From 162aa084e89ca71f0423fe1c7081fffa43d7a600 Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
<315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Thu, 4 Sep 2025 18:27:12 +0300
Subject: [PATCH 1/4] Add support for directory_permissions_var_log_audit rule
in SLE15 platform
- Adds custom oval check for sle15
- Adds ansible remediation for directory_permissions_var_log_audit
- Adds support for sle platforms in bash remediation
---
.../ansible/shared.yml | 41 ++++++
.../bash/shared.sh | 2 +-
.../oval/sle15.xml | 124 ++++++++++++++++++
3 files changed, 166 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
create mode 100644 linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
new file mode 100644
index 000000000000..88eb4dbe0c32
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
@@ -0,0 +1,41 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+ ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ failed_when: false
+ register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+ ansible.builtin.set_fact:
+ log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+ ansible.builtin.set_fact:
+ log_file_dir: "/var/log/audit"
+ when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file_dir from log_file_line if configured"
+ ansible.builtin.set_fact:
+ log_file_dir: "{{ log_file_line | dirname}}"
+ when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get audit log group"
+ ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
+ failed_when: false
+ register: log_group_exists
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0700"
+ ansible.builtin.file:
+ path: "{{ log_file_dir }}"
+ mode: 0700
+ when: log_group_exists.stdout | length == 0
+
+- name: "{{{ rule_title }}} - Set audit log directory mode to 0750"
+ ansible.builtin.file:
+ path: "{{ log_file_dir }}"
+ mode: 0750
+ when: log_group_exists.stdout | length > 0
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
index af7d8ce9eb7c..8aad7d5a8900 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
@@ -1,4 +1,4 @@
-# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_fedora
+# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml
new file mode 100644
index 000000000000..121f6a6f7a46
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml
@@ -0,0 +1,124 @@
+
+
+ {{{ oval_metadata("Checks for correct permissions for audit logs.", rule_title=rule_title) }}}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /etc/audit/auditd.conf
+ ^[ ]*log_group[ ]+=[ ](\w+)$
+ 1
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /var/log/audit
+
+
+
+
+
+
+
+
+
+ /var/log/audit
+
+
+
+
+ false
+ false
+ false
+ true
+ true
+ true
+ false
+ false
+ false
+ false
+ false
+ false
+
+
+
+ false
+ false
+ false
+ true
+ true
+ true
+ true
+ false
+ true
+ false
+ false
+ false
+
+
From c5bd7ddd26f5c1cdc97f2e21204fe4bfcdd9dac8 Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
<315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Thu, 4 Sep 2025 18:33:59 +0300
Subject: [PATCH 2/4] Correct fixtext section to reflect actual behaviour
---
.../file_permissions_var_log_audit/rule.yml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
index c70a8da65a55..a672d9cb74b2 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
@@ -74,13 +74,13 @@ fixtext: |-
If the log_group is not defined or it is set to root, configure the permissions the following way:
- $ sudo chmod 0640 $log_file
- $ sudo chmod 0440 $log_file.*
+ $ sudo chmod 0600 $log_file
+ $ sudo chmod 0400 $log_file.*
Otherwise, configure the permisssions the following way:
- $ sudo chmod 0600 $log_file
- $ sudo chmod 0400 $log_file.*
+ $ sudo chmod 0640 $log_file
+ $ sudo chmod 0440 $log_file.*
srg_requirement: |-
{{{ full_name }}} audit log file must have mode 0640 or less permissive to prevent unauthorized access to the audit log.
From e01870121de9185c6a3bf99470b0c6b86935d152 Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
<315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Thu, 4 Sep 2025 18:34:53 +0300
Subject: [PATCH 3/4] Adds ansible remediation for
file_ownership_var_log_audit_stig rule
---
.../ansible/shared.yml | 41 +++++++++++++++++++
1 file changed, 41 insertions(+)
create mode 100644 linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
new file mode 100644
index 000000000000..158a9cd0bb4a
--- /dev/null
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
@@ -0,0 +1,41 @@
+# platform = multi_platform_sle
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
+ ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ failed_when: false
+ register: log_file_exists
+
+- name: "{{{ rule_title }}} - Set audit log file fact"
+ ansible.builtin.set_fact:
+ log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
+
+- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
+ ansible.builtin.set_fact:
+ log_file: "/var/log/audit/audit.log"
+ when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+
+- name: "{{{ rule_title }}} - Set log_file from log_file_line if configured"
+ ansible.builtin.set_fact:
+ log_file: "{{ log_file_line }}"
+ when: (log_file_line is defined) and (log_file_line | length > 0)
+
+- name: "{{{ rule_title }}} - Get all audit backup log file(s)"
+ ansible.builtin.find:
+ path: "{{ log_file | dirname }}"
+ patterns: "{{ log_file | basename }}.*"
+ register: backup_files
+
+- name: "{{{ rule_title }}} - Set root as owner to all audit backup log file(s)"
+ ansible.builtin.file:
+ path: "{{ item }}"
+ owner: root
+ loop: "{{ backup_files.files| map(attribute='path') | list }}"
+
+- name: "{{{ rule_title }}} - Set root as owner to audit log file"
+ ansible.builtin.file:
+ path: "{{ log_file }}"
+ owner: root
From 357209cc6c197d98051f318a1e772ae2b40162bb Mon Sep 17 00:00:00 2001
From: teacup-on-rockingchair
<315160+teacup-on-rockingchair@users.noreply.github.com>
Date: Mon, 8 Sep 2025 08:52:39 +0300
Subject: [PATCH 4/4] Make sure ansible will beahve ok also in check_mode
Thanks :bow: to @jan-cerny for the tip
---
.../ansible/shared.yml | 2 +
.../ansible/shared.yml | 1 +
.../oval/sle15.xml | 224 ++++++++++++++++++
3 files changed, 227 insertions(+)
create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml
diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
index 88eb4dbe0c32..785b50ee44a4 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml
@@ -6,6 +6,7 @@
- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ check_mode: False
failed_when: false
register: log_file_exists
@@ -25,6 +26,7 @@
- name: "{{{ rule_title }}} - Get audit log group"
ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
+ check_mode: False
failed_when: false
register: log_group_exists
diff --git a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
index 158a9cd0bb4a..8c1e4094da0c 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml
@@ -6,6 +6,7 @@
- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
+ check_mode: False
failed_when: false
register: log_file_exists
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml
new file mode 100644
index 000000000000..3eca8b865ecd
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval/sle15.xml
@@ -0,0 +1,224 @@
+
+
+ {{{ oval_metadata("The root account should be configured to deny access after the number of
+ defined failed attempts has been reached.", rule_title=rule_title) }}}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ^[\s]*auth\N+pam_unix\.so
+
+
+
+ ^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc
+
+
+
+^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=\b)(?=.*?\bnew_authtok_reqd=(ok|done)\b)(?=.*?\bdefault=(bad|ignore)\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=\b)(?=.*\bdefault=\b).*\])[\s]+pam_faillock\.so
+
+
+
+ ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+(?=.*authfail)(?=.*even_deny_root)[\s\S]*^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+(?=.*authsucc)(?=.*even_deny_root)
+
+
+
+ ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*even_deny_root
+
+
+
+^[\s]*even_deny_root
+
+
+
+
+ ^/etc/pam.d/common-auth$
+
+
+1
+
+
+
+
+
+
+
+
+^/etc/pam.d/common-auth$
+
+1
+
+
+
+
+
+
+
+
+^/etc/pam.d/common-account$
+
+1
+
+
+
+
+
+
+
+
+ ^/etc/pam.d/common-auth$
+
+1
+
+
+
+ ^/etc/pam.d/common-auth$
+
+1
+
+
+
+
+
+
+
+
+
+
+
+
+ ^/etc/security/faillock.conf$
+
+1
+
+
+
+
+
+
+
+
+
+