Update Rhel10 stig v1r2 to v1r3 by macko1 · Pull Request #15216 · ComplianceAsCode/content

macko1 · 2026-10-19T13:21:03Z

Description:

Description here. Replace this text. Don't use the italics format!

Rationale:

Rationale here. Replace this text. Don't use the italics format!
Fixes # Issue number here (e.g. Updating sysctl XCCDF naming #26) or remove this line if no issue exists.

Review Hints:

Review hints here. Replace this text. Don't use the italics format!
Use this optional section to give any relevant information which could help the reviewer to more quickly and assertively understand and test the changes.
Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc.

openshift-ci · 2026-10-19T13:21:08Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-10-20T22:01:57Z

This datastream diff is auto generated by the check Compare DS/Generate Diff.
Due to the excessive size of the diff, it has been trimmed to fit the 65535-character limit.

Click here to see the trimmed diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -11,7 +11,7 @@
 To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
 available under /etc/pki/tls/openssl.cnf.
 This file has the ini format, and it enables crypto policy support
-if there is a [ crypto_policy ] section that contains the .include /etc/crypto-policies/back-ends/opensslcnf.config directive.
+if there is a [ crypto_policy ] section that contains the .include = /etc/crypto-policies/back-ends/opensslcnf.config directive.
 
 [reference]:
 CIP-003-8 R4.2

OCIL for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
+++ ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1
@@ -1,8 +1,9 @@
 To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
 /etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
-.include /etc/crypto-policies/back-ends/opensslcnf.config directive:
+.include = /etc/crypto-policies/back-ends/opensslcnf.config directive:
 
-$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
+
+$ sudo grep '\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
       Is it the case that the OpenSSL config file doesn't contain the whole section,
-or the section doesn't contain the <pre>.include /etc/crypto-policies/back-ends/opensslcnf.config</pre> directive?
+or the section doesn't contain the <pre>.include = /etc/crypto-policies/back-ends/opensslcnf.config</pre> directive?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -4,9 +4,11 @@
 OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
 OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
 
-OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
+OPENSSL_CRYPTO_POLICY_INCLUSION='.include = /etc/crypto-policies/back-ends/opensslcnf.config'
 
-OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
+
+OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$'
+
 
 
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -48,7 +48,7 @@
   ansible.builtin.find:
     paths: /etc/pki/tls
     patterns: openssl.cnf
-    contains: ^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$
+    contains: ^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$
   register: test_crypto_policy_include_directive
   when: '"openssl" in ansible_facts.packages'
   tags:
@@ -73,7 +73,7 @@
   ansible.builtin.lineinfile:
     create: true
     insertafter: ^\s*\[\s*crypto_policy\s*]\s*
-    line: .include /etc/crypto-policies/back-ends/opensslcnf.config
+    line: .include = /etc/crypto-policies/back-ends/opensslcnf.config
     path: /etc/pki/tls/openssl.cnf
     mode: 420
   when:
@@ -103,7 +103,7 @@
     create: true
     line: |-
       [crypto_policy]
-      .include /etc/crypto-policies/back-ends/opensslcnf.config
+      .include = /etc/crypto-policies/back-ends/opensslcnf.config
     path: /etc/pki/tls/openssl.cnf
     mode: 420
   when:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction'.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -11,7 +11,9 @@
         
 To configure the system to ignore the CtrlAltDelBurstAction
 
-setting, add or modify the following to /etc/systemd/system.conf:
+setting, create the /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+file with the following content:
+[Manager]
 CtrlAltDelBurstAction=none
 
 [warning]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1
+++ ocil:ssg-disable_ctrlaltdel_burstaction_ocil:questionnaire:1
@@ -1,7 +1,9 @@
+
 To ensure the system is configured to ignore the Ctrl-Alt-Del setting,
 enter the following command:
-$ sudo grep -i ctrlaltdelburstaction /etc/systemd/system.conf
+$ sudo grep -iR CtrlAltDelBurstAction /etc/systemd/system.conf /etc/systemd/system.conf.d/*.conf
 The output should return:
-CtrlAltDelBurstAction=none
+/etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf:CtrlAltDelBurstAction=none
+Verify that the setting occurs in a [Manager] section.
       Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -1,27 +1,12 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel-core && { rpm --quiet -q systemd; }; then
 
-# Strip any search characters in the key arg so that the key can be replaced without
-# adding any search characters to the config file.
-stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^CtrlAltDelBurstAction=")
-
-# shellcheck disable=SC2059
-printf -v formatted_output "%s=%s" "$stripped_key" "none"
-
-# If the key exists, change it. Otherwise, add it to the config_file.
-# We search for the key string followed by a word boundary (matched by \>),
-# so if we search for 'setting', 'setting2' won't match.
-if LC_ALL=C grep -q -m 1 -i -e "^CtrlAltDelBurstAction=\\>" "/etc/systemd/system.conf"; then
-    escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
-    LC_ALL=C sed -i --follow-symlinks "s/^CtrlAltDelBurstAction=\\>.*/$escaped_formatted_output/gi" "/etc/systemd/system.conf"
-else
-    if [[ -s "/etc/systemd/system.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/system.conf" || true)" ]]; then
-        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/system.conf"
-    fi
-    cce="CCE-80784-2"
-    printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/system.conf" >> "/etc/systemd/system.conf"
-    printf '%s\n' "$formatted_output" >> "/etc/systemd/system.conf"
-fi
+mkdir -p /etc/systemd/system.conf.d
+cat << EOF > /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+[Manager]
+CtrlAltDelBurstAction=none
+EOF
+systemctl daemon-reload
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction' differs.
--- xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
+++ xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
@@ -14,14 +14,12 @@
   - low_disruption
   - no_reboot_needed
 
-- name: Disable Ctrl-Alt-Del Burst Action
-  ansible.builtin.lineinfile:
-    dest: /etc/systemd/system.conf
-    state: present
-    regexp: ^CtrlAltDelBurstAction
-    line: CtrlAltDelBurstAction=none
-    create: true
-    mode: 420
+- name: Create the systemd configuration drop-in directory
+  ansible.builtin.file:
+    path: /etc/systemd/system.conf.d
+    state: directory
+    owner: root
+    mode: '0755'
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"systemd" in ansible_facts.packages'
@@ -37,3 +35,46 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+
+- name: Disable Ctrl-Alt-Del Burst Action
+  ansible.builtin.copy:
+    dest: /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf
+    content: |
+      [Manager]
+      CtrlAltDelBurstAction=none
+    owner: root
+    mode: '0644'
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"systemd" in ansible_facts.packages'
+  tags:
+  - CCE-80784-2
+  - DISA-STIG-RHEL-08-040172
+  - NIST-800-53-AC-6(1)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-6(a)
+  - disable_ctrlaltdel_burstaction
+  - disable_strategy
+  - high_severity
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed
+
+- name: Reload systemd configuration
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"systemd" in ansible_facts.packages'
+  tags:
+  - CCE-80784-2
+  - DISA-STIG-RHEL-08-040172
+  - NIST-800-53-AC-6(1)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-6(a)
+  - disable_ctrlaltdel_burstaction
+  - disable_strategy
+  - high_severity
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed

New content has different text for rule 'xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts'.
--- xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
+++ xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
@@ -14,6 +14,7 @@
 /etc/passwd. System accounts are those user accounts with a user ID less than
 1000. The user ID is stored in the third field. If any system account
 other than root has a login shell, disable it with the command:
+
 $ sudo usermod -s /sbin/nologin account
 
 [warning]:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts' differs.
--- xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
+++ xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts
@@ -5,8 +5,11 @@
   && $7 != "\/sbin\/shutdown" && $7 != "\/sbin\/halt" && $7 != "\/bin\/sync") \
   { print $1 }' /etc/passwd)
 
+
 for systemaccount in "${systemaccounts[@]}"; do
+
     usermod -s /sbin/nologin "$systemaccount"
+
 done
 
 else

OCIL for rule 'xccdf_org.ssgproject.content_rule_grub2_password' differs.
--- ocil:ssg-grub2_password_ocil:questionnaire:1
+++ ocil:ssg-grub2_password_ocil:questionnaire:1
@@ -1,3 +1,4 @@
+
 First, check whether the password is defined in either /boot/grub2/user.cfg or
 /boot/grub2/grub.cfg.
 Run the following commands:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d
@@ -15,7 +15,7 @@
     rule for /etc/cron.d/ already exists in /etc/audit/rules.d/
   ansible.builtin.find:
     paths: /etc/audit/rules.d
-    contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
+    contains: ^(?=.*(?:-k\s+|-F\s+key=)cronjobs(?:\s|$))\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
     patterns: '*.rules'
   register: find_existing_watch_rules_d
   when:
@@ -119,7 +119,7 @@
     rule for /etc/cron.d/ already exists in /etc/audit/audit.rules
   ansible.builtin.find:
     paths: /etc/audit/
-    contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
+    contains: ^(?=.*(?:-k\s+|-F\s+key=)cronjobs(?:\s|$))\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
     patterns: audit.rules
   register: find_existing_watch_audit_rules
   when:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -147,7 +180,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"
@@ -184,11 +217,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -220,7 +260,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -228,8 +272,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        else
+            # The required rule contains no '-S' syscall specification, so any '-S' field
+            # in an existing rule makes it more specific than the required scope
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$auid_filter//" -e "s/$key_regex//" <<< "$s_rule")
+            else
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s/$key_regex//" <<< "$s_rule")
+            fi
+            grep -qE -- "-F|-S|-k" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        fi
     done
 
     if [[ ${#syscall_a[@]} -ge 1 ]]
@@ -295,7 +357,7 @@
             done
         fi
         other_string=$([[ $OTHER_FILTERS ]] && echo " $OTHER_FILTERS") || /bin/true
-        auid_string=$([[ $AUID_FILTERS ]] && echo " $AUID_FILTERS") || /bin/true
+        auid_string=$([[ $auid_filter ]] && echo " $auid_filter") || /bin/true
         full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
         if ! grep -Fxq -- "$full_rule" "$default_file" 2>/dev/null; then
             echo "$full_rule" >> "$default_file"

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
@@ -23,11 +23,18 @@
 unset rule_syscalls_to_edit
 unset other_string
 unset auid_string
+unset auid_filter
 unset full_rule
+unset key_regex
 
 # Load macro arguments into arrays
 read -a syscall_a <<< $SYSCALL
 read -a syscall_grouping <<< $SYSCALL_GROUPING
+auid_filter="$AUID_FILTERS"
+
+# Any audit key is accepted
+key_regex="-F key=[[:alnum:]_-]+|-k [[:alnum:]_-]+"
+
 
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
@@ -49,7 +56,11 @@
 default_file="/etc/audit/rules.d/$KEY.rules"
 # As other_filters may include paths, lets use a different delimiter for it
 # The "F" script expression tells sed to print the filenames where the expressions matched
-readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
+if [[ $auid_filter ]]; then
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" -e "F" /etc/audit/rules.d/*.rules)
+else
+    readarray -t files_to_inspect < <(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "F" /etc/audit/rules.d/*.rules)
+fi
 # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
 if [ ${#files_to_inspect[@]} -eq "0" ]
 then
@@ -72,7 +83,11 @@
     # * the action, list and arch, (2-nd argument)
     # * the other filters, (3-rd argument)
     # * the auid filters, (4-rd argument)
-    readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")
+    if [[ $auid_filter ]]; then
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$auid_filter/!d" "$audit_file")
+    else
+        readarray -t similar_rules < <(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" "$audit_file")
+    fi
 
     candidate_rules=()
     # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
@@ -80,8 +95,26 @@
     do
         # Strip all the options and fields we know of,
         # than check if there was any field left over
-        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"<<< "$s_rule")
-        grep -q -- "-F" <<< "$extra_fields" || candidate_rules+=("$s_rule")
+        if [[ ${#syscall_a[@]} -ge 1 ]]
+        then
+            # The required rule contains '-S' syscall specifications, so existing '-S' fields
+            # are stripped here and their content is validated by the syscall check below
+            if [[ $auid_filter ]]; then
+                extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//" -e "s#$OTHER_FILTERS##" -e "s

... The diff is trimmed here ...

Mab879

Maybe neeed a rebase?

Mab879 · 2026-10-23T20:51:34Z

-            - sshd_approved_ciphers=stig_rhel9
-            - sshd_approved_macs=stig_rhel9
-        status: automated
+    - id: SRG-OS-000250-GPOS-00093


Do we need to reformat this?

I believe yamllint complained

Mab879 · 2026-10-23T21:24:28Z

    name: audit_rules_privileged_commands
    vars:
        path: /usr/sbin/useradd
+        key: privileged-useradd


Should this @rhel10?

Mab879 · 2026-10-23T21:25:27Z

 # complexity = low
 # disruption = low

+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


If rhel in families?

Mab879 · 2026-10-23T21:25:42Z

 # platform = multi_platform_all


+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


If rhel in families?

Mab879 · 2026-10-23T21:27:25Z



 checktext: |-
+    {{% if product == "rhel8" or product == "rhel9" %}}


product in ["rhel8" , "rhel9"]?

Mab879 · 2026-10-23T21:29:20Z

@@ -1,5 +1,12 @@
 #!/bin/bash

+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


rhel in families

Mab879 · 2026-10-23T21:30:27Z

    <br /><br />
    To configure the system to ignore the <tt>CtrlAltDelBurstAction</tt>
-    {{% if product != "rhcos4" %}}
+    {{% if product in ["rhel8", "rhel9", "rhel10"] %}}


rhel in families

macko1 · 2026-10-27T18:19:49Z

/packit test -i contest-all

Rules affected: RHEL-10-300085: configure_openssl_crypto_policy - The new OpenSSL requirement is mapped to the rule; the RHEL 10 remediations and check require the equals-sign .include = /etc/crypto-policies/back-ends/opensslcnf.config form, with pass and fail scenarios - The rule joins SRG-OS-000250-GPOS-00093 in controls/srg_gpos, the SRG the requirement satisfies, so the stig-rules-srg-gpos check covers the new profile selection; the touched control file is reformatted to the - id: style

Rules affected: RHEL-10-200050: package_tftp-server_removed - The control entry and policy/stig source are removed, the rule stays mapped to the RHEL 8 and RHEL 9 STIGs

Rules affected: RHEL-10-600100: accounts_maximum_age_login_defs - The control selects var_accounts_maximum_age_login_defs=180 and the policy/stig file raises the new-user password lifetime from 60 to 180 days - The incorrect_stig scenarios use 240 days; 120 days is within the new limit and no longer fails the check RHEL-10-600110: accounts_password_set_max_life_existing - The control selects var_accounts_maximum_age_login_defs=180 and the policy/stig file raises the existing-account password lifetime from 60 to 180 days

Rules affected: RHEL-10-700950: disable_ctrlaltdel_burstaction - Requires the CtrlAltDelBurstAction=none systemd drop-in with the [Manager] section in OVAL, remediations, and STIG policy RHEL-09-211045 and RHEL-08-040172: disable_ctrlaltdel_burstaction - The shared policy/stig file checktext and fixtext use the /etc/systemd/system.conf.d/55-CtrlAltDel-BurstAction.conf drop-in form, and the OVAL accepts both the drop-in and the main /etc/systemd/system.conf setting

macko1 · 2026-10-27T19:48:34Z

/packit test -i contest-all

… RHEL-10-200000 Rules affected: RHEL-10-001030: ensure_gpgcheck_globally_activated - The OVAL check accepts 1, true, and yes case insensitively for gpgcheck, with focused scenarios RHEL-10-001040: ensure_gpgcheck_local_packages - The OVAL check accepts 1, true, and yes case insensitively for localpkg_gpgcheck, with focused scenarios RHEL-10-001050: enable_gpgcheck_for_all_repositories - The OVAL check validates gpgcheck positively on every repository with the accepted values, replacing the negative-only check RHEL-10-200000: clean_components_post_updating - The OVAL check accepts 1, true, and yes case insensitively for clean_requirements_on_remove, with focused scenarios

Rules affected: RHEL-10-600000: grub2_password - The OVAL requires GRUB2_PASSWORD with the grub.pbkdf2.sha512 prefix in /boot/grub2/user.cfg only; the EFI fallback, the grub.cfg password alternative, and the superuser criterion are dropped for RHEL 10, and the control title now names single-user and maintenance mode authentication

Rules affected: RHEL-10-600020: no_shelllogin_for_systemaccounts - The check accepts the reserved accounts root, halt, sync, and shutdown and rejects interactive shells on system accounts in the UID 1 to 999 band; the remediations use /usr/sbin/nologin

Rules affected: RHEL-10-500720: audit_rules_usergroup_modification_opasswd - The watch template enforces the identity audit key when requested; RHEL 10 requires it for /etc/security/opasswd with the rules in identity.rules loaded by augenrules, and the malformed b64 policy lines are corrected

Rules affected: RHEL-10-500450: audit_rules_privileged_commands_gpasswd - The template generates b32 and b64 rules with the privileged-gpasswd key and no AUID filters for RHEL 10 RHEL-10-500490: audit_rules_privileged_commands_passwd - The template generates b32 and b64 rules with the privileged-passwd key and no AUID filters for RHEL 10

Rules affected: - audit_rules_privileged_commands_gpasswd, audit_rules_privileged_commands_passwd: the bash_fix_audit_syscall_rule macro stripped -S syscall fields and any audit key from candidate rules, so existing rules with -S execve or a wrong key were accepted as compliant and the canonical b32 and b64 rules were never appended; the macro now rejects -S fields for syscall-less rules and enforces the exact key in the STIG arch mode - audit_rules_usergroup_modification_opasswd: the extra_permission scenarios wrote the hardcoded logins key that the require_key OVAL rejects, and the missing_identity_key scenarios could be satisfied by rules leaked from earlier scenarios; the scenarios now use the rendered identity key and clean pre-existing rules first

Rules affected: RHEL-10-500605: audit_rules_privileged_commands_useradd - the control entry, the SRG-OS-000062-GPOS-00031 line, cce@rhel10 CCE-86501-4, and the stig and stig_gui stability data select the rule in the STIG profile - the rule enforces the privileged-useradd key: require_key makes the generated OVAL, Bash, and Ansible output a single rule without an arch split, and the policy/stig/rhel10.yml carries the V1R3 fixtext and checktext - the bash_fix_audit_syscall_rule macro rejects a wrong audit key written in the -k spelling and anchors the exact-key match - new wrong-key scenarios in both spellings for useradd, gpasswd, and passwd, cleaning both audit files first, with one-line purpose comments on the touched scenarios

Rules affected: RHEL-10-200648: rsyslog_cron_logging - The policy/stig checktext is synced to the V1R3 text: the anchored grep -s "cron.\*", the RainerScript omfile action sample for /var/log/cron, and the functional logger -p cron.info test with the /var/log/cron lookup as the manual fallback - The fixtext drops the quotes from /etc/rsyslog.d/ and uses "The rsyslog daemon must be restarted" wording - The seven cron_set scenarios restart rsyslog so the scenario system state matches the written configuration; the restart condition names both rhel9 and rhel10, identical to the rhel9 branch's copy of the scenarios

Rules affected: RHEL-10-600750: set_password_hashing_algorithm_libuserconf - The RHEL 10 OVAL lookup changes from any "crypt_style" line to one anchored to the [defaults] section, so a crypt_style in another section or a commented-out line no longer satisfies the check - The checktext command changes from "grep crypt" to the anchored "grep -i "^crypt_style"" and gains the note that the requirement is not applicable when the libuser package is not installed - The fixtext section name changes from "[default]" to "[defaults]" - New scenarios cover the wrong section, a commented-out setting, a crypt_style in an earlier section not shadowing the [defaults] value, and the absent libuser package

Rules affected: RHEL-10-200730: install_smartcard_packages - The RHEL 10 OVAL branch changes the checked package from openssl-pkcs11 to pkcs11-provider, matching the package already selected by the rule metadata and remediation; the openssl-pkcs11 path used by RHEL 8 and RHEL 9 is unchanged - The checktext and fixtext change the package name from openssl-pkcs11 to pkcs11-provider - The vulnerability discussion abbreviates multifactor authentication to MFA after the first mention and retains the DOD-approved PKI wording - New scenarios cover the installed package, the missing package, and another smart card package not satisfying the requirement

Rules affected: RHEL-10-500610: audit_rules_media_export - The RHEL 10 audit key for the mount syscall rules changes from export to privileged-mount in the rule description, fixtext, generated Bash and Ansible remediations, and the STIG policy fixtext and checktext examples - The correct_rules scenario writes the privileged-mount key on RHEL 10

Rules affected: RHEL-10-500680: audit_rules_sudoers - The RHEL 10 audit key for the /etc/sudoers watch rules changes from logins to identity in the STIG policy fixtext and checktext, the rule description, OCIL, and fixtext, and the generated Bash and Ansible remediations - The RHEL 10 OVAL enforces the identity audit key, so a rule with a different key no longer satisfies the check - The fixtext load procedure changes from "service auditd restart" to "augenrules --load" - New wrong key scenarios cover the augenrules and auditctl backends

Rules affected: RHEL-10-500690: audit_rules_sudoers_d - The RHEL 10 watch path in the generated audit rules changes from /etc/sudoers.d/ to /etc/sudoers.d without the trailing slash in the rule description, OCIL, and fixtext, the generated Bash and Ansible remediations, and the STIG policy fixtext and checktext examples; the OVAL and remediation use the path filter instead of the directory filter for RHEL 10 - The RHEL 10 OVAL enforces the identity audit key, so a rule with a different key no longer satisfies the check - New wrong key scenarios cover the augenrules and auditctl backends, and a trailing slash path scenario verifies the path without the slash is required

Both the stig and stig_gui stability files: - add var_accounts_maximum_age_login_defs=180 and configure_openssl_crypto_policy - remove var_accounts_maximum_age_login_defs=60 and package_tftp-server_removed

Rules affected: RHEL-10-500605: audit_rules_privileged_commands_useradd - the privileged-useradd audit key and its enforcement apply to rhel10 only RHEL-10-700950: disable_ctrlaltdel_burstaction - the oval, bash, ansible, and rule conditions use the rhel family instead of the rhel8, rhel9, and rhel10 list - the policy check and fix instructions use the drop-in form for rhel8 and rhel9, rhel10 renders from policy/stig/rhel10.yml - the ansible tasks use octal file modes

Reformat the changed srg_gpos control files to the '- id:' list style. The '- id:' style is pre-existing on master and enters lint scope because this update touches the files. No content change.

macko1 · 2026-10-27T23:30:14Z

/packit test -i contest-all

Mab879 · 2026-10-28T20:41:35Z

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
+# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10


multi_platform_rhel should be used here vs listing

Mab879 · 2026-10-28T21:17:55Z

 # complexity = low
 # disruption = low

+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


'rhel' in families?

Mab879 · 2026-10-28T21:18:24Z

 # platform = multi_platform_all


+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


'rhel' in families?

Mab879 · 2026-10-28T21:18:41Z

    {{{ oval_metadata("Configure the CtrlAltDelBurstAction setting in /etc/systemd/system.conf
      or /etc/systemd/system.conf.d/* to none to prevent a reboot if Ctrl-Alt-Delete is
      pressed more than 7 times in 2 seconds.", rule_title=rule_title) }}}
+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


'rhel' in families?

Mab879 · 2026-10-28T21:19:31Z

+{{% endif %}}
  </definition>

+{{% if product == "rhel10" %}}


Should we rewrite this to support RHEL 11?

Mab879 · 2026-10-28T21:22:59Z

@@ -1,5 +1,12 @@
 #!/bin/bash

+{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


'rhel' in families?

Mab879 · 2026-10-28T21:23:07Z

    <br /><br />
    To configure the system to ignore the <tt>CtrlAltDelBurstAction</tt>
-    {{% if product != "rhcos4" %}}
+    {{% if product in ["rhel8", "rhel9", "rhel10"] %}}


'rhel' in families?

Mab879 · 2026-10-28T21:31:25Z

+
    Run the following command to disable the interactive shell for a specific non-interactive user account:

+    {{% if product == "rhel10" %}}


Seems to be same path on RHEL9.

Mab879 · 2026-10-28T21:49:01Z

 #!/bin/bash
 # packages = audit

-echo "-a always,exit -F arch=b32 -S mount -F auid>={{{ uid_min }}} -F auid!=unset -k export" >> /etc/audit/rules.d/export.rules


IIRC the key doesn't matter to our OVAL, maybe just add test for different key?

Mab879 · 2026-10-28T21:53:56Z

+rm -f /etc/audit/rules.d/*.rules
+truncate -s 0 /etc/audit/audit.rules
+
+echo "-a always,exit -F arch=b32 -F path=/etc/sudoers.d -F perm=wa -F key=wrong" >> /etc/audit/rules.d/login.rules


The key doesn't really matter, wondering if as point of policy we don't care?

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 19, 2026

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from b021e31 to 53eaae7 Compare October 20, 2026 21:57

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread ...os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml Outdated

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread ...os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml Outdated

macko1 commented Oct 20, 2026

View reviewed changes

Comment thread linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/bash/shared.sh Outdated

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 8 times, most recently from 8596888 to ec2c2e7 Compare October 22, 2026 12:07

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread .../accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_alternate_dropin.pass.sh Outdated

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread ...ounts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_main_config.pass.sh Outdated

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread ...nts/accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_wrong_section.fail.sh Outdated

macko1 commented Oct 22, 2026

View reviewed changes

Comment thread .../accounts-physical/disable_ctrlaltdel_burstaction/tests/rhel8_rhel9_alternate_dropin.pass.sh Outdated

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 3 times, most recently from 8d29aa8 to 3a9089f Compare October 23, 2026 08:56

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 3a9089f to a384acc Compare October 23, 2026 10:10

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

macko1 added this to the 0.1.83 milestone Oct 23, 2026

macko1 added the STIG STIG Benchmark related. label Oct 23, 2026

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 23, 2026

Mab879 requested changes Oct 23, 2026

View reviewed changes

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 83c96d8 to 581a949 Compare October 26, 2026 14:25

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch 2 times, most recently from ff711bf to 20f602a Compare October 27, 2026 18:16

macko1 added 4 commits October 27, 2026 19:31

rhel10: STIG v1r3 remove RHEL-10-200050

b22db7e

Rules affected: RHEL-10-200050: package_tftp-server_removed - The control entry and policy/stig source are removed, the rule stays mapped to the RHEL 8 and RHEL 9 STIGs

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 20f602a to e7e49e6 Compare October 27, 2026 19:40

macko1 added 6 commits October 27, 2026 20:07

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from e7e49e6 to 74859b8 Compare October 27, 2026 22:04

macko1 and others added 11 commits October 27, 2026 22:44

rhel10: STIG v1r3 update profile stability data

c310255

Both the stig and stig_gui stability files: - add var_accounts_maximum_age_login_defs=180 and configure_openssl_crypto_policy - remove var_accounts_maximum_age_login_defs=60 and package_tftp-server_removed

rhel10: STIG v1r0-v1r3 update DISA SCAP Benchmark from cyber.mil

100e7fb

Fix yamllint findings in files touched by the STIG update

ebcf3f1

Reformat the changed srg_gpos control files to the '- id:' list style. The '- id:' style is pre-existing on master and enters lint scope because this update touches the files. No content change.

macko1 force-pushed the rhel10_stig_v1r2_to_v1r3 branch from 74859b8 to ebcf3f1 Compare October 27, 2026 22:56

Mab879 requested changes Oct 28, 2026

View reviewed changes

		# platform = multi_platform_all


		{{% if product in ["rhel8", "rhel9", "rhel10"] %}}



		checktext: \|-
		{{% if product == "rhel8" or product == "rhel9" %}}

		@@ -1,5 +1,12 @@
		#!/bin/bash

		{{% if product in ["rhel8", "rhel9", "rhel10"] %}}


		Run the following command to disable the interactive shell for a specific non-interactive user account:

		{{% if product == "rhel10" %}}

Conversation

macko1 commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Review Hints:

Uh oh!

openshift-ci Bot commented Oct 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mab879 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

macko1 commented Oct 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

macko1 commented Oct 19, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading