RHEL10: Update DISA STIG v1r2 to v1r3 by macko1 · Pull Request #15216 · ComplianceAsCode/content

macko1 · 2026-10-19T13:21:03Z

Description:

This PR updates the RHEL 10 DISA STIG content from V1R2 to V1R3.

The stig and stig_gui profiles now match the V1R3 benchmark DISA published on cyber.mil.

What changes at the profile level:

new requirements mapped to rules:
- RHEL-10-300085, mapped to configure_openssl_crypto_policy: the .include = /etc/crypto-policies/back-ends/opensslcnf.config form applies to the RHEL family, with Fedora and Oracle Linux 9 named explicitly because they use that form without belonging to the RHEL family, with pass and fail scenarios on multi_platform_rhel
- RHEL-10-500605, mapped to audit_rules_privileged_commands_useradd
removed requirement:
- RHEL-10-200050 (the package_tftp-server_removed rule stays in the data stream for the RHEL 8 and RHEL 9 STIG profiles)
the RHEL-10-600100 and RHEL-10-600110 requirements select var_accounts_maximum_age_login_defs=180 in the stig and stig_gui profiles: the password maximum age rises from 60 to 180 days, so accounts with a maximum age between 61 and 180 days that failed the V1R2 profiles now pass
the remaining requirement changes are updates implemented in this PR's commits, checks carried by the shared files the RHEL 8 and RHEL 9 updates already merged (RHEL8: Update DISA STIG from v2r8 to v2r9 #15214, RHEL9: Update DISA STIG from v2r9 to v2r10 #15212, detailed below) with this PR adding the rhel10 policy text and scenarios, and DISA wording-only edits that never reach the data stream

The V1R3 update introduces changes that affect other products, not only the RHEL 10 STIG profile:

The audit_rules_privileged_commands_gpasswd and audit_rules_privileged_commands_passwd rules (RHEL-10-500450, RHEL-10-500490) use rhel10-specific hand-written OVAL, Bash, and Ansible files instead of the audit_rules_privileged_commands template, which stays at its master state for every other product:
- the checks mirror the acceptance of DISA's own SCAP benchmark for passwd
- for gpasswd the check is more lenient than DISA's pattern, which requires the auid filters: the optional-auid acceptance keeps machines hardened under the previous release passing
- the shared test scenarios serve both RHEL 9 and RHEL 10 with per-product rule forms
The audit_rules_privileged_commands_useradd rule (RHEL-10-500605) is added as a text-only change: the control entry, the policy file with the V1R3 checktext and fixtext, the cce@rhel10 identifier, and the profile stability data. The rule rides the shared audit_rules_privileged_commands template like its RHEL 9 counterpart (RHEL-09-654176), so its check and remediation use the template arch-split pair; the V1R3 fixtext prescribes the single-line form, which watches the same executions.
The grub2_password check (RHEL-10-600000) verifies GRUB2_PASSWORD in /boot/grub2/user.cfg for RHEL 10, with no EFI fallback and no superuser verification: the RHEL 10 criteria are a separate branch of the shared OVAL alongside the RHEL 9 one, and with both products on their own branches, the invalid_username scenario stops running on any RHEL because no RHEL check verifies the superuser name anymore.
The no_shelllogin_for_systemaccounts rule (RHEL-10-600020) applies the RHEL 10 definition of a system account on rhel10, sharing the check and remediation branch with RHEL 9:
- the check covers UIDs between 1 and 999, with root, halt, sync, and shutdown exempt and the nologin and false shells accepted
- the Bash and Ansible remediations set /sbin/nologin for every product, the same file as the fixtext's /usr/sbin/nologin because /sbin is a symlink to /usr/sbin
- other products keep the check based on uid_min
- the new check reaches every rhel10 profile selecting the rule, not only the STIG profile (cis, cis_server_l1, cis_workstation_l1, cis_workstation_l2, SRG-OS-000480-GPOS-00227): a system account with a /bin/false shell now passes where the uid_min check failed it
The gpgcheck and clean_components checks (RHEL-10-001030, RHEL-10-001040, RHEL-10-001050, RHEL-10-200000), the rsyslog_cron_logging OVAL (RHEL-10-200648), and the disable_ctrlaltdel_burstaction ini-file remediation (RHEL-10-700950) arrive through the shared files the RHEL 8 and RHEL 9 updates already merged (RHEL8: Update DISA STIG from v2r8 to v2r9 #15214, RHEL9: Update DISA STIG from v2r9 to v2r10 #15212); this PR carries the rhel10 policy text, control entries, and scenarios for those requirements.
The configure_openssl_crypto_policy conditions that select the .include = form use the RHEL family, which changes the rendering for almalinux9, the only RHEL-family product outside RHEL 8, 9, and 10: its check, remediations, and OCIL now use the form with the equals sign where they previously used the form that accepts .include with and without it, so an almalinux9 machine with the no-equals-sign .include line now fails the check until remediated. Every other product outside the RHEL family renders exactly as before.
The configure_openssl_crypto_policy rule joins SRG-OS-000250-GPOS-00093 in controls/srg_gpos, which every product selecting srg_gpos:all builds, including opensuse16.
The install_smartcard_packages check (RHEL-10-200730) selects pkcs11-provider for fedora, rhel10, and ol10 in the OVAL and in the rule metadata package set, matching the package the remediations already install: at V1R2 the OVAL required openssl-pkcs11 for all three products while their remediations installed pkcs11-provider, so a remediated machine kept failing the check. The openssl-pkcs11 path used by RHEL 8 and RHEL 9 is unchanged.
The set_password_hashing_algorithm_libuserconf check (RHEL-10-600750) anchors the crypt_style lookup to the [defaults] section of /etc/libuser.conf on every product, so a crypt_style in another section or a commented-out line no longer satisfies the check: the previous lookup matched the line anywhere in the file and passed settings that have no effect, while DISA's SCAP and the rule's own description require the [defaults] section. The Ansible remediation sets the option in the [defaults] section through the ini_file module, creating the file and the section when missing.

Rationale:

DISA released V1R3 of the RHEL 10 STIG as part of the quarterly update cycle. This PR aligns the stig and stig_gui profiles with it.

Review Hints:

Commits that update requirements name the STIG IDs in their subjects and list the per-rule changes in their bodies, so see the commits for the exact per-rule detail.
Local verification: per-rule Automatus runs on RHEL 10.3 virtual machines, on both the bash and ansible backends, all passing:
- audit_rules_privileged_commands_gpasswd
- audit_rules_privileged_commands_passwd
- audit_rules_privileged_commands_useradd
- audit_rules_privileged_commands_chsh (the template-restoration canary for the rules above)
- audit_rules_sudoers
- audit_rules_sudoers_d
- audit_rules_sysadmin_actions
- audit_rules_usergroup_modification_group
- audit_rules_usergroup_modification_gshadow
- audit_rules_usergroup_modification_opasswd
- audit_rules_usergroup_modification_passwd
- audit_rules_usergroup_modification_shadow
- audit_rules_login_events_faillock
- audit_rules_login_events_lastlog
- configure_openssl_crypto_policy
- set_password_hashing_algorithm_libuserconf
- disable_ctrlaltdel_burstaction
grub2_password has no automated remediation upstream (setting a boot loader password is interactive), so its scenarios verify the OVAL check only.
Reproduce with:

./build_product rhel10
tests/automatus.py rule --libvirt qemu:///session "$DOMAIN" \
    --datastream build/ssg-rhel10-ds.xml --product rhel10 \
    --remediate-using bash <rule ids>

CI: the failing checks fail on conditions that already exist on master, not on this update's changes:
- the Run Tests and Build, Test on SLE Latest (Container) checks fail in the SLE container build itself (exit code 125, before any test runs); the same failures are on the head of the merged RHEL 9 STIG update (RHEL9: Update DISA STIG from v2r9 to v2r10 #15212)
- the Yaml Lint on Changed yaml files check fails on the historical controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml line 2 indentation, which enters lint scope because this PR adds configure_openssl_crypto_policy to that file
- the disa-alignment tests fail on account_password_pam_faillock_password_auth, account_password_pam_faillock_system_auth, rsyslog_omfwd_authmode, rsyslog_omfwd_streamdriver, rsyslog_omfwd_tls, coredump_disable_backtraces, file_permissions_sshd_config_not_modified, require_emergency_target_auth, and networkmanager_dns_mode: none of them is part of the V1R3 delta, and their checks and remediations compile identically to master, so the disagreement between our results and DISA's benchmark is pre-existing and branch-independent
The DISA SCAP benchmark reference (shared/references/disa-stig-rhel10-v1r3-xccdf-scap.xml) carries DISA's V1R1 SCAP content: DISA has not published a V1R3 SCAP benchmark, so the V1R1 automation remains the latest available acceptance authority.
compliance-operator-content-dev (Konflux) is neutral.

AI-assisted under my direction, verification and testing.

openshift-ci · 2026-10-19T13:21:08Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-10-20T22:01:57Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf
@@ -28,14 +28,12 @@
   tags:
     - always
 
-- name: Set Password Hashing Algorithm in /etc/libuser.conf - Set Password Hashing
-    Algorithm in /etc/libuser.conf
-  ansible.builtin.lineinfile:
-    dest: /etc/libuser.conf
-    insertafter: ^\s*\[defaults]
-    regexp: ^#?crypt_style
-    line: crypt_style = {{ var_password_hashing_algorithm_pam }}
-    state: present
+- name: Set Password Hashing Algorithm in /etc/libuser.conf
+  community.general.ini_file:
+    path: /etc/libuser.conf
+    section: defaults
+    option: crypt_style
+    value: '{{ var_password_hashing_algorithm_pam }}'
     create: true
     mode: 420
   when:

OVAL for rule 'xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts' differs.
--- oval:ssg-no_shelllogin_for_systemaccounts:def:1
+++ oval:ssg-no_shelllogin_for_systemaccounts:def:1
@@ -1,2 +1,2 @@
 criteria AND
-criterion oval:ssg-test_shell_defined_rhel9_uid_range:tst:1
+criterion oval:ssg-test_shell_defined_system_uid_range:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_grub2_password' differs.
--- ocil:ssg-grub2_password_ocil:questionnaire:1
+++ ocil:ssg-grub2_password_ocil:questionnaire:1
@@ -1,3 +1,4 @@
+
 First, check whether the password is defined in either /boot/grub2/user.cfg or
 /boot/grub2/grub.cfg.
 Run the following commands:

Mab879

Maybe neeed a rebase?

Mab879 · 2026-10-23T21:10:36Z

@@ -0,0 +1,8 @@
+#!/bin/bash


What is this needed?

https://stigaview.com/products/rhel10/v1r3/RHEL-10-500300/ is the control with execve.

rule's oval checks for the verbatim what the stig wants, and I didn't want to rewrite the rules with the amount of work this update takes:

-a always,exit -F arch=b32 -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd -a always,exit -F arch=b64 -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd

Testbenches that fail the check. Rules are correct though, because gpasswd is always started through execve.

-a always,exit -F arch=b32 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd -a always,exit -F arch=b64 -S execve -F path=/usr/bin/gpasswd -F perm=x -k privileged-gpasswd

audit_rules_suid_privilege_function cannot cover this requirement, its oval checks:

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv

These only record runs that escalate to root, so sudo gpasswd and root running gpasswd leave no audit.

macko1 · 2026-11-12T18:17:14Z

/packit retest-failed

Mab879 · 2026-11-12T20:33:20Z

 description: |-
    At a minimum, the audit system should collect administrator actions
    for all users and root.
-    {{{ describe_audit_rules_watch("/etc/sudoers.d/", "actions") }}}


This seems odd, should we do it for all products?

indeed strange, i discussed this but forgot what the reasoning was.

double checking

yeah, just to match fixtext... sigh

functionally i believe it is the same.

reverting

Mab879 · 2026-11-12T21:59:22Z

  <ind:textfilecontent54_object id="object_set_password_hashing_algorithm_libuserconf" version="2"
    comment="only one hashing algorithm option for pam_unix.so is found in /etc/libuser.conf">
    <ind:filepath>/etc/libuser.conf</ind:filepath>
+{{% if product == "rhel10" %}}


Should we do this for all products? The section is important for all products right?

hm, you seem to be correct.

I'm led to believe that setting the crypt_style outside the [defaults] section would probably ignore the key altogether.

updating

and fixing the ansible remediation, too

Replace the RHEL 10 DISA STIG manual reference file with the V1R3 content.

Set the control file version and the stig and stig_gui profile metadata and descriptions to V1R3. Metadata only, no rules are affected.

…ementation is not needed Rules affected: RHEL-10-200090: package_vsftpd_removed - The policy file fixtext and checktext use the package name vsftpd; the V1R2 text named the nonexistent vsftp package - The package_removed template, OVAL package check, and Bash and Ansible remediations already enforce vsftpd RHEL-10-200640: package_rsyslog_installed - The policy file fixtext and checktext use the package name rsyslog; the V1R2 text named the daemon rsyslogd - The package_installed template already checks and installs rsyslog RHEL-10-200648: rsyslog_cron_logging - The policy file checktext is synced to the V1R3 text: the anchored grep -s "cron.*", the RainerScript omfile action sample for /var/log/cron, and the functional logger -p cron.info test with the /var/log/cron lookup as the manual fallback - The fixtext drops the quotes from /etc/rsyslog.d/ and uses "The rsyslog daemon must be restarted" wording - The OVAL configuration check, the Bash and Ansible remediations, and the scenarios already enforce and cover the cron routing through the shared files merged with the RHEL 8 and RHEL 9 STIG updates RHEL-10-300090: crypto_policy_not_overridden - The policy file checktext removes the obsolete nss.config symlink note - The existing SCE check and crypto-policy remediation already cover the requirement RHEL-10-500105: auditd_data_retention_admin_space_left_percentage - The policy file checktext finding line names admin_space_left instead of space_left - The rule variable, OVAL check, and Bash and Ansible remediations already use admin_space_left with var_auditd_admin_space_left_percentage=5pc RHEL-10-500610: audit_rules_media_export - The policy file fixtext and checktext change the RHEL 10 audit key for the mount syscall rules from export to privileged-mount - The audit_rules_dac_modification template, the OVAL check, and the Bash and Ansible remediations keep the export key: the OVAL pattern requires a key of any value and no check in the repository reads the key value RHEL-10-500680: audit_rules_sudoers - The policy file fixtext and checktext change the RHEL 10 audit key for the /etc/sudoers watch rules from logins to identity, and the fixtext load procedure changes from "service auditd restart" to "augenrules --load" - The audit_rules_watch template, the OVAL check, and the Bash and Ansible remediations already enforce the /etc/sudoers watch; the OVAL pattern does not read the audit key RHEL-10-500690: audit_rules_sudoers_d - The fixtext and checktext remove the trailing slash from the /etc/sudoers.d/ path in the b32 and b64 examples, following the V1R3 text - The implementation is unchanged: the rule keeps the shared /etc/sudoers.d/ path and the directory filter used by RHEL 8 and RHEL 9, whose STIG texts prescribe the same form; the trailing slash is functionally identical for the audit watch, and the directory filter watches /etc/sudoers.d recursively, covering the files under it that the path filter of the V1R3 examples does not RHEL-10-500720: audit_rules_usergroup_modification_opasswd - The title now names /etc/security/opasswd, where the password history file actually lives and which the rule already watches; the V1R2 title named /etc/opasswd, a path that does not exist - The policy file srg_requirement names /etc/security/opasswd, the fixtext prescribes the rules in /etc/audit/rules.d/identity.rules with the -k identity key and the augenrules --load command, the checktext uses grep instead of egrep with the b32 and b64 rule lines, and the scope narrows from all account creations, modifications, disabling, and termination events to all modifications - The audit_rules_watch render already enforces the /etc/security/opasswd watch; the OVAL pattern requires the arch, the path, and the perm filters and does not read the audit key or the rules file name RHEL-10-600740: set_password_hashing_algorithm_logindefs - The policy file vulnerability discussion adds the RHEL 10 default yescrypt and explains that it is not NIST CMVP validated - The control already selects var_password_hashing_algorithm=SHA512 and the rule enforces it as the ENCRYPT_METHOD in /etc/login.defs RHEL-10-700920: accounts_tmout - The title now requires 10 minutes, matching the already selected var_accounts_tmout=10_min that enforces TMOUT after 600 seconds - The policy file srg_requirement drops from 15 to 10 minutes - The control already selects var_accounts_tmout=10_min and the accounts_tmout check and remediations enforce 600 seconds RHEL-10-701210: service_autofs_disabled - The title drops the "unless required" exception; the rule already disables the autofs service and treats an absent autofs package as not applicable - The policy file srg_requirement and checktext drop the "unless required" exception, the checktext example shows not-found, and the vulnerability discussion is replaced with the device identification text - The rule already disables the autofs service; its package[autofs] platform guard and the service_disabled template treat an absent autofs package as not applicable

Rules affected: RHEL-10-300085: configure_openssl_crypto_policy - The new OpenSSL requirement is mapped to the rule; the equals-sign .include = /etc/crypto-policies/back-ends/opensslcnf.config form applies to the rhel family and to Fedora and Oracle Linux 9, which are named explicitly because they use the equals-sign form without belonging to the rhel family, in the shared check, the shared remediations, and the rule's directive text (the description, ocil_clause, OCIL, and fixtext), with pass and fail scenarios on multi_platform_rhel - The rule.yml OCIL grep example uses the equals-sign anchored form for the rhel family - policy/stig/rhel10.yml carries the V1R3 srg_requirement, vulnerability discussion, checktext, and fixtext - The rule joins SRG-OS-000250-GPOS-00093 in controls/srg_gpos, the SRG the requirement satisfies, so the stig-rules-srg-gpos check covers the new profile selection

Rules affected: RHEL-10-200050: package_tftp-server_removed - The control entry and policy/stig source are removed, the rule stays mapped to the RHEL 8 and RHEL 9 STIGs

Rules affected: RHEL-10-600100: accounts_maximum_age_login_defs - The control selects var_accounts_maximum_age_login_defs=180 and the policy/stig file raises the new-user password lifetime from 60 to 180 days - The incorrect_stig scenarios use 240 days, which exceeds the new limit RHEL-10-600110: accounts_password_set_max_life_existing - The control selects var_accounts_maximum_age_login_defs=180 and the policy/stig file raises the existing-account password lifetime from 60 to 180 days both rules: - The policy/stig files and the 600100 control title carry the V1R3 wording refresh: "must be changed" becomes "need to be changed" and "the operating system" becomes "RHEL 10"

Rules affected: RHEL-10-700950: disable_ctrlaltdel_burstaction - The policy/stig/rhel10.yml checktext and fixtext require the CtrlAltDelBurstAction=none setting in the /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf drop-in with the [Manager] section - The rule.yml ocil and fixtext conditions use the rhel family instead of the rhel8 and rhel9 list - New rhel10 scenarios cover the missing drop-in file and a wrong section

… RHEL-10-200000 Rules affected: RHEL-10-001030: ensure_gpgcheck_globally_activated RHEL-10-001040: ensure_gpgcheck_local_packages RHEL-10-001050: enable_gpgcheck_for_all_repositories RHEL-10-200000: clean_components_post_updating - The policy/stig checktext and fixtext name the accepted values 1, true, and yes case insensitively and note the value acceptability - The OVAL checks already accept the values case insensitively for gpgcheck, localpkg_gpgcheck, and clean_requirements_on_remove, and validate gpgcheck positively on every repository with the accepted values - New rhel10 scenarios cover the accepted values: mixed-case yes and true, uppercase TRUE, and the repository gpgcheck values, with the commented-out and invalid values failing

Rules affected: RHEL-10-600000: grub2_password - The OVAL requires GRUB2_PASSWORD with the grub.pbkdf2.sha512 prefix in /boot/grub2/user.cfg only: the RHEL 10 criteria are a separate elif, so unlike RHEL 9 the check carries no EFI path fallback, and the grub.cfg password alternative and the superuser criterion do not apply to RHEL 10 - policy/stig/rhel10.yml carries the V1R3 srg_requirement and the unified configuration file checktext, and the control title names single-user and maintenance mode authentication - The rule.yml OCIL gains a rhel10 branch grepping the GRUB2_PASSWORD=grub.pbkdf2.sha512 line in /boot/grub2/user.cfg - The invalid_username scenario platform drops RHEL 10: the check no longer verifies the superuser name, so the fail scenario would pass the scan - New rhel10 scenarios cover the user.cfg password passing, the missing user.cfg, the legacy grub.cfg-only configuration, and the wrong hash prefix failing

Rules affected: RHEL-10-600020: no_shelllogin_for_systemaccounts - The check accepts the reserved accounts root, halt, sync, and shutdown and rejects interactive shells on system accounts in the UID 1 to 999 band; the remediations extend the reserved-account and UID-band filtering to rhel10 in the ansible when clauses and the bash awk filter - The OVAL test and state ids drop the rhel9 suffix - New rhel10 scenarios cover the /usr/bin/false shell passing, the sync reserved account passing, and a UID 999 interactive shell failing

Rules affected: RHEL-10-500450: audit_rules_privileged_commands_gpasswd RHEL-10-500490: audit_rules_privileged_commands_passwd - The policy files carry the V1R3 checktext and fixtext, which prescribe the arch-split rules with the privileged-gpasswd and privileged-passwd keys, without a syscall filter and without auid filters - The rules use rhel10-specific hand-written OVAL, Bash, and Ansible files instead of the audit_rules_privileged_commands template, which stays at its master state for every product, following the layout of audit_rules_login_events_lastlog: the template serves the generic forms, and oval/rhel10.xml, bash/rhel10.sh, and ansible/rhel10.yml carry the RHEL 10 arch-split forms; the rule.ymls keep the master template block unchanged - oval/rhel10.xml: the RHEL 10 arch-split checks, b32 and b64. The pattern acceptance mirrors the DISA SCAP benchmark for passwd; for gpasswd the check is more lenient than the DISA pattern, which requires the auid filters, so a machine hardened under the previous release that carries the filters alongside the new form passes. The audit key is optional; the perm value accepts any x-containing combination; and the exit,always field order is accepted alongside always,exit - bash/rhel10.sh: the fixes write the rules the fixtext prescribes, the privileged-gpasswd and privileged-passwd keys included, into /etc/audit/rules.d/audit.rules and /etc/audit/audit.rules - ansible/rhel10.yml: the same rules through lineinfile tasks over a rule-and-regex fact and a service auditd restart, the lastlog ansible shape - the correct_value scenarios write the product forms: gpasswd rhel9 the execve form its checktext prescribes, passwd rhel9 and rhel10 the plain arch-split form, fedora and ol10 the auid-filtered form; the rhel10_correct_with_auid scenarios write the arch-split rules with auid filters, proving the optional-auid acceptance; the passwd with_execve fail scenarios run on both RHEL 9 and RHEL 10, where the execve filter fails both checks; the gpasswd with_execve fail scenarios run on RHEL 10 only, because the RHEL 9 gpasswd checktext prescribes the execve filter; the gpasswd missing_execve fail scenarios stay RHEL 9-only, where the plain form fails the check

Rules affected: RHEL-10-500605: audit_rules_privileged_commands_useradd - the control entry, cce@rhel10 CCE-86530-3, and the stig and stig_gui profile stability data select the rule in the STIG profile - the policy/stig/rhel10.yml carries the V1R3 srg_requirement, vulnerability discussion, checktext, and fixtext, which prescribe the single rule with the privileged-useradd key and the auid filters - the rule builds from the audit_rules_privileged_commands template with /usr/sbin/useradd, the same implementation the other privileged-command rules in the profile use

Rules affected: RHEL-10-600750: set_password_hashing_algorithm_libuserconf - The OVAL lookup changes from any "crypt_style" line to one anchored to the [defaults] section on all products; the previous lookup matched the line anywhere in the file, so a crypt_style in another section, where the setting has no effect, or a commented-out line passed the check - The checktext command changes from "grep crypt" to the anchored "grep -i "^crypt_style"" and gains the note that the requirement is not applicable when the libuser package is not installed - The fixtext section name changes from "[default]" to "[defaults]" - The Ansible remediation sets the crypt_style option in the [defaults] section of /etc/libuser.conf with the ini_file module, creating the file and the section when missing - New scenarios cover the wrong section, a commented-out setting, and a crypt_style in an earlier section not shadowing the [defaults] value; the scenarios run on all products

Rules affected: RHEL-10-200730: install_smartcard_packages - The OVAL gains a fedora, rhel10, and ol10 branch selecting pkcs11-provider and the rule metadata package set adds fedora to the rhel10 and ol10 group, aligning the check and the description with the pkcs11-provider package their remediations already install; the openssl-pkcs11 path used by RHEL 8 and RHEL 9 is unchanged - The checktext and fixtext change the package name from openssl-pkcs11 to pkcs11-provider - The vulnerability discussion abbreviates multifactor authentication to MFA after the first mention and retains the DOD-approved PKI wording - New scenarios cover the installed package, the missing package, and another smart card package not satisfying the requirement

Both the stig and stig_gui stability files: - add var_accounts_maximum_age_login_defs=180 and configure_openssl_crypto_policy - remove var_accounts_maximum_age_login_defs=60 and package_tftp-server_removed

Mab879 · 2026-11-13T18:02:07Z


 # remediation = none
-# platform = Red Hat Enterprise Linux 10,multi_platform_ubuntu,multi_platform_sle,multi_platform_fedora
+# platform = multi_platform_ubuntu,multi_platform_sle,multi_platform_fedora


If Red Hat Enterprise Linux 10 is gone so should Fedora?

Mab879 · 2026-11-13T18:03:27Z

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 10


This should work on all right?

Mab879 · 2026-11-13T18:03:37Z

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 10


This should work on all right?

Mab879

The test platforms could be improved, but that can be follow up PR.

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 19, 2026

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from b021e31 to 53eaae7 Compare October 20, 2026 21:57

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread ...os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml Resolved

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread ...os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml Resolved

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/bash/shared.sh Resolved

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 8 times, most recently from 8596888 to ec2c2e7 Compare October 22, 2026 12:07

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread .../accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_alternate_dropin.pass.sh Resolved

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread ...ounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_main_config.pass.sh Resolved

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread ...nts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_wrong_section.fail.sh Resolved

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread .../accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_alternate_dropin.pass.sh Resolved

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 3 times, most recently from 8d29aa8 to 3a9089f Compare October 23, 2026 08:56

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 3a9089f to a384acc Compare October 23, 2026 10:10

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

macko1 added this to the 0.1.83 milestone Oct 23, 2026

macko1 added the STIG STIG Benchmark related. label Oct 23, 2026

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

Mab879 requested changes Oct 23, 2026

View reviewed changes

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 83c96d8 to 581a949 Compare October 26, 2026 14:25

macko1 requested review from ggbecker, jan-cerny and marcusburghardt as code owners November 12, 2026 18:17

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Nov 12, 2026

Mab879 reviewed Nov 12, 2026

View reviewed changes

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 36a8f36 to 6e1f009 Compare November 13, 2026 11:31

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Nov 13, 2026

macko1 added 2 commits November 13, 2026 12:52

rhel10: STIG v1r3 update DISA manual from cyber.mil

f6fcf22

Replace the RHEL 10 DISA STIG manual reference file with the V1R3 content.

rhel10: STIG v1r3 update versions in control file and profiles

95e1dd7

Set the control file version and the stig and stig_gui profile metadata and descriptions to V1R3. Metadata only, no rules are affected.

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 6e1f009 to 9189c2e Compare November 13, 2026 12:03

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Nov 13, 2026

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 2 times, most recently from 85827da to d8433bd Compare November 13, 2026 13:42

macko1 and others added 14 commits November 13, 2026 14:42

rhel10: STIG v1r3 remove RHEL-10-200050

8007082

Rules affected: RHEL-10-200050: package_tftp-server_removed - The control entry and policy/stig source are removed, the rule stays mapped to the RHEL 8 and RHEL 9 STIGs

rhel10: STIG v1r3 update profile stability data

c472ea1

Both the stig and stig_gui stability files: - add var_accounts_maximum_age_login_defs=180 and configure_openssl_crypto_policy - remove var_accounts_maximum_age_login_defs=60 and package_tftp-server_removed

rhel10: STIG v1r0-v1r3 update DISA SCAP Benchmark from cyber.mil

e42540c

Mab879 reviewed Nov 13, 2026

View reviewed changes

Mab879 approved these changes Nov 13, 2026

View reviewed changes

		@@ -0,0 +1,7 @@
		#!/bin/bash
		# platform = Red Hat Enterprise Linux 10

Conversation

macko1 commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mab879 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

macko1 commented Nov 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mab879 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

macko1 commented Oct 19, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading