Update Rhel8 stig v2r8 to v2r9 by macko1 · Pull Request #15214 · ComplianceAsCode/content

macko1 · 2026-10-19T10:54:14Z

Description:

Description here. Replace this text. Don't use the italics format!

Rationale:

Rationale here. Replace this text. Don't use the italics format!
Fixes # Issue number here (e.g. Updating sysctl XCCDF naming #26) or remove this line if no issue exists.

Review Hints:

Review hints here. Replace this text. Don't use the italics format!
Use this optional section to give any relevant information which could help the reviewer to more quickly and assertively understand and test the changes.
Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc.

openshift-ci · 2026-10-19T10:54:19Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-10-19T11:38:01Z

This datastream diff is auto generated by the check Compare DS/Generate Diff.
Due to the excessive size of the diff, it has been trimmed to fit the 65535-character limit.

Click here to see the trimmed diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_fips_crypto_subpolicy'.
--- xccdf_org.ssgproject.content_rule_fips_crypto_subpolicy
+++ xccdf_org.ssgproject.content_rule_fips_crypto_subpolicy
@@ -32,19 +32,19 @@
 RHEL-08-010297
 
 [reference]:
-SV-230223r1155356_rule
+SV-230223r1262171_rule
 
 [reference]:
-SV-230251r1184240_rule
+SV-230251r1262195_rule
 
 [reference]:
-SV-230252r1184241_rule
+SV-230252r1262196_rule
 
 [reference]:
-SV-272482r1208740_rule
+SV-272482r1262197_rule
 
 [reference]:
-SV-272483r1184243_rule
+SV-272483r1262198_rule
 
 [reference]:
 V-230223

New content has different text for rule 'xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy'.
--- xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
+++ xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
@@ -16,51 +16,6 @@
 [reference]:
 SRG-OS-000394-GPOS-00174
 
-[reference]:
-RHEL-08-010020
-
-[reference]:
-RHEL-08-010290
-
-[reference]:
-RHEL-08-010291
-
-[reference]:
-RHEL-08-010296
-
-[reference]:
-RHEL-08-010297
-
-[reference]:
-SV-230223r1155356_rule
-
-[reference]:
-SV-230251r1184240_rule
-
-[reference]:
-SV-230252r1184241_rule
-
-[reference]:
-SV-272482r1208740_rule
-
-[reference]:
-SV-272483r1184243_rule
-
-[reference]:
-V-230223
-
-[reference]:
-V-230251
-
-[reference]:
-V-230252
-
-[reference]:
-V-272482
-
-[reference]:
-V-272483
-
 [rationale]:
 To follow STIG policy.
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy' differs.
--- xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
+++ xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
@@ -3,11 +3,6 @@
     manager: auto
   tags:
   - CCE-86493-4
-  - DISA-STIG-RHEL-08-010020
-  - DISA-STIG-RHEL-08-010290
-  - DISA-STIG-RHEL-08-010291
-  - DISA-STIG-RHEL-08-010296
-  - DISA-STIG-RHEL-08-010297
   - configure_strategy
   - fips_custom_stig_sub_policy
   - low_complexity
@@ -27,11 +22,6 @@
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-86493-4
-  - DISA-STIG-RHEL-08-010020
-  - DISA-STIG-RHEL-08-010290
-  - DISA-STIG-RHEL-08-010291
-  - DISA-STIG-RHEL-08-010296
-  - DISA-STIG-RHEL-08-010297
   - configure_strategy
   - fips_custom_stig_sub_policy
   - low_complexity
@@ -51,11 +41,6 @@
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-86493-4
-  - DISA-STIG-RHEL-08-010020
-  - DISA-STIG-RHEL-08-010290
-  - DISA-STIG-RHEL-08-010291
-  - DISA-STIG-RHEL-08-010296
-  - DISA-STIG-RHEL-08-010297
   - configure_strategy
   - fips_custom_stig_sub_policy
   - low_complexity
@@ -72,11 +57,6 @@
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-86493-4
-  - DISA-STIG-RHEL-08-010020
-  - DISA-STIG-RHEL-08-010290
-  - DISA-STIG-RHEL-08-010291
-  - DISA-STIG-RHEL-08-010296
-  - DISA-STIG-RHEL-08-010297
   - configure_strategy
   - fips_custom_stig_sub_policy
   - low_complexity
@@ -92,11 +72,6 @@
   - current_crypto_policy.stdout.strip() != "FIPS:STIG"
   tags:
   - CCE-86493-4
-  - DISA-STIG-RHEL-08-010020
-  - DISA-STIG-RHEL-08-010290
-  - DISA-STIG-RHEL-08-010291
-  - DISA-STIG-RHEL-08-010296
-  - DISA-STIG-RHEL-08-010297
   - configure_strategy
   - fips_custom_stig_sub_policy
   - low_complexity

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy
@@ -40,7 +40,7 @@
 RHEL-08-010275
 
 [reference]:
-SV-279931r1184237_rule
+SV-279931r1262194_rule
 
 [reference]:
 V-279931

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_configure_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_crypto_policy
@@ -136,22 +136,22 @@
 RHEL-08-010297
 
 [reference]:
-SV-230223r1155356_rule
+SV-230223r1262171_rule
 
 [reference]:
 SV-279932r1156349_rule
 
 [reference]:
-SV-230251r1184240_rule
+SV-230251r1262195_rule
 
 [reference]:
-SV-230252r1184241_rule
+SV-230252r1262196_rule
 
 [reference]:
-SV-272482r1208740_rule
+SV-272482r1262197_rule
 
 [reference]:
-SV-272483r1184243_rule
+SV-272483r1262198_rule
 
 [reference]:
 V-230223

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -11,7 +11,7 @@
 To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
 available under /etc/pki/tls/openssl.cnf.
 This file has the ini format, and it enables crypto policy support
-if there is a [ crypto_policy ] section that contains the .include /etc/crypto-policies/back-ends/opensslcnf.config directive.
+if there is a [ crypto_policy ] section that contains the .include = /etc/crypto-policies/back-ends/opensslcnf.config directive.
 
 [reference]:
 CIP-003-8 R4.2
@@ -76,6 +76,15 @@
 [reference]:
 SRG-OS-000250-GPOS-00093
 
+[reference]:
+RHEL-08-010293
+
+[reference]:
+SV-288829r1261888_rule
+
+[reference]:
+V-288829
+
 [rationale]:
 Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
 and makes system configuration more fragmented.

OCIL for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
+++ ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
@@ -1,8 +1,9 @@
 To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
 /etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
-.include /etc/crypto-policies/back-ends/opensslcnf.config directive:
+.include = /etc/crypto-policies/back-ends/opensslcnf.config directive:
 
-$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
+
+$ sudo grep '\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
       Is it the case that the OpenSSL config file doesn't contain the whole section,
-or the section doesn't contain the <pre>.include /etc/crypto-policies/back-ends/opensslcnf.config</pre> directive?
+or the section doesn't contain the <pre>.include = /etc/crypto-policies/back-ends/opensslcnf.config</pre> directive?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -4,9 +4,11 @@
 OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
 OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
 
-OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
+OPENSSL_CRYPTO_POLICY_INCLUSION='.include = /etc/crypto-policies/back-ends/opensslcnf.config'
 
-OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
+
+OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$'
+
 
 
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -3,6 +3,7 @@
     manager: auto
   tags:
   - CCE-80938-4
+  - DISA-STIG-RHEL-08-010293
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)
@@ -28,6 +29,7 @@
   when: '"openssl" in ansible_facts.packages'
   tags:
   - CCE-80938-4
+  - DISA-STIG-RHEL-08-010293
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)
@@ -48,11 +50,12 @@
   ansible.builtin.find:
     paths: /etc/pki/tls
     patterns: openssl.cnf
-    contains: ^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$
+    contains: ^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$
   register: test_crypto_policy_include_directive
   when: '"openssl" in ansible_facts.packages'
   tags:
   - CCE-80938-4
+  - DISA-STIG-RHEL-08-010293
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)
@@ -73,7 +76,7 @@
   ansible.builtin.lineinfile:
     create: true
     insertafter: ^\s*\[\s*crypto_policy\s*]\s*
-    line: .include /etc/crypto-policies/back-ends/opensslcnf.config
+    line: .include = /etc/crypto-policies/back-ends/opensslcnf.config
     path: /etc/pki/tls/openssl.cnf
     mode: 420
   when:
@@ -82,6 +85,7 @@
   - test_crypto_policy_include_directive.matched == 0
   tags:
   - CCE-80938-4
+  - DISA-STIG-RHEL-08-010293
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)
@@ -103,7 +107,7 @@
     create: true
     line: |-
       [crypto_policy]
-      .include /etc/crypto-policies/back-ends/opensslcnf.config
+      .include = /etc/crypto-policies/back-ends/opensslcnf.config
     path: /etc/pki/tls/openssl.cnf
     mode: 420
   when:
@@ -111,6 +115,7 @@
   - test_crypto_policy_group.matched == 0
   tags:
   - CCE-80938-4
+  - DISA-STIG-RHEL-08-010293
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
@@ -67,6 +67,15 @@
 SRG-OS-000250-GPOS-00093
 
 [reference]:
+SRG-OS-000393-GPOS-00173
+
+[reference]:
+SRG-OS-000394-GPOS-00174
+
+[reference]:
+SRG-OS-000125-GPOS-00065
+
+[reference]:
 0418
 
 [reference]:
@@ -81,6 +90,15 @@
 [reference]:
 5.1.1
 
+[reference]:
+RHEL-08-010287
+
+[reference]:
+SV-288830r1261891_rule
+
+[reference]:
+V-288830
+
 [rationale]:
 Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
 and makes system configuration more fragmented.

bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
@@ -3,7 +3,21 @@
 
 SSH_CONF="/etc/sysconfig/sshd"
 
-sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF
+
+# Replace an uncommented 'CRYPTO_POLICY' assignment with the commented directive
+# so that the SSH daemon uses the systemwide crypto policy.
+sed -i "s/^\s*CRYPTO_POLICY\s*=.*$/# CRYPTO_POLICY=/I" "$SSH_CONF"
+
+# Ensure the commented directive is present even when no assignment was set.
+if ! grep -q "CRYPTO_POLICY" "$SSH_CONF"; then
+    echo "# CRYPTO_POLICY=" >> "$SSH_CONF"
+fi
+
+# Restart 'sshd' so the change takes effect; skip when systemd is not running,
+# for example in containers.
+if [[ $(/usr/bin/systemctl is-system-running) != "offline" ]]; then
+    /usr/bin/systemctl restart sshd.service
+fi
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy
@@ -3,6 +3,29 @@
     manager: auto
   tags:
   - CCE-80939-2
+  - DISA-STIG-RHEL-08-010287
+  - NIST-800-171-03.01.12
+  - NIST-800-53-AC-17(2)
+  - NIST-800-53-AC-17(a)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-MA-4(6)
+  - NIST-800-53-SC-13
+  - PCI-DSS-Req-2.2
+  - PCI-DSSv4-2.2
+  - PCI-DSSv4-2.2.7
+  - configure_ssh_crypto_policy
+  - disable_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - reboot_required
+
+- name: Service facts
+  ansible.builtin.service_facts: null
+  when: '"kernel-core" in ansible_facts.packages'
+  tags:
+  - CCE-80939-2
+  - DISA-STIG-RHEL-08-010287
   - NIST-800-171-03.01.12
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
@@ -23,10 +46,11 @@
   ansible.builtin.lineinfile:
     dest: /etc/sysconfig/sshd
     state: absent
-    regexp: (?i)^\s*CRYPTO_POLICY.*$
+    regexp: (?i)^\s*CRYPTO_POLICY\s*=.*$
   when: '"kernel-core" in ansible_facts.packages'
   tags:
   - CCE-80939-2
+  - DISA-STIG-RHEL-08-010287
   - NIST-800-171-03.01.12
   - NIST-800-53-AC-17(2)
   - NIST-800-53-AC-17(a)
@@ -42,3 +66,57 @@
   - medium_disruption
   - medium_severity
   - reboot_required
+
+- name: Configure SSH to use System Crypto Policy - Add the Commented CRYPTO_POLICY
+    Directive
+  ansible.builtin.lineinfile:
+    dest: /etc/sysconfig/sshd
+    state: present
+    create: true
+    mode: '0644'
+    line: '# CRYPTO_POLICY='
+  when: '"kernel-core" in ansible_facts.packages'
+  tags:
+  - CCE-80939-2
+  - DISA-STIG-RHEL-08-010287
+  - NIST-800-171-03.01.12
+  - NIST-800-53-AC-17(2)
+  - NIST-800-53-AC-17(a)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-MA-4(6)
+  - NIST-800-53-SC-13
+  - PCI-DSS-Req-2.2
+  - PCI-DSSv4-2.2
+  - PCI-DSSv4-2.2.7
+  - configure_ssh_crypto_policy
+  - disable_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - reboot_required
+
+- name: Configure SSH to use System Crypto Policy - Restart the SSH Daemon
+  ansible.builtin.systemd:
+    name: sshd.service
+    state: restarted
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - ('sshd.service' in ansible_facts.services)
+  tags:
+  - CCE-80939-2
+  - DISA-STIG-RHEL-08-010287
+  - NIST-800-171-03.01.12
+  - NIST-800-53-AC-17(2)
+  - NIST-800-53-AC-17(a)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-MA-4(6)
+  - NIST-800-53-SC-13
+  - PCI-DSS-Req-2.2
+  - PCI-DSSv4-2.2
+  - PCI-DSSv4-2.2.7
+  - configure_ssh_crypto_policy
+  - disable_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - reboot_required

New content has different text for rule 'xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported'.
--- xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported
+++ xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported
@@ -92,7 +92,7 @@
 RHEL-08-010000
 
 [reference]:
-SV-230221r1017040_rule
+SV-230221r1262181_rule
 
 [reference]:
 V-230221

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sudo_require_reauthentication'.
--- xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
+++ xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
@@ -42,7 +42,7 @@
 RHEL-08-010384
 
 [reference]:
-SV-237643r1050789_rule
+SV-237643r1262533_rule
 
 [reference]:
 V-237643

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed'.
--- xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed
+++ xccdf_org.ssgproject.content_rule_package_krb5-workstation_removed
@@ -23,7 +23,7 @@
 RHEL-08-010162
 
 [reference]:
-SV-230239r1017058_rule
+SV-230239r1262191_rule
 
 [reference]:
 V-230239

New content has different text for rule 'xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories'.
--- xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories
+++ xccdf_org.ssgproject.content_rule_enable_gpgcheck_for_all_repositories
@@ -19,7 +19,7 @@
 RHEL-08-010370
 
 [reference]:
-SV-230264r1017377_rule
+SV-230264r1262199_rule
 
 [reference]:
 V-230264

New content has different text for rule 'xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages'.
--- xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
+++ xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
@@ -113,7 +113,7 @@
 RHEL-08-010371
 
 [reference]:
-SV-230265r1208742_rule
+SV-230265r1262200_rule
 
 [reference]:
 V-230265

New content has different text for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue'.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -146,7 +146,7 @@
 RHEL-08-010060
 
 [reference]:
-SV-230227r1017046_rule
+SV-230227r1262184_rule
 
 [reference]:
 V-230227

New content has different text for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text'.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -137,7 +137,7 @@
 RHEL-08-010050
 
 [reference]:
-SV-230226r1069298_rule
+SV-230226r1262183_rule
 
 [reference]:
 V-230226

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen'.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
@@ -242,7 +242,7 @@
 RHEL-08-020230
 
 [reference]:
-SV-230369r1017181_rule
+SV-230369r1262207_rule
 
 [reference]:
 V-230369

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth'.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -8,7 +8,7 @@
 To enable PAM password complexity in system-auth file:
 Edit the password section in
 /etc/pam.d/system-auth to show
-password    requisite                                    pam_pwquality.so.
+password    required                                    pam_pwquality.so.
 
 [reference]:
 SRG-OS-000480-GPOS-00227
@@ -23,7 +23,7 @@
 RHEL-08-020101
 
 [reference]:
-SV-251713r1017366_rule
+SV-251713r1262179_rule
 
 [reference]:
 V-251713

OCIL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1
+++ ocil:ssg-accounts_password_pam_pwquality_system_auth_ocil:questionnaire:1
@@ -1,6 +1,6 @@
 To check if pam_pwquality.so is enabled in system-auth, run the following command:
 $ grep pam_pwquality /etc/pam.d/system-auth
 The output should be similar to the following:
-password requisite pam_pwquality.so
+password required pam_pwquality.so
       Is it the case that pam_pwquality.so is not enabled in system-auth?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -37,17 +37,17 @@
         authselect apply-changes -b
     fi
     
-if ! grep -qP "^\s*password\s+requisite\s+pam_pwquality.so\s*.*" "$PAM_FILE_PATH"; then
+if ! grep -qP "^\s*password\s+required\s+pam_pwquality.so\s*.*" "$PAM_FILE_PATH"; then
     # Line matching group + control + module was not found. Check group + module.
     if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwquality.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
         # The control is updated only if one single line matches.
-        sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwquality.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
+        sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwquality.so.*)/\1required \2/" "$PAM_FILE_PATH"
     else
         LAST_MATCH_LINE=$(grep -nP "^account.*required.*pam_permit\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
         if [ ! -z $LAST_MATCH_LINE ]; then
-            sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwquality.so" "$PAM_FILE_PATH"
+            sed -i --follow-symlinks $LAST_MATCH_LINE" a password     required    pam_pwquality.so" "$PAM_FILE_PATH"
         else
-            echo "password    requisite    pam_pwquality.so" >> "$PAM_FILE_PATH"
+            echo "password    required    pam_pwquality.so" >> "$PAM_FILE_PATH"
         fi
     fi
 fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -199,7 +199,7 @@
   - name: Ensure PAM password complexity module is enabled in system-auth - Define
       a fact for control already filtered in case filters are used
     ansible.builtin.set_fact:
-      pam_module_control: requisite
+      pam_module_control: required
 
   - name: Ensure PAM password complexity module is enabled in system-auth - Check
       if expected PAM module line is present in {{ pam_file_path }}

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs'.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
@@ -199,7 +199,7 @@
 RHEL-08-010110
 
 [reference]:
-SV-230231r1017050_rule
+SV-230231r1262187_rule
 
 [reference]:
 V-230231

OCIL for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1
+++ ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1
@@ -1,5 +1,5 @@
 
-Verify that the shadow password suite configuration is set to encrypt password with a FIPS 140-2 approved cryptographic hashing algorithm.
+Verify that the shadow password suite configuration is set to encrypt password with a FIPS 140-2-approved cryptographic hashing algorithm.
 
 Check the hashing algorithm that is being used to hash passwords with the following command:
 

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth'.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -223,7 +223,7 @@
 RHEL-08-010160
 
 [reference]:
-SV-230237r1017056_rule
+SV-230237r1262189_rule
 
 [reference]:
 V-230237

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth'.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -232,7 +232,7 @@
 RHEL-08-010159
 
 [reference]:
-SV-244524r1017330_rule
+SV-244524r1262188_rule
 
 [reference]:
 V-244524

New content has different text for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction'.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -223,7 +223,7 @@
 RHEL-08-040172
 
 [reference]:
-SV-230531r1208754_rule
+SV-230531r1262161_rule
 
 [reference]:
 V-230531

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_opensc_installed'.
--- xccdf_org.ssgproject.content_rule_package_opensc_installed
+++ xccdf_org.ssgproject.content_rule_package_opensc_installed
@@ -25,7 +25,7 @@
 RHEL-08-010410
 
 [reference]:
-SV-230275r958816_rule
+SV-230275r1262205_rule
 
 [reference]:
 V-230275

New content has different text for rule 'xccdf_org.ssgproject.content_rule_install_smartcard_packages'.
--- xccdf_org.ssgproject.content_rule_install_smartcard_packages
+++ xccdf_org.ssgproject.content_rule_install_smartcard_packages
@@ -34,7 +34,7 @@
 RHEL-08-010390
 
 [reference]:
-SV-230273r1017381_rule
+SV-230273r1262203_rule
 
 [reference]:
 V-230273

New content has different text for rule 'xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration'.
--- xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
+++ xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration
@@ -280,7 +280,7 @@
 RHEL-08-020260
 
 [reference]:
-SV-230373r1017185_rule
+SV-230373r1262210_rule
 
 [reference]:
 V-230373

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs'.
--- xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs
@@ -205,7 +205,7 @@
 RHEL-08-020200
 
 [reference]:
-SV-230366r1038967_rule
+SV-230366r1262169_rule
 
 [reference]:
 V-230366

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs'.
--- xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs
@@ -223,7 +223,7 @@
 RHEL-08-020231
 
 [reference]:
-SV-230370r1017182_rule
+SV-230370r1262208_rule
 
 [reference]:
 V-230370

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing'.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
@@ -39,7 +39,7 @@
 RHEL-08-020210
 
 [reference]:
-SV-230367r1038967_rule
+SV-230367r1262170_rule
 
 [reference]:
 V-230367

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay'.
--- xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay
+++ xccdf_org.ssgproject.content_rule_accounts_logon_fail_delay
@@ -73,7 +73,7 @@
 RHEL-08-020310
 
 [reference]:
-SV-230378r1017189_rule
+SV-230378r1262211_rule
 
 [reference]:
 V-230378

New content has different text for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username'.
--- xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username
+++ xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username
@@ -13,8 +13,10 @@
 /etc/grub.d/01_users configuration file to reflect the account name change.
 
         
-It is highly suggested not to use common administrator account names like root,
-admin, or administrator for the grub2 superuser account.
+
+For RHEL 8, do not use the standard administrative account names root, admin,
+administrator, superuser, or unlock for the grub2 superuser account.
+
 
         
 Change the superuser to a different username (The default is 'root').
@@ -280,7 +282,7 @@
 RHEL-08-010141
 
 [reference]:
-SV-244521r1137691_rule
+SV-244521r1262177_rule
 
 [reference]:
 V-244521

OVAL for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username' differs.
--- oval:ssg-grub2_uefi_admin_username:def:1
+++ oval:ssg-grub2_uefi_admin_username:def:1
@@ -1,5 +1,5 @@
 criteria OR
-criterion oval:ssg-test_bootloader_uefi_superuser_differ_from_other_users:tst:1
+criterion oval:ssg-test_bootloader_uefi_primary_superuser_differ_from_other_users:tst:1
 criteria AND
-criterion oval:ssg-test_grub2_uefi_admin_username_stub:tst:1
-criterion oval:ssg-test_bootloader_uefi_boot_superuser_differ_from_other_users:tst:1
+criterion oval:ssg-test_grub2_uefi_admin_username_primary_grubcfg_absent:tst:1
+criterion oval:ssg-test_bootloader_uefi_legacy_superuser_differ_from_other_users:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_admin_username' differs.
--- ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1
+++ ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1
@@ -1,10 +1,16 @@
-To verify the boot loader superuser account has been set, run the following
-command:
-sudo grep -A1 "superusers" /boot/efi/EFI/redhat/grub.cfg
+
+To verify the boot loader superuser account has been set, run the following command:
+# grep -iw "superusers" /boot/grub2/grub.cfg
 The output should show the following:
 set superusers="superusers-account"
 export superusers
-where superusers-account is the actual account name different from common names like root,
-admin, or administrator and different from any other existing user name.
-      Is it the case that superuser account is not set or is set to an existing name or to a common name?
+where superusers-account is the actual account name and is not root, admin, administrator,
+superuser, unlock, or any other existing user name.
+
+If /boot/grub2/grub.cfg is absent on an older RHEL 8 deployment, run:
+# grep -iw "superusers" /boot/efi/EFI/redhat/grub.cfg
+
+If superusers is not defined or is set to root, admin, administrator, superuser,
+unlock, or an existing user name, this is a finding.
+      Is it the case that superuser account is not set or is set to root, admin, administrator, superuser, unlock, or an existing user name?
       
New content has different text for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_password'.
--- xccdf_org.ssgproject.content_rule_grub2_uefi_password
+++ xccdf_org.ssgproject.content_rule_grub2_uefi_password
@@ -16,6 +16,10 @@
 
 When prompted, enter the password that was selected.
 
+On RHEL 8, this command writes the password to /boot/grub2/user.cfg.
+On older deployments where that primary file is absent, the legacy password file is
+/boot/efi/EFI/redhat/user.cfg.
+
 [warning]:
 To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
 must be automated as a component of machine provisioning, or followed manually as outlined above.
@@ -279,7 +283,7 @@
 RHEL-08-010140
 
 [reference]:
-SV-230234r1137691_rule
+SV-230234r1262176_rule
 
 [reference]:
 V-230234

OVAL for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_password' differs.
--- oval:ssg-grub2_uefi_password:def:1
+++ oval:ssg-grub2_uefi_password:def:1
@@ -1,5 +1,5 @@
 criteria OR
-criterion oval:ssg-test_grub2_uefi_password_usercfg:tst:1
+criterion oval:ssg-test_grub2_uefi_password_primary_usercfg:tst:1
 criteria AND
-criterion oval:ssg-test_grub2_uefi_password_stub:tst:1
-criterion oval:ssg-test_grub2_uefi_password_boot_usercfg:tst:1
+criterion oval:ssg-test_grub2_uefi_password_primary_usercfg_absent:tst:1
+criterion oval:ssg-test_grub2_uefi_password_legacy_usercfg:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_password' differs.
--- ocil:ssg-grub2_uefi_password_ocil:questionnaire:1
+++ ocil:ssg-grub2_uefi_password_ocil:questionnaire:1
@@ -1,9 +1,16 @@
+
 To verify the boot loader superuser password has been set, run the following command:
-$ sudo grep "^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$" /boot/efi/EFI/redhat/user.cfg
+# grep -iw "GRUB2_PASSWORD" /boot/grub2/user.cfg
 The output should be similar to:
 GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
 2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
 916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
 0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
+
+If /boot/grub2/user.cfg is absent on an older RHEL 8 deployment, run:
+# grep -iw "GRUB2_PASSWORD" /boot/efi/EFI/redhat/user.cfg
+
+If the GRUB2_PASSWORD entry does not exist in the applicable location or does not
+begin with grub.pbkdf2.sha512, this is a finding.
       Is it the case that no password is set?
       
New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_rsyslog_enabled'.
--- xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
+++ xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
@@ -230,7 +230,7 @@
 RHEL-08-010561
 
 [reference]:
-SV-230298r1017108_rule
+SV-230298r1262206_rule
 
 [reference]:
 V-230298

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring'.
--- xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring
+++ xccdf_org.ssgproject.content_rule_rsyslog_remote_access_monitoring
@@ -27,7 +27,7 @@
 RHEL-08-010070
 
 [reference]:
-SV-230228r1069299_rule
+SV-230228r1262185_rule
 
 [reference]:
 V-230228

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_firewalld_installed'.
--- xccdf_org.ssgproject.content_rule_package_firewalld_installed
+++ xccdf_org.ssgproject.content_rule_package_firewalld_installed
@@ -52,7 +52,7 @@
 RHEL-08-040100
 
 [reference]:
-SV-230505r958672_rule
+SV-230505r1262221_rule
 
 [reference]:
 V-230505
@@ -62,7 +62,7 @@
 
 Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.
 
-Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
+Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
 
 Red Hat Enterprise Linux 8 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."

New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_firewalld_enabled'.
--- xccdf_org.ssgproject.content_rule_service_firewalld_enabled
+++ xccdf_org.ssgproject.content_rule_service_firewalld_enabled
@@ -129,7 +129,7 @@
 RHEL-08-040101
 
 [reference]:
-SV-244544r958672_rule
+SV-244544r1262222_rule
 
 [reference]:
 V-244544

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny'.
--- xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny
+++ xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny
@@ -19,7 +19,7 @@
 RHEL-08-040090
 
 [reference]:
-SV-230504r958672_rule
+SV-230504r1262220_rule
 
 [reference]:
 V-230504

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_firewalld_default_zone'.
--- xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
+++ xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
@@ -243,7 +243,7 @@
 RHEL-08-040090
 
 [reference]:
-SV-230504r958672_rule
+SV-230504r1262220_rule
 
 [reference]:
 V-230504

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians'.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians
@@ -339,7 +339,7 @@
 RHEL-08-040221
 
 [reference]:
-SV-284948r1208757_rule
+SV-284948r1262225_rule
 
 [reference]:
 V-284948

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians'.
--- xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians
+++ xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians
@@ -339,7 +339,7 @@
 RHEL-08-040222
 
 [reference]:
-SV-284949r1208759_rule
+SV-284949r1262226_rule
 
 [reference]:
 V-284949

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
@@ -306,7 +306,7 @@
 RHEL-08-040111
 
 [reference]:
-SV-230507r1017287_rule
+SV-230507r1262224_rule
 
 [reference]:
 V-230507

New content has different text for rule 'xccdf_org.ssgproject.content_rule_wireless_disable_interfaces'.
--- xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
+++ xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
@@ -335,7 +335,7 @@
 RHEL-08-040110
 
 [reference]:
-SV-230506r1017286_rule
+SV-230506r1262223_rule
 
 [reference]:
 V-230506

OCIL for rule 'xccdf_org.ssgproject.content_rule_wireless_disable_interfaces' differs.
--- ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1
+++ ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1
@@ -11,5 +11,5 @@
 p2p-dev-wlp7s0  wifi-p2p  disconnected  --
 lo              loopback  unmanaged     --
 virbr0-nic      tun       unmanaged     --
-      Is it the case that a wireless interface is configured and has not been documented and approved by the Information System Security Officer (ISSO)?
+      Is it the case that a wireless interface is configured and has not been documented and approved by the information system security officer (ISSO)?
       
New content has different text for rule 'xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits'.
--- xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
+++ xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
@@ -210,7 +210,7 @@
 RHEL-08-010190
 
 [reference]:
-SV-230243r1137695_rule
+SV-230243r1262193_rule
 
 [reference]:
 V-230243

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled
@@ -23,7 +23,7 @@
 RHEL-08-040020
 
 [reference]:
-SV-230493r1184280_rule
+SV-230493r1262162_rule
 
 [reference]:
 V-230493

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict'.
--- xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict
+++ xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict
@@ -60,7 +60,7 @@
 RHEL-08-010375
 
 [reference]:
-SV-230269r1184255_rule
+SV-230269r1262201_rule
 
 [reference]:
 V-230269

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid'.
--- xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid
+++ xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid
@@ -30,7 +30,7 @@
 RHEL-08-010376
 
 [reference]:
-SV-230270r1184258_rule
+SV-230270r1262202_rule
 
 [reference]:
 V-230270

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_krb5-server_removed'.
--- xccdf_org.ssgproject.content_rule_package_krb5-server_removed
+++ xccdf_org.ssgproject.content_rule_package_krb5-server_removed
@@ -28,7 +28,7 @@
 RHEL-08-010163
 
 [reference]:
-SV-237640r1017323_rule
+SV-237640r1262192_rule
 
 [reference]:
 V-237640

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab'.
--- xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab
+++ xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab
@@ -25,7 +25,7 @@
 RHEL-08-010161
 
 [reference]:
-SV-230238r1017057_rule
+SV-230238r1262190_rule
 
 [reference]:
 V-230238

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server'.
--- xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server
+++ xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server
@@ -66,7 +66,7 @@
 RHEL-08-030740
 
 [reference]:
-SV-230484r1038944_rule
+SV-230484r1262217_rule
 
 [reference]:
 V-230484

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_client_only'.
--- xccdf_org.ssgproject.content_rule_chronyd_client_only
+++ xccdf_org.ssgproject.content_rule_chronyd_client_only
@@ -28,7 +28,7 @@
 RHEL-08-030741
 
 [reference]:
-SV-230485r1017269_rule
+SV-230485r1262218_rule
 
 [reference]:
 V-230485

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_configure_local_socket'.
--- xccdf_org.ssgproject.content_rule_chronyd_configure_local_socket
+++ xccdf_org.ssgproject.content_rule_chronyd_configure_local_socket
@@ -23,7 +23,7 @@
 RHEL-08-030742
 
 [reference]:
-SV-230486r1017270_rule
+SV-230486r1262219_rule
 
 [reference]:
 V-230486

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network'.
--- xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
+++ xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network
@@ -22,7 +22,7 @@
 RHEL-08-030742
 
 [reference]:
-SV-230486r1017270_rule
+SV-230486r1262219_rule
 
 [reference]:
 V-230486

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll'.
--- xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll
+++ xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll
@@ -124,7 +124,7 @@
 RHEL-08-030740
 
 [reference]:
-SV-230484r1038944_rule
+SV-230484r1262217_rule
 
 [reference]:
 V-230484

New content has different text for rule 'xccdf_org.ssgproject.content_rule_chronyd_server_directive'.
--- xccdf_org.ssgproject.content_rule_chronyd_server_directive
+++ xccdf_org.ssgproject.content_rule_chronyd_server_directive
@@ -23,7 +23,7 @@
 RHEL-08-030740
 
 [reference]:
-SV-230484r1038944_rule
+SV-230484r1262217_rule
 
 [reference]:
 V-230484

New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_rngd_enabled'.
--- xccdf_org.ssgproject.content_rule_service_rngd_enabled
+++ xccdf_org.ssgproject.content_rule_service_rngd_enabled
@@ -18,15 +18,6 @@
 [reference]:
 SRG-OS-000480-GPOS-00227
 
-[reference]:
-RHEL-08-010471
-
-[reference]:
-SV-230285r1017096_rule
-
-[reference]:
-V-230285
-
 [rationale]:
 The rngd service
 feeds random data from hardware device to kernel random device.

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_rngd_enabled' differs.
--- xccdf_org.ssgproject.content_rule_service_rngd_enabled
+++ xccdf_org.ssgproject.content_rule_service_rngd_enabled
@@ -3,7 +3,6 @@
     manager: auto
   tags:
   - CCE-82831-9
-  - DISA-STIG-RHEL-08-010471
   - enable_strategy
   - low_complexity
   - low_disruption
@@ -28,7 +27,6 @@
     - '"rng-tools" in ansible_facts.packages'
   tags:
   - CCE-82831-9
-  - DISA-STIG-RHEL-08-010471
   - enable_strategy
   - low_complexity
   - low_disruption

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner'.
--- xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner
+++ xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner
@@ -159,7 +159,7 @@
 RHEL-08-010040
 
 [reference]:
-SV-230225r1184236_rule
+SV-230225r1262182_rule
 
 [reference]:
 V-230225

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sssd_certificate_verification'.
--- xccdf_org.ssgproject.content_rule_sssd_certificate_verification
+++ xccdf_org.ssgproject.content_rule_sssd_certificate_verification
@@ -24,7 +24,7 @@
 RHEL-08-010400
 
 [reference]:
-SV-230274r1017089_rule
+SV-230274r1262204_rule
 
 [reference]:
 V-230274

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards'.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -82,7 +82,7 @@
 RHEL-08-020250
 
 [reference]:
-SV-230372r1017184_rule
+SV-230372r1262209_rule
 
 [reference]:
 V-230372

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor'.
--- xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor
+++ xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor
@@ -23,7 +23,7 @@
 RHEL-08-010090
 
 [reference]:
-SV-230229r1017048_rule
+SV-230229r1262186_rule
 
 [reference]:
 V-230229

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend'.
--- xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
+++ xccdf_org.ssgproject.content_rule_configure_usbguard_auditbackend
@@ -35,7 +35,7 @@
 RHEL-08-030603
 
 [reference]:
-SV-230470r1017261_rule
+SV-230470r1262216_rule
 
 [reference]:
 V-230470

New content has different text for rule 'xccdf_org.ssgproject.content_rule_grub2_audit_argument'.
--- xccdf_org.ssgproject.content_rule_grub2_audit_argument
+++ xccdf_org.ssgproject.content_rule_grub2_audit_argument
@@ -370,7 +370,7 @@
 RHEL-08-030601
 
 [reference]:
-SV-230468r1017260_rule
+SV-230468r1262215_rule
 
 [reference]:
 V-230468

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -

... The diff is trimmed here ...

macko1 · 2026-10-27T14:04:18Z

/packit test -i contest-all

The control file version field and the version metadata and description in the stig and stig_gui profiles move to V2R9.

Replace the RHEL 8 DISA STIG manual and SCAP benchmark reference files with the V2R9 content.

…not needed Rules affected: RHEL-08-010000: installed_OS_is_vendor_supported - The RHEL 8 policy/stig file adds the V2R9 superseded-release warning and the RHEL 8 lifecycle table (General Availability through Final Minor Release 8.10); the fix command and the "$ sudo cat /etc/redhat-release" check are unchanged. RHEL-08-010020: configure_crypto_policy - The RHEL 8 policy/stig file replaces the custom STIG subpolicy fixtext with the plain FIPS procedure ("update-crypto-policies --set FIPS"), adds the application-restart note, and drops the colon-separated FIPS subpolicy exception and the subpolicy inspection steps from the checktext. RHEL-08-010110: set_password_hashing_algorithm_logindefs - The ocil now reads "FIPS 140-2-approved" instead of "FIPS 140-2 approved" RHEL-08-010159: set_password_hashing_algorithm_systemauth - The vulnerability discussion now reads "mechanisms used" instead of "mechanisms that are used" and adds the comma after "therefore"; the sha512 OVAL, Bash, and Ansible implementation remains aligned with the unchanged requirement. RHEL-08-010160: set_password_hashing_algorithm_passwordauth - The vulnerability discussion now reads "mechanisms used" instead of "mechanisms that are used" and adds the comma after "therefore"; the rule already enforces sha512 in /etc/pam.d/password-auth through its unchanged OVAL, Bash, and Ansible components. RHEL-08-010161: kerberos_disable_no_keytab - The vulnerability discussion sentence now reads: "are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised"; the rule and its OVAL, Bash, and Ansible behavior are unchanged. RHEL-08-010370: enable_gpgcheck_for_all_repositories - The checktext uses lower-case system administrator for RHEL 8 RHEL-08-010400: sssd_certificate_verification - The new RHEL 8 policy/stig file carries the sha1-based V2R9 check and fixtext ("ocsp_dgst=sha1"), the lower-case "system administrator" note, and the "Verify OCSP is enabled" check wording; the RHEL 8 var_sssd_certificate_verification_digest_function=sha1 selection is unchanged. RHEL-08-020250: sssd_enable_smartcards - "DOD Common Access Card (CAC)" becomes "DOD common access card (CAC)" without reproducing the DISA "Ccard" typo; the rule still checks pam_cert_auth=True and the certificate-authentication PAM options. RHEL-08-030610: file_permissions_audit_configuration_stig - The policy/stig file fixtext and checktext are synchronized with the V2R9 two-command procedure: "find /etc/audit/rules.d/ -type f -name "*.rules" -exec chmod 0600 {} +" plus explicit chmod for /etc/audit/audit.rules and /etc/audit/auditd.conf, and the matching two-step stat verification; the file_permissions template and the generated Bash and Ansible components already set /etc/audit/rules.d/*.rules, /etc/audit/audit.rules, and /etc/audit/auditd.conf to 0600. RHEL-08-040100: package_firewalld_installed - The rule rationale now reads "nonorganization-controlled" instead of "non-organization-controlled"; the rule and its package_installed template are unchanged. RHEL-08-040101: service_firewalld_enabled - The RHEL 8 policy/stig file now reads "nonorganization-controlled" instead of "non-organization-controlled"; the service_enabled template still requires an active firewalld service. RHEL-08-040110: wireless_disable_interfaces - "Authorizing Official (AO)" becomes "authorizing official (AO)" and the ocil and ocil_clause now use the lower-case "information system security officer (ISSO)"; the rule still uses "nmcli radio all off" with its existing OVAL, Bash, and Ansible components. RHEL-08-040111: kernel_module_bluetooth_disabled - "Authorizing Official (AO)" becomes "authorizing official (AO)"; the checktext already spells "information system security officer" correctly, so the DISA "securiy" typo is not reproduced; the kernel_module_disabled template still enforces "install bluetooth /bin/false" and "blacklist bluetooth".

macko1 · 2026-10-27T19:48:02Z

/packit test -i contest-all

Rules affected: RHEL-08-030565: audit_rules_privileged_commands_useradd - the control entry, the SRG-OS-000062-GPOS-00031 line, and cce@rhel8 CCE-86498-3 select the rule in the STIG profile, and the stig and stig_gui profile stability data adds the rule - the rule enforces the privileged-useradd key: require_key makes the generated OVAL, Bash, and Ansible remediations a single rule without an arch split, and the policy/stig/rhel8.yml carries the V2R9 fixtext and checktext - the bash_fix_audit_syscall_rule macro rejects a wrong audit key written in the -k spelling and anchors the exact-key match - new wrong-key scenarios in both spellings, cleaning both audit files first, with one-line purpose comments on the touched scenarios

The obsolete RHEL-08-010471 requirement for the hardware random number generator entropy gatherer service is removed from the control file. The service_rngd_enabled rule is retained in the data stream through a new selection in the default profile and is referenced as a related rule on the RHEL-08-010480 control.

Rules affected: RHEL-08-010020: configure_crypto_policy - The control selects var_system_crypto_policy=fips and drops the fips_custom_stig_sub_policy mapping

…RHEL-08-010297 The FIPS subpolicy mappings are removed from the RHEL-08-010290, RHEL-08-010291, RHEL-08-010296, and RHEL-08-010297 controls. The controls now select var_system_crypto_policy=fips instead of the fips_stig subpolicy and drop the STIG subpolicy notes. The fips_custom_stig_sub_policy rule stays in the data stream through a new selection in the default profile and is referenced as a related rule on the four controls.

Rules affected: RHEL-08-010140: grub2_uefi_password - Checks GRUB2_PASSWORD in /boot/grub2/user.cfg with the legacy EFI path as fallback

Rules affected: RHEL-08-010141: grub2_uefi_admin_username - Checks the superuser in /boot/grub2/grub.cfg with the legacy EFI path as fallback and rejects reserved names

Rules affected: RHEL-08-020200: accounts_maximum_age_login_defs - The control selects var_accounts_maximum_age_login_defs=180 - The maximum password lifetime for new users or password changes rises from 60 to 180 days in the RHEL 8 policy/stig file, and the incorrect_stig scenarios use 240 days because 120 days is within the new limit RHEL-08-020210: accounts_password_set_max_life_existing - The control selects var_accounts_maximum_age_login_defs=180 - The maximum password lifetime for existing passwords rises from 60 to 180 days, "non-compliant" becomes "noncompliant", and the fixtext command changes from "passwd -x 60" to "chage -M 180"

Rules affected: RHEL-08-010293: configure_openssl_crypto_policy - The new OpenSSL crypto policy requirement is mapped to the rule - The check and remediations require the equals-sign .include = /etc/crypto-policies/back-ends/opensslcnf.config form, with a fail scenario for the space form

Rules affected: RHEL-08-010287: configure_ssh_crypto_policy - The new SSH crypto policy requirement is mapped to the rule - The RHEL 8 Bash and Ansible remediations write the commented "# CRYPTO_POLICY=" directive in /etc/sysconfig/sshd and restart sshd; previously they deleted the CRYPTO_POLICY line - The fixtext documents adding the "# CRYPTO_POLICY=" directive and restarting sshd instead of the sed delete command - The srg references grow from SRG-OS-000250-GPOS-00093 to also include SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, and SRG-OS-000125-GPOS-00065 - The new policy/stig file carries the V2R9 vulnerability discussion, check text, and fix text - The new override_with_value.fail.sh scenario covers an uncommented CRYPTO_POLICY assignment with a value

Rules affected: RHEL-08-010384: sudo_require_reauthentication - Binds the OVAL check to var_sudo_timestamp_timeout, so the STIG always_prompt selection requiring timestamp_timeout=0 is enforced and nonzero values fail - The fixtext changes from reauthenticating "sudo" commands after the specified timeout to reauthenticating every invocation of the "sudo" command and adds the "Remove any duplicate definitions." sentence - The checktext finding condition changes from a negative number or no results returned to a value other than "0" (including negative numbers) or missing entirely - Scenarios declare their var_sudo_timestamp_timeout selection and a new RHEL 8 scenario expects failure for a nonzero timeout under the always_prompt selection

Rules affected: RHEL-08-020101: accounts_password_pam_pwquality_system_auth - Expects the required PAM control flag instead of requisite for pam_pwquality.so in /etc/pam.d/system-auth on RHEL 8 and RHEL 9 - Scenarios configure the expected control flag per product and a new RHEL 8 and RHEL 9 scenario expects failure for a requisite control

The rule carries a Jinja if/else with two template blocks for SLE and non-SLE products. The yaml lint strips the Jinja conditionals and keeps both branches, which produces a duplicate template key and fails lint on every pull request that touches the rule. Select the template through a single Jinja-conditional key instead; the rendered rule is unchanged for every product.

Regenerate tests/data/profile_stability/rhel8/{stig,stig_gui}.profile from the current control state: var_system_crypto_policy=fips added with the fips_stig subpolicy removed, configure_openssl_crypto_policy and configure_ssh_crypto_policy added, var_accounts_maximum_age_login_defs changed from 60 to 180, and service_rngd_enabled removed.

Rules affected: RHEL-08-030565: audit_rules_privileged_commands_useradd - the privileged-useradd audit key and its enforcement apply to rhel8 only

Rules affected: RHEL-08-010293: configure_openssl_crypto_policy - the product condition uses the rhel family instead of the rhel8 and rhel9 list, so rhel10 and almalinux9 also build the equals-sign form RHEL-08-020101: accounts_password_pam_pwquality_system_auth - the product condition uses the rhel family instead of the rhel8 and rhel9 list, so rhel10 and almalinux9 also build required, matching the DISA rhel10 V1R3 fixtext and the rule text - the OVAL, Bash, and Ansible control flag comes from one "rhel" in families condition

Rules affected: RHEL-08-020101: accounts_password_pam_pwquality_system_auth - the authselect test scenarios set the pam_pwquality control flag in a PAM_CONTROL_FLAG variable instead of duplicated sed commands per product

Reformat the changed srg_gpos control files to the '- id:' list style. The '- id:' style is pre-existing on master and enters lint scope because this update touches the files. No content change.

macko1 · 2026-10-27T23:30:10Z

/packit test -i contest-all

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 19, 2026

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch from 1d34cd7 to bf6b0db Compare October 19, 2026 11:24

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch 11 times, most recently from cb9195e to 617cfe3 Compare October 23, 2026 10:10

macko1 added this to the 0.1.83 milestone Oct 23, 2026

macko1 added the STIG STIG Benchmark related. label Oct 23, 2026

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 25, 2026

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch from 617cfe3 to 7d8b005 Compare October 26, 2026 10:53

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Oct 26, 2026

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch 4 times, most recently from 7eb7418 to 1ea56c5 Compare October 27, 2026 00:01

macko1 and others added 3 commits October 27, 2026 19:31

rhel8: STIG v2r9 update versions in control file and profiles

24a8d3f

The control file version field and the version metadata and description in the stig and stig_gui profiles move to V2R9.

rhel8: STIG v2r9 update DISA manual and SCAP benchmark from cyber.mil

ca959cf

Replace the RHEL 8 DISA STIG manual and SCAP benchmark reference files with the V2R9 content.

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch from 1ea56c5 to efe5ea0 Compare October 27, 2026 19:40

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch from efe5ea0 to 33b4f7b Compare October 27, 2026 22:04

macko1 and others added 17 commits October 27, 2026 22:44

rhel8: STIG v2r9 update RHEL-08-010020

a09e09d

Rules affected: RHEL-08-010020: configure_crypto_policy - The control selects var_system_crypto_policy=fips and drops the fips_custom_stig_sub_policy mapping

rhel8: STIG v2r9 update RHEL-08-010140

ea66a90

Rules affected: RHEL-08-010140: grub2_uefi_password - Checks GRUB2_PASSWORD in /boot/grub2/user.cfg with the legacy EFI path as fallback

rhel8: STIG v2r9 update RHEL-08-010141

bb16842

Rules affected: RHEL-08-010141: grub2_uefi_admin_username - Checks the superuser in /boot/grub2/grub.cfg with the legacy EFI path as fallback and rejects reserved names

rhel8: STIG v2r9 update RHEL-08-030565

4d736fb

Rules affected: RHEL-08-030565: audit_rules_privileged_commands_useradd - the privileged-useradd audit key and its enforcement apply to rhel8 only

rhel8: STIG v2r9 update RHEL-08-020101

6857779

Rules affected: RHEL-08-020101: accounts_password_pam_pwquality_system_auth - the authselect test scenarios set the pam_pwquality control flag in a PAM_CONTROL_FLAG variable instead of duplicated sed commands per product

Fix yamllint findings in files touched by the STIG update

0e973d5

Reformat the changed srg_gpos control files to the '- id:' list style. The '- id:' style is pre-existing on master and enters lint scope because this update touches the files. No content change.

macko1 force-pushed the rhel8_stig_v2r8_to_v2r9 branch from 33b4f7b to 0e973d5 Compare October 27, 2026 22:56

Navigation Menu

Repository navigation

Update Rhel8 stig v2r8 to v2r9 - #15214

Update Rhel8 stig v2r8 to v2r9#15214
macko1 wants to merge 20 commits into
ComplianceAsCode:masterfrom
macko1:rhel8_stig_v2r8_to_v2r9

macko1 commented Oct 19, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

macko1 commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

macko1 commented Oct 19, 2026 •

edited

Loading

github-actions Bot commented Oct 19, 2026 •

edited

Loading