid_min }}} -F auid!=unset -k cron_exec</pre>
+
+    If this command does not return the expected output, or the lines are commented out, this is a finding.
+
+platform: machine

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# packages = audit
+# platform = multi_platform_rhel
+
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_arch.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = audit
+# platform = multi_platform_rhel
+
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_auid_rules.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = audit
+# platform = multi_platform_rhel
+
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F euid=0 -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/missing_euid0_rules.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = audit
+# platform = multi_platform_rhel
+
+echo "-a always,exit -F arch=b64 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules
+echo "-a always,exit -F arch=b32 -S execve -F subj_type=crond_t -F auid>=1000 -F auid!=unset -k cron_exec" >> /etc/audit/rules.d/cron_exec.rules

linux_os/guide/auditing/auditd_configure_rules/audit_rules_cron_execution/tests/no_rules.fail.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# packages = audit
+# platform = multi_platform_rhel
+
+rm -f /etc/audit/rules.d/cron_exec.rules

products/rhel9/controls/stig_rhel9.yml

@@ -3616,11 +3616,9 @@ controls:
       title: RHEL 9 must audit any script or executable called by cron as root or by any privileged
           user.
       rules:
-          - audit_rules_etc_cron_d
-          - audit_rules_var_spool_cron
+          - audit_rules_cron_execution
       status: automated
 
-
     - id: RHEL-09-654100
       levels:
           - medium

products/rhel9/product.yml

@@ -61,3 +61,4 @@ centos_major_version: "9"
 
 journald_conf_dir_path: /etc/systemd/journald.conf.d
 sysctl_remediate_drop_in_file: true
+audit_watches_style: modern

shared/references/cce-redhat-avail.txt

@@ -52,7 +52,6 @@ CCE-86712-7
 CCE-86713-5
 CCE-86726-7
 CCE-86728-3
-CCE-86730-9
 CCE-86743-2
 CCE-86745-7
 CCE-86752-3

tests/data/product_stability/rhel9.yml

@@ -16,7 +16,7 @@ audit_binaries:
   - /sbin/auditd
   - /sbin/augenrules
   - /sbin/audisp-syslog
-audit_watches_style: legacy
+audit_watches_style: modern
 auid: 1000
 aux_pkg_release: 6229229e
 aux_pkg_version: 5a6340b3

tests/data/profile_stability/rhel9/stig.profile

@@ -55,6 +55,7 @@ audit_privileged_commands_init
 audit_privileged_commands_poweroff
 audit_privileged_commands_reboot
 audit_privileged_commands_shutdown
+audit_rules_cron_execution
 audit_rules_dac_modification_chmod
 audit_rules_dac_modification_chown
 audit_rules_dac_modification_fchmod
@@ -70,7 +71,6 @@ audit_rules_dac_modification_removexattr
 audit_rules_dac_modification_setxattr
 audit_rules_dac_modification_umount
 audit_rules_dac_modification_umount2
-audit_rules_etc_cron_d
 audit_rules_execution_chacl
 audit_rules_execution_chcon
 audit_rules_execution_semanage
@@ -124,7 +124,6 @@ audit_rules_usergroup_modification_gshadow
 audit_rules_usergroup_modification_opasswd
 audit_rules_usergroup_modification_passwd
 audit_rules_usergroup_modification_shadow
-audit_rules_var_spool_cron
 auditd_audispd_configure_sufficiently_large_partition
 auditd_data_disk_error_action_stig
 auditd_data_disk_full_action_stig

tests/data/profile_stability/rhel9/stig_gui.profile

@@ -55,6 +55,7 @@ audit_privileged_commands_init
 audit_privileged_commands_poweroff
 audit_privileged_commands_reboot
 audit_privileged_commands_shutdown
+audit_rules_cron_execution
 audit_rules_dac_modification_chmod
 audit_rules_dac_modification_chown
 audit_rules_dac_modification_fchmod
@@ -70,7 +71,6 @@ audit_rules_dac_modification_removexattr
 audit_rules_dac_modification_setxattr
 audit_rules_dac_modification_umount
 audit_rules_dac_modification_umount2
-audit_rules_etc_cron_d
 audit_rules_execution_chacl
 audit_rules_execution_chcon
 audit_rules_execution_semanage
@@ -124,7 +124,6 @@ audit_rules_usergroup_modification_gshadow
 audit_rules_usergroup_modification_opasswd
 audit_rules_usergroup_modification_passwd
 audit_rules_usergroup_modification_shadow
-audit_rules_var_spool_cron
 auditd_audispd_configure_sufficiently_large_partition
 auditd_data_disk_error_action_stig
 auditd_data_disk_full_action_stig