Align audit_rules_sudoers_d remediation with DISA STIG content - #15060
Draft
ggbecker wants to merge 1 commit into
Draft
Align audit_rules_sudoers_d remediation with DISA STIG content#15060ggbecker wants to merge 1 commit into
ggbecker wants to merge 1 commit into
Conversation
ggbecker
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
August 26, 2026 13:31
ggbecker
added
RHEL
ggbecker
marked this pull request as draft
August 26, 2026 13:35
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
The DISA RHEL 9 STIG (SV-258218) OVAL check requires the /etc/sudoers.d
audit rule to use the 'path' filter without a trailing slash:
-a always,exit -F arch=b64 -F path=/etc/sudoers.d -F perm=wa ...
Our content generated the semantically equivalent 'dir' form with a
trailing slash, so systems remediated by our content failed DISA scans
while passing our own check.
- The audit_rules_watch OVAL template now accepts both the 'dir' and
'path' filters, with or without a trailing slash, so systems already
remediated with the previous form are not regressed. The template.py
preprocessing normalizes away a trailing slash so the optional-slash
match is symmetric for every rule using the template.
- audit_rules_sudoers_d now uses the path '/etc/sudoers.d' (no trailing
slash) so the remediation emits the DISA-aligned 'path=' rule.
- Generalize the coverage into the audit_rules_watch template tests
(dir<->path filter alternation and trailing-slash toggle) so it
applies to every rule using the template on all platforms, instead of
rule-specific tests for audit_rules_sudoers_d.
ggbecker
force-pushed
the
audit_rules_sudoers_d_disa_path
branch
from
August 26, 2026 14:06
e542e1f to
877b885
Compare
jan-cerny
reviewed
Aug 27, 2026
| <literal_component>{{{ PATH_ESCAPED }}}</literal_component> | ||
| {{% endif %}} | ||
| <literal_component>\s+\-F\s+perm=\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</literal_component> | ||
| <literal_component>/?\s+\-F\s+perm=\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</literal_component> |
Member
There was a problem hiding this comment.
@ggbecker Will it accidentally start accepting paths with trailing slash where it shouldn't accept it? When the audit rule is supposed to watch a regular file (not a directory) but the audit rule contains a path with a trailing slash, will the rule fail?
Let's assume that I have the following rules in the /etc/audit/audit.rules, which is supposed to watch the /etc/passwd file, but notice the path:
-a always,exit -F arch=b32 -F path=/etc/passwd/ -F perm=wa -F key=identity
-a always,exit -F arch=b64 -F path=/etc/passwd/ -F perm=wa -F key=identity
What will be the OVAL result?
| data["name"] = name | ||
| if lang == "oval": | ||
| data["path_escaped"] = path.replace("/", "\\/") | ||
| # Normalize away a trailing slash so it can be made optional in the |
Member
There was a problem hiding this comment.
@ggbecker I consider having the new behavior accessible by a new template parameter instead of changing the existing behavior.
jan-cerny
reviewed
Aug 27, 2026
| At a minimum, the audit system should collect administrator actions | ||
| for all users and root. | ||
| {{{ describe_audit_rules_watch("/etc/sudoers.d/", "actions") }}} | ||
| {{{ describe_audit_rules_watch("/etc/sudoers.d", "actions") }}} |
Member
There was a problem hiding this comment.
The RHEL 10 STIG contains the trailing slash in the rule, so the description won't match the rule. https://stigaview.com/products/rhel10/v1r2/RHEL-10-500690/
Member
|
Can we remove the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
audit_rules_sudoers_dto watch/etc/sudoers.d(no trailing slash), so the remediation emits thepath=filter form instead ofdir=.audit_rules_watchOVAL template accept both thedirandpathfilters, with or without a trailing slash.audit_rules_sudoers_dcovering all accepted forms and the negative cases.Rationale:
-a always,exit -F arch=b64 -F path=/etc/sudoers.d -F perm=wa .... Our content generated the semantically equivalent-F dir=/etc/sudoers.d/form, so systems remediated by our content passed our own scan but failed the DISA scan.dir=form.Review Hints:
pathtemplate var inrule.yml;template.pyderivesfilter_type(dirvspath) from that slash.(dir|path)+ optional trailing slash, so it never rejects anything previously accepted; it affects all 35 rules using the template.-F key=value, so keepingkey=actionsis fine; confirmed againstU_RHEL_9_V2R9_STIG_SCAP_1-3_Benchmark.