From caee039a8c2f1b067d1913a47fef04a2087967e1 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Tue, 8 Sep 2026 12:11:43 +0100
Subject: [PATCH] Change path of rule to realpath as per stig

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../audit_rules_privileged_commands_fdisk/ansible/shared.yml  | 4 ++--
 .../audit_rules_privileged_commands_fdisk/bash/shared.sh      | 4 ++--
 .../audit_rules_privileged_commands_fdisk/oval/shared.xml     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/ansible/shared.yml
index bbedfcb37d07..7979625915cc 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/ansible/shared.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/ansible/shared.yml
@@ -4,5 +4,5 @@
 # complexity = low
 # disruption = low
 
-{{{ ansible_audit_augenrules_add_watch_rule(path='/sbin/fdisk', permissions='x', key='modules', rule_title=rule_title) }}}
-{{{ ansible_audit_auditctl_add_watch_rule(path='/sbin/fdisk', permissions='x', key='modules', rule_title=rule_title) }}}
+{{{ ansible_audit_augenrules_add_watch_rule(path='/usr/sbin/fdisk', permissions='x', key='modules', rule_title=rule_title) }}}
+{{{ ansible_audit_auditctl_add_watch_rule(path='/usr/sbin/fdisk', permissions='x', key='modules', rule_title=rule_title) }}}
diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/bash/shared.sh
index bb3c30c530f2..50208c5f0354 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/bash/shared.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/bash/shared.sh
@@ -1,5 +1,5 @@
 # platform = multi_platform_ubuntu
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
-{{{ bash_fix_audit_watch_rule("auditctl", "/sbin/fdisk", "x", "modules") }}}
-{{{ bash_fix_audit_watch_rule("augenrules", "/sbin/fdisk", "x", "modules") }}}
+{{{ bash_fix_audit_watch_rule("auditctl", "/usr/sbin/fdisk", "x", "modules") }}}
+{{{ bash_fix_audit_watch_rule("augenrules", "/usr/sbin/fdisk", "x", "modules") }}}
diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/oval/shared.xml b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/oval/shared.xml
index 4a284e7fdae0..9e006ba271fd 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/oval/shared.xml
+++ b/linux_os/guide/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_fdisk/oval/shared.xml
@@ -23,7 +23,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_fdisk_augenrules" version="1">
     <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*-w[\s]+/sbin/fdisk[\s]+-p[\s]+x([\s]+-k[\s]+[\S]+)?[\s]*$</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*-w[\s]+/usr/sbin/fdisk[\s]+-p[\s]+x([\s]+-k[\s]+[\S]+)?[\s]*$</ind:pattern>
     <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -32,7 +32,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_fdisk_auditctl" version="1">
     <ind:filepath>/etc/audit/audit.rules</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*-w[\s]+/sbin/fdisk[\s]+-p[\s]+x([\s]+-k[\s]+[\S]+)?[\s]*$</ind:pattern>
+    <ind:pattern operation="pattern match">^[\s]*-w[\s]+/usr/sbin/fdisk[\s]+-p[\s]+x([\s]+-k[\s]+[\S]+)?[\s]*$</ind:pattern>
     <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>