[teacup-on-rockingchair]

Description:

• Fix file_ownership_var_log_audit rule check when custom log_group is set in /etc/audit/auditd.conf

Rationale:

• file_ownership_var_log_audit: fix rule when custom log_group is set in /etc/audit/auditd.conf
  • if log_group is not set or set to root: check all files/dirs under /var/log/audit are user_id/group_id 0/0
  • if log_group is set, get GID of configured group and check all files/dirs under /var/log/audit are user_id/group_id 0/GID
• extended tests for both cases: root/root and root/audit user/group and DIR/Filename tests

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit' differs.
--- oval:ssg-file_ownership_var_log_audit:def:1
+++ oval:ssg-file_ownership_var_log_audit:def:1
@@ -1,5 +1,6 @@
 criteria OR
 criteria AND
+extend_definition oval:ssg-auditd_conf_log_group_not_root:def:1
 criterion oval:ssg-test_ownership_var_log_audit_files:tst:1
 criterion oval:ssg-test_ownership_var_log_audit_directories:tst:1
 criteria AND

[Mab879]

On RHEL 9.6 I noticed this issue.

Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/github.com/ComplianceAsCode/content/tests/logs/rule-custom-2026-10-23-1440/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script correct_value_log_group.pass.sh using profile (all) OK
INFO - Script wrong_value_dir.fail.sh using profile (all) OK
INFO - Script wrong_value_log_group.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit'.
INFO - Script wrong_value_log_group_dir.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit'.

[teacup-on-rockingchair]

_file_ownership_var_log_audit

On RHEL 9.6 I noticed this issue.

Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/github.com/ComplianceAsCode/content/tests/logs/rule-custom-2026-10-23-1440/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script correct_value_log_group.pass.sh using profile (all) OK
INFO - Script wrong_value_dir.fail.sh using profile (all) OK
INFO - Script wrong_value_log_group.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit'.
INFO - Script wrong_value_log_group_dir.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit'.

I've got this on rhel9:

./automatus.py rule --datastream ../build/ssg-rhel9-ds.xml --logdir /tmp/logs_podman_tests --debug  file_ownership_var_log_audit --profile default --container ssg_test_suite_rhel9:latest
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-6/test_suite.log
WARNING - Script 'correct_value.pass.sh' is not applicable on 'rhel9' target because the package(s) 'audit' it requires are unavailable there
WARNING - Script 'wrong_value.fail.sh' is not applicable on 'rhel9' target because the package(s) 'audit' it requires are unavailable there
INFO - xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit
WARNING - Nothing has been tested!

Could it be that you tested before the c2c978c patch ?