Skip to content

Add RHEL9-specific audit rules for faillock and lastlog with auid filter - #15016

Merged
jan-cerny merged 1 commit into
ComplianceAsCode:masterfrom
ggbecker:rhel9-faillock-lastlog-auid-filter
Aug 24, 2026
Merged

Add RHEL9-specific audit rules for faillock and lastlog with auid filter#15016
jan-cerny merged 1 commit into
ComplianceAsCode:masterfrom
ggbecker:rhel9-faillock-lastlog-auid-filter

Conversation

@ggbecker

@ggbecker ggbecker commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Adds RHEL9-specific audit rules for audit_rules_login_events_faillock and audit_rules_login_events_lastlog with auid filters (-F auid>=1000 -F auid!=unset) as required by RHEL 9 STIG v2r9 (RHEL-09-654250, RHEL-09-654255).

Note: RHEL 10 STIG v1r2 does NOT require these filters. This was missed in PR #15000.

Changes

Created RHEL9-specific overrides for both rules:

  • bash/rhel9.sh - Remediation with auid filters
  • ansible/rhel9.yml - Remediation with auid filters
  • oval/rhel9.xml - Permissive check (accepts rules with or without auid filters)
  • tests/rhel9_*.sh - Test scenarios (pass/fail cases)

OVAL Design: The OVAL check accepts rules with or without auid filters to prevent false failures on existing systems. Remediations always add the auid filters to ensure compliance. A conditional warning explains this behavior (RHEL9 only).

Generated rules:

-a always,exit -F arch=b32 -F path=/var/log/faillock -F perm=wa -F auid>=1000 -F auid!=unset -k logins
-a always,exit -F arch=b64 -F path=/var/log/faillock -F perm=wa -F auid>=1000 -F auid!=unset -k logins

Impact

  • 14 profiles use audit_rules_login_events_faillock
  • 16 profiles use audit_rules_login_events_lastlog
  • 36 controls reference faillock, 47 controls reference lastlog
  • Includes RHEL/CIS/NIST/HIPAA/PCI-DSS profiles across multiple products

References

@ggbecker ggbecker added this to the 0.1.83 milestone Aug 19, 2026
@ggbecker ggbecker added RHEL9 Red Hat Enterprise Linux 9 product related. STIG STIG Benchmark related. labels Aug 19, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 19, 2026
@openshift-ci

openshift-ci Bot commented Aug 19, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@ggbecker
ggbecker force-pushed the rhel9-faillock-lastlog-auid-filter branch 4 times, most recently from 5c4bfea to fb4ea82 Compare August 19, 2026 20:54
@jan-cerny jan-cerny self-assigned this Aug 20, 2026
@jan-cerny

jan-cerny commented Aug 20, 2026

Copy link
Copy Markdown
Member

@ggbecker I think the rule descriptions need to be changed so that on RHEL 9 they would match the OVAL and remediations.

@jan-cerny

jan-cerny commented Aug 20, 2026

Copy link
Copy Markdown
Member

@ggbecker Is this going to be backported to the stabilization branch?

@ggbecker

ggbecker commented Aug 20, 2026

Copy link
Copy Markdown
Member Author

@ggbecker I think the rule descriptions need to be changed so that on RHEL 9 they would match the OVAL and remediations.

Yeah, but one thing here that I decided to do is for example, to have the OVAL relaxed in a way that it allows the audit line without the auid filters set, this is to not break any other profile (many other profiles are using these rules already) that already has that line of audit configured, but the remediation, when applied, will set those auid filters to the audit line

@ggbecker Is this going to be backported to the stabilization branch?

It was on my plans to do so.

@ggbecker
Add RHEL9-specific audit rules for faillock and lastlog with auid filter
6be7f90 
RHEL9 STIG v2r9 requires auid filters for the following audit rules:
- RHEL-09-654250: audit_rules_login_events_faillock
- RHEL-09-654255: audit_rules_login_events_lastlog

RHEL10 STIG v1r2 does NOT require auid filters for the equivalent rules:
- RHEL-10-500750
- RHEL-10-500760

This commit removes the templates from rule.yml and provides:

1. **shared.sh/yml/xml** - Template-derived content (no auid filters) used by:
   - rhel8, rhel10, ol7, ol8, ol9, ol10, rhcos4, rhv4
   - almalinux9, anolis8, anolis23, fedora
   - debian11, ubuntu2204, ubuntu2404
   - sle12, sle15

2. **rhel9.sh/yml/xml** - Custom RHEL9 content with required auid filters:
   - Bash: Uses bash_fix_audit_syscall_rule macro with AUID_FILTERS
   - Ansible: Adds auid>=1000 and auid!=unset to rule patterns
   - OVAL: Requires auid>=1000 and auid!=unset in pattern matching

The generated RHEL9 rules include:
```
-a always,exit -F arch=b32 -F path=/var/run/faillock -F perm=wa -F auid>=1000 -F auid!=unset -k logins
-a always,exit -F arch=b64 -F path=/var/run/faillock -F perm=wa -F auid>=1000 -F auid!=unset -k logins
```

And similar for /var/log/lastlog.

Test scenarios verify both passing and failing cases for RHEL9.

This is a temporary solution until DISA clarifies why RHEL10 STIG doesn't
require the auid parameter. If DISA updates RHEL10 to match RHEL9, the custom
content can be updated accordingly.

Fixes: Missed requirement in PR ComplianceAsCode#15000
References: https://stigaview.com/products/rhel9/v2r9/RHEL-09-654250/
References: https://stigaview.com/products/rhel9/v2r9/RHEL-09-654255/
References: https://stigaview.com/products/rhel10/v1r2/RHEL-10-500750
References: https://stigaview.com/products/rhel10/v1r2/RHEL-10-500760
@ggbecker
ggbecker force-pushed the rhel9-faillock-lastlog-auid-filter branch from fb4ea82 to 6be7f90 Compare August 20, 2026 12:34
@ggbecker

ggbecker commented Aug 20, 2026

Copy link
Copy Markdown
Member Author

@ggbecker I think the rule descriptions need to be changed so that on RHEL 9 they would match the OVAL and remediations.

Yeah, but one thing here that I decided to do is for example, to have the OVAL relaxed in a way that it allows the audit line without the auid filters set, this is to not break any other profile (many other profiles are using these rules already) that already has that line of audit configured, but the remediation, when applied, will set those auid filters to the audit line

If we should actually restrict OVAL to check for the presence of auid filters, then this opens a different kind of question that is how we deal with other profiles. Unless we create custom STIG rules for RHEL9 (kind of unwanted IMO).

@jan-cerny

jan-cerny commented Aug 20, 2026

Copy link
Copy Markdown
Member

I think that allowing audit rules both with and without auid is fine.

@ggbecker
ggbecker marked this pull request as ready for review August 20, 2026 20:03
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 20, 2026
@ggbecker

ggbecker commented Aug 20, 2026

Copy link
Copy Markdown
Member Author

I think that allowing audit rules both with and without auid is fine.

I agree

@openshift-ci

openshift-ci Bot commented Aug 20, 2026

Copy link
Copy Markdown

@ggbecker: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-openshift-node-compliance 6be7f90 link false /test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jan-cerny
jan-cerny approved these changes Aug 24, 2026
View reviewed changes
Comment thread ...auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml
{{{ ocil_audit_rules_watch("/var/log/lastlog", "logins") }}}

{{% if product in ["rhel9"] %}}
warnings:

@jan-cerny jan-cerny Aug 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@jan-cerny
jan-cerny merged commit df060c6 into ComplianceAsCode:master Aug 24, 2026
71 of 75 checks passed
@ggbecker ggbecker mentioned this pull request Aug 24, 2026
Merged
@jan-cerny jan-cerny added the backported-into-stabilization PRs which were cherry-picked during stabilization process. label Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes
@matusmarhefka matusmarhefka Awaiting requested review from matusmarhefka matusmarhefka is a code owner
@Mab879 Mab879 Awaiting requested review from Mab879 Mab879 is a code owner
@vojtapolasek vojtapolasek Awaiting requested review from vojtapolasek vojtapolasek is a code owner

Assignees

@jan-cerny jan-cerny

Labels

backported-into-stabilization PRs which were cherry-picked during stabilization process. RHEL9 Red Hat Enterprise Linux 9 product related. STIG STIG Benchmark related.

Projects

None yet

Milestone

0.1.83

Development

Successfully merging this pull request may close these issues.

2 participants

@ggbecker @jan-cerny