Description of problem:
Rules that use the audit_rules_dac_modification template are misaligned with DISA on RHEL 10.3.
SCAP Security Guide Version:
current upstream master as of 2026-09-22
Operating System Version:
RHEL 10.3
Steps to Reproduce:
Run contest test /scanning/disa-alignment/oscap and /scanning/disa-alignment/ansible.
Actual Results:
audit_rules_dac_modification_fremovexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_fsetxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_lremovexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_lsetxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_removexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_setxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
Expected Results:
both SSG and DISA result should be pass for all the rules that use the audit_rules_dac_modification template.
Additional Information/Debugging Steps:
The problem is that DISA rules require to have 2 audit rules - first for auid >=1000 and second for auid == 0. Our content has only the former but doesn't have the latter.
We need to add a template parameter setting check_root_user@rhel10: "true" to all affected rules to activate these audit rules check.
Description of problem:
Rules that use the
audit_rules_dac_modificationtemplate are misaligned with DISA on RHEL 10.3.SCAP Security Guide Version:
current upstream master as of 2026-09-22
Operating System Version:
RHEL 10.3
Steps to Reproduce:
Run contest test
/scanning/disa-alignment/oscapand/scanning/disa-alignment/ansible.Actual Results:
audit_rules_dac_modification_fremovexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_fsetxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_lremovexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_lsetxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_removexattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
audit_rules_dac_modification_setxattr SSG result: pass, DISA result(s): SV-281117r1184680_rule:fail
Expected Results:
both SSG and DISA result should be pass for all the rules that use the
audit_rules_dac_modificationtemplate.Additional Information/Debugging Steps:
The problem is that DISA rules require to have 2 audit rules - first for
auid >=1000and second forauid == 0. Our content has only the former but doesn't have the latter.We need to add a template parameter setting
check_root_user@rhel10: "true"to all affected rules to activate these audit rules check.