Update rules related to /var/log/audit #14286
Merged
+534
−504
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This rule description wasn't aligned with OVAL and remediations. There were product specific conditions that aren't justified. In this commit the code has been consolidated so that it works the same on all platforms. Inconsistencies have been removed and clarified. Special OVAL for SLES 15 has been merged into the generic OVAL. Ansible remediation has been simplified and aligned with the Bash remediation. Finally, all test scenarios have been reworked. Resolves: https://issues.redhat.com/browse/RHEL-138549
|
Skipping CI for Draft Pull Request. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
This rule description wasn't aligned with OVAL and remediations. There were product specific conditions that aren't justified. In this commit the code has been consolidated so that it works the same on all platforms. Inconsistencies have been removed and clarified. Ansible remediation has been simplified and aligned with the Bash remediation. Finally, test scenarios have been reworked. Resolves: https://issues.redhat.com/browse/RHEL-138549
jan-cerny
force-pushed
the
var_log_audit
branch
from
500a47c to
445b25f
Compare
ATEX Test ResultsTest artifacts have been submitted to Testing Farm. Results: View Test Results This comment was automatically generated by the ATEX workflow. |
Collaborator
Author
|
I have confirmed that this PR fixes the linked issue https://issues.redhat.com/browse/RHEL-138549 therefore I will mark this as ready for review. |
jan-cerny
requested review from
Mab879,
matusmarhefka and
vojtapolasek
as code owners
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
Mab879
requested changes
Jan 12, 2026
Member
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
Should linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh still lists all of the platforms?
linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml
Outdated
Show resolved
Hide resolved
...x_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/ansible/shared.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh
Outdated
Show resolved
Hide resolved
| documentation_complete: true | ||
|
|
||
|
|
||
| title: 'System Audit Logs Must Have Mode 0640 or Less Permissive' |
Collaborator
Author
There was a problem hiding this comment.
0640 or less permissive
0600 if the log_group is root
0640 if the log_group isn't root
I updated the rule description, it was confusing
..._os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh
Outdated
Show resolved
Hide resolved
Minor changes based on the PR review
Collaborator
Author
|
I have updated the PR according to your feedback |
Mab879
approved these changes
Jan 13, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix rules fix_permissions_var_log_audit and directory_permissions_var_log_audit.
This rule description wasn't aligned with OVAL and remediations. There
were product specific conditions that aren't justified. In this commit
the code has been consolidated so that it works the same on all
platforms. Inconsistencies have been removed and clarified. Ansible
remediation has been simplified and aligned with the Bash remediation.
Finally, test scenarios have been reworked.
Resolves: https://issues.redhat.com/browse/RHEL-138549