<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="xccdf_org.ssgproject.content_benchmark_AL-2023" resolved="1" xml:lang="en-US" style="SCAP_1.2">
  <status date="2025-11-28">draft</status>
  <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Guide to the Secure Configuration of Amazon Linux 2023</title>
  <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This guide presents a catalog of security-relevant
configuration settings for Amazon Linux 2023. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">scap-security-guide</html:code> package which is developed at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
    <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:em xmlns:html="http://www.w3.org/1999/xhtml">catalog, not a
checklist</html:em>, and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:em xmlns:html="http://www.w3.org/1999/xhtml">Profiles</html:em>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG, which provides required
settings for US Department of Defense systems, is one example of a baseline
created from this guidance.
</description>
  <notice xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.
</notice>
  <front-matter xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SCAP Security Guide Project<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>
   </front-matter>
  <rear-matter xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.</rear-matter>
  <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">anssi</reference>
  <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=application-servers">app-srg</reference>
  <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">app-srg-ctr</reference>
  <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">bsi</reference>
  <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">cis</reference>
  <reference href="https://www.cisecurity.org/controls/">cis-csc</reference>
  <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">cjis</reference>
  <reference href="https://www.isaca.org/resources/cobit">cobit5</reference>
  <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">cui</reference>
  <reference href="not_officially_available">dcid</reference>
  <reference href="https://www.cyber.mil/stigs/cci/">disa</reference>
  <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">hipaa</reference>
  <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">isa-62443-2009</reference>
  <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">isa-62443-2013</reference>
  <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">ism</reference>
  <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">iso27001-2013</reference>
  <reference href="https://www.nerc.com/standards/reliability-standards/cip">nerc-cip</reference>
  <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">nist</reference>
  <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">nist-csf</reference>
  <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">os-srg</reference>
  <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">ospp</reference>
  <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">pcidss</reference>
  <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">pcidss4</reference>
  <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux">stigid</reference>
  <reference href="https://www.cyber.mil/stigs/srg-stig-tools/">stigref</reference>
  <platform idref="cpe:/o:amazon:amazon_linux:2023"/>
  <version update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.79</version>
  <metadata xmlns:xhtml="http://www.w3.org/1999/xhtml">
        <dc:publisher xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:publisher>
        <dc:creator xmlns:dc="http://purl.org/dc/elements/1.1/">SCAP Security Guide Project</dc:creator>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank J Cameron (CAM1244) &lt;cameron@ctc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">0x66656c6978 &lt;0x66656c6978@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Håvard F. Aasen &lt;havard.f.aasen@pfft.no&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Armando Acosta &lt;armando.acosta@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jack Adolph &lt;jack.adolph@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Edgar Aguilar &lt;edgar.aguilar@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">akuster &lt;akuster808@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Firas AlShafei &lt;firas.alshafei@us.abb.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rodrigo Alvares &lt;ralvares@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">am-tux &lt;andrew.miller11@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Craig Andrews &lt;candrews@integralblue.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">angystardust &lt;angystardust@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">anivan-suse &lt;anastasija.ivanovic@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">anixon-rh &lt;55244503+anixon-rh@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Anna-Koudelkova &lt;akoudelk@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Arden97 &lt;arden2545@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Steve Arnold &lt;sarnold@vctlabs.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ikko Ashimine &lt;eltociear@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">axuan &lt;axuan@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bharath B &lt;bhb@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ryan Ballanger &lt;root@rballang-admin-2.fastenal.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alex Baranowski &lt;alex@euro-linux.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eduardo Barretto &lt;eduardo.barretto@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Bastide &lt;pbastide@us.ibm.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew Becker &lt;A-Beck@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gabriel Becker &lt;ggasparb@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">BenGui &lt;benoit.guillon1@etu.unilim.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexander Bergmann &lt;abergmann@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eric Berry &lt;eric@approvedworkman.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dale Bewley &lt;dale@bewley.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jose Luis BG &lt;bgjoseluis@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">binyanling &lt;binyanling@uniontech.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeff Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Olivier Bonhomme &lt;ptitoliv@ptitoliv.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">bontreger &lt;bontreger@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lance Bragstad &lt;lbragstad@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ted Brunell &lt;tbrunell@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marcus Burghardt &lt;maburgha@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matthew Burket &lt;mburket@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">George Campbell &lt;gcampbell@palantir.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Carlos &lt;64919342+carlosmmatos@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">James Cassell &lt;james.cassell@ll.mit.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Caviggia &lt;fcaviggia@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sinong Chen &lt;costinchen@tencent.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dan Clark &lt;danclark@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jayson Cofell &lt;1051437+70k10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">David du Colombier &lt;djc@datadoghq.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Commandcracker &lt;lukas.fricke.dev@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">CoreyCook8 &lt;129206271+CoreyCook8@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">cortesana &lt;acortes@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Richard Maciel Costa &lt;richard.maciel.costa@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Xavier Coulon &lt;xavier.coulon@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Deric Crago &lt;deric.crago@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">crleekwc &lt;crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">cueball23 &lt;christoph.alms@westnetz.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">cyarbrough76 &lt;42849651+cyarbrough76@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Benjamin Deering &lt;ben_deering@jeepingben.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">denknorr &lt;dennis.knorr@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">dhanushkar-wso2 &lt;dhanushkar@wso2.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew DiPrinzio &lt;andrew.diprinzio@jhuapl.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">dom &lt;dominique.blaze@devinci.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marco De Donno &lt;mdedonno1337@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">dperrone &lt;dperrone@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">drax &lt;applezip@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sebastian Dunne &lt;sdunne@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">François Duthilleul &lt;francoisduthilleul@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">eradot4027 &lt;jrtonmac@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">ericeberry &lt;ericeberry@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">ermeratos &lt;manuel.ermer@eviden.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Evelyn &lt;evansvevelyn@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexis Facques &lt;alexis.facques@mythalesgroup.io&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Fader &lt;jan.fader@web.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Henry Finucane &lt;hfinucane@zscaler.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Leah Fisher &lt;lfisher047@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marco Fortina &lt;marco_fortina@hotmail.it&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yavor Georgiev &lt;strandjata@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alijohn Ghassemlouei &lt;alijohn@secureagc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Swarup Ghosh &lt;swghosh@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">ghylock &lt;ghylock@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Gompper &lt;forestgomp@yahoo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">David Fernandez Gonzalez &lt;david.fernandezgonzalez@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Loren Gordon &lt;lorengordon@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gene Gotimer &lt;otherdevopsgene@portinfo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Patrik Greco &lt;sikevux@sikevux.se&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">guangyee &lt;gyee@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bhargavi Gudi &lt;bgudi@bgudi-thinkpadt14sgen2i.remote.csb&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christian Hagenest &lt;christian.hagenest@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marek Haicman &lt;mhaicman@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sun, Haoxiang &lt;haoxiang.sun@intel.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Vern Hart &lt;vern.hart@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alex Haydock &lt;alex@alexhaydock.co.uk&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rebekah Hayes &lt;rhayes@corp.rivierautilities.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">hazerre &lt;kotadouglas2@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Henning Henkel &lt;henning.henkel@helvetia.ch&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">hex2a &lt;hex2a@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">hipponix &lt;mirco.santori@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">John Hooks &lt;jhooks@starscream.pa.jhbcomputers.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jakub Hrozek &lt;jhrozek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Donald Hunter &lt;donald.hunter@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">De Huo &lt;De.Huo@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yasir Imam &lt;yimam@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jiri Jaburek &lt;jjaburek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Keith Jackson &lt;keithkjackson@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marc Jadoul &lt;mgjadoul@laptomatic.auth-o-matic.corp&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jakub Jelen &lt;jjelen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jessicahfy &lt;Jessicahfy@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Simon John &lt;sjohn@tuxcare.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Hunter Jones &lt;hjones2199@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jono &lt;jono@ubuntu-18.localdomain&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">justchris1 &lt;justchris1@justchris1.email&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kacper &lt;kacper@kacper.se&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kai Kang &lt;kai.kang@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Charles Kernstock &lt;charles.kernstock@ultra-ats.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sherine Khoury &lt;skhoury@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Kinder &lt;nkinder@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lee Kinser &lt;lee.kinser@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Evgeny Kolesnikov &lt;ekolesni@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Peter 'Pessoft' Kolínek &lt;github@pessoft.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Malte Kraus &lt;malte.kraus@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Seth Kress &lt;seth.kress@dsainc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Felix Krohn &lt;felix.krohn@helvetia.ch&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Amit Kumar &lt;amitkuma@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dexter Le &lt;dexter.le@sap.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dimitri John Ledkov &lt;dimitri.ledkov@surgut.co.uk&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ade Lee &lt;alee@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Christopher Lee &lt;Crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ian Lee &lt;lee1001@llnl.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jarrett Lee &lt;jarrettl@umd.edu&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joseph Lenox &lt;joseph.lenox@collins.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stefano Libero &lt;stefano.libero@nozominetworks.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">lichtblaugue &lt;guenther.lichtblau@eviden.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Markus Linnala &lt;Markus.Linnala@knowit.fi&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Flos Lonicerae &lt;lonicerae@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Simon Lukasik &lt;slukasik@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Andrew Lukoshko &lt;andrew.lukoshko@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Milan Lysonek &lt;mlysonek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Fredrik Lysén &lt;fredrik@pipemore.se&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mackemania &lt;8738793+Mackemania@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Caitlin Macleod &lt;caitelatte@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dmitry Makovey &lt;dmakovey@yahoo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Maludy &lt;nmaludy@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lokesh Mandvekar &lt;lsm5@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matus Marhefka &lt;mmarhefk@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Carlos Matos &lt;cmatos@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robert McAllister &lt;rmcallis@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Karen McCarron &lt;kmccarro@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Marcus Meissner &lt;meissner@suse.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Khary Mendez &lt;kmendez@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matt Micene &lt;nzwulfin@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Takuya Mishina &lt;tmishina@jp.ibm.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mixer9 &lt;35545791+Mixer9@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Thomas Montague &lt;montague.thomas@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alan Moore &lt;alan.moore@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Moyer &lt;nmoyer@spectric.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ross Murphy &lt;RossMurphy@ibm.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Renaud Métrich &lt;rmetrich@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">namoyer10 &lt;48189779+namoyer10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Neiloy &lt;neiloy@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Axel Nennker &lt;axel@nennker.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">nnerdmann &lt;128606223+nnerdmann@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sean O'Keeffe &lt;seanokeeffe797@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jiri Odehnal &lt;jodehnal@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ilya Okomin &lt;ilya.okomin@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Eryx Paredes &lt;eryxp@lyft.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Max R.D. Parmer &lt;maxp@trystero.is&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Arnaud Patard &lt;apatard@hupstream.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Pazdziora &lt;jpazdziora@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Peters &lt;Nathaniel.Peters@ca.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Stefan Pietsch &lt;mail.ipv4v6+gh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">piggyvenus &lt;piggyvenus@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Vojtech Polasek &lt;vpolasek@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Orion Poplawski &lt;orion@nwra.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jennifer Power &lt;barnabei.jennifer@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nick Poyant &lt;npoyant@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Wesley Ceraso Prudencio &lt;wcerasop@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Raphael Sanchez Prudencio &lt;rsprudencio@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Miha Purg &lt;miha.purg@canonical.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rain-Qing &lt;yangyuqing6@qq.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenyon Ralph &lt;kenyon@kenyonralph.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mike Ralph &lt;mralph@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Federico Ramirez &lt;federico.r.ramirez@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rchikov &lt;rumen.chikov@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Rensing &lt;prensing@cimetrics.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rhayes &lt;rhayes@rivierautilities.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rlucente-se-jboss &lt;rlucente@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Juan Antonio Osorio Robles &lt;juan.osoriorobles@eu.equinix.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Roche &lt;paul.roche@menlosecurity.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Rodak &lt;hony.com@seznam.cz&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matt Rogers &lt;mrogers@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jesse Roland &lt;jesse.roland@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Daniel Ruf &lt;daniel@daniel-ruf.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Chris Ruffalo &lt;chris.ruffalo@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Benjamin Ruland &lt;benjamin.ruland@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">rumch-se &lt;77793453+rumch-se@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rutvik &lt;rutksh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nicolas SAID &lt;nicolas.said@atos.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Earl Sampson &lt;ESampson@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">sampsone &lt;esampson@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mirco Santori &lt;mirco.santori@roche.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nagarjuna Sarvepalli &lt;snagarju@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Anderson Sasaki &lt;33833274+ansasaki@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexander Scheel &lt;alexander.m.scheel@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bryan Schneiders &lt;pschneiders@trisept.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Robert Schweikert &lt;rjschwei@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">shaneboulden &lt;shane.boulden@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Vincent Shen &lt;wenshen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dhriti Shikhar &lt;dhriti.shikhar.rokz@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Mark Shoger &lt;mshoger@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Shane Siebken &lt;shane.siebken@capellaspace.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">THOBY Simon &lt;Simon.THOBY@viveris.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Thomas Sjögren &lt;konstruktoid@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jindrich Skacel &lt;102800748+jskacel@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Alexandre Skrzyniarz &lt;alexandre.skrzyniarz@laposte.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">sluetze &lt;13255307+sluetze@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Dave Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">David Smith &lt;dsmith@fornax.eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Justin Stephenson &lt;jstephen@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">steven.y.gui &lt;steven_ygui@163.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Stinson &lt;brian@bstinson.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jake Stookey &lt;jakestookey@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nathan Strahs &lt;135379779+nathanstrahs@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jonathan Sturges &lt;jsturges@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">svet-se &lt;svetlin.boychev@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kaushik Talathi &lt;kaushik.talathi1@ibm.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">teacup-on-rockingchair &lt;315160+teacup-on-rockingchair@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Ian Tewksbury &lt;itewk@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Simon THOBY &lt;git@nightmared.fr&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Derek Thurston &lt;thegrit@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">tianzhenjia &lt;jiatianzhen@cmss.chinamobile.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Greg Tinsley &lt;gtinsley@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">tom &lt;tom@localhost.localdomain&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">tomas.hudik &lt;tomas.hudik@embedit.cz&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">TrilokGeer &lt;tgeer@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Viktors Trubovics &lt;viktors.trubovics@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Nico Truzzolino &lt;nico.truzzolino@gmx.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Brian Turek &lt;brian.turek@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Matěj Týč &lt;matyc@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">VadimDor &lt;29509093+VadimDor@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Trevor Vaughan &lt;tvaughan@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">vtrubovics &lt;82443408+vtrubovics@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Sophia Wang &lt;huiwang@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Samuel Warren &lt;swarren@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">wcushen &lt;54533890+wcushen@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Shawn Wells &lt;shawn@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Whidix &lt;31294015+Whidix@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Daniel E. White &lt;linuxdan@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Bernhard M. Wiedemann &lt;bwiedemann@suse.de&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Roy Williams &lt;roywilli@roywilli.redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Willumpie &lt;willumpie@xs4all.nl&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">win97pro &lt;win97pro@protonmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">xcfxr &lt;xucee@qq.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Xirui Yang &lt;xirui.yang@oracle.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Yuqing Yang &lt;yyq01323329@alibaba-inc.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">yarunachalam &lt;yarunachalam@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Guang Yee &lt;guang.yee@suse.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Achilleas John Yfantis &lt;ayfantis@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">YiLin.Li &lt;YiLin.Li@linux.alibaba.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">yu410621 &lt;lihuanyu410621@gmail.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Xiaojie Yuan &lt;xiyuan@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">yungcero &lt;133906218+yungcero@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">yunimoo &lt;yunimoo@nekocake.cafe&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">YuQing &lt;yyq0391@163.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">zhaoyun &lt;zhaoyun@kylinos.cn&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Luigi Mario Zuccarelli &lt;luzuccar@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Jan Černý &lt;jcerny@redhat.com&gt;</dc:contributor>
        <dc:contributor xmlns:dc="http://purl.org/dc/elements/1.1/">Michal Šrubař &lt;msrubar@redhat.com&gt;</dc:contributor>
        <dc:source xmlns:dc="http://purl.org/dc/elements/1.1/">https://github.com/ComplianceAsCode/content/releases/latest</dc:source>
      </metadata>
  <model system="urn:xccdf:scoring:default"/>
  <Profile id="xccdf_org.ssgproject.content_profile_cis">
    <version>1.0.0</version>
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">CIS Amazon Linux 2023 Benchmark for Level 2 - Server</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile defines a baseline that aligns to the "Level 2 - Server"
configuration from the Center for Internet Security® Amazon Linux
2023 Benchmark™, v1.0.0, released 2023-06-26.

This profile includes Center for Internet Security®
Amazon Linux 2023 CIS Benchmarks™ content.</description>
    <reference>https://www.cisecurity.org/benchmark/amazon_linux/</reference>
    <select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_id" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_users_netrc_file_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_create" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_query" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification_usr_share" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_audit_sudo_log_events" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_root_password_configured" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_cron_allow_exists" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_group_ownership_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit_stig" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_audit_binaries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_group_unique_id" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_group_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_has_nonlocal_mta" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_compress" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_forward_to_syslog" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_storage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_forward_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_avahi_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_bind_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cups_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dhcp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dnsmasq_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dovecot_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ftp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_httpd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_libselinux_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nftables_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nginx_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsync_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_samba_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_squid_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnet_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_dev_shm" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_root_path_no_dot" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_not_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_nfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_nftables_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rpcbind_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_nftables_table" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su" selected="true"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" selector="all_dotfiles"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="027"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="15_min"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="30"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="365"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" selector="SHA512"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" selector="sha512"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" selector="requisite_or_required"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" selector="5"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="900"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="14"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" selector="cis"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="15_minutes"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" selector="60"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" selector="10"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" selector="10:30:60"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" selector="4"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" selector="loopback-only"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="amazon"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="default_policy"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_motd_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" selector="run"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" selector="root"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" selector="halt"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" selector="email"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" selector="keep_logs"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" selector="6"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" selector="8192"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_nftables_family" selector="inet"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_nftables_table" selector="firewalld"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
  </Profile>
  <Profile id="xccdf_org.ssgproject.content_profile_cis_server_l1">
    <version>1.0.0</version>
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">CIS Amazon Linux 2023 Benchmark for Level 1 - Server</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile defines a baseline that aligns to the "Level 1 - Server"
configuration from the Center for Internet Security® Amazon Linux
2023 Benchmark™, v1.0.0, released 2023-06-26.

This profile includes Center for Internet Security®
Amazon Linux 2023 CIS Benchmarks™ content.</description>
    <reference>https://www.cisecurity.org/benchmark/amazon_linux/</reference>
    <select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_id" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_accounts_users_netrc_file_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_banner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_ensure_root_password_configured" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_cron_allow_exists" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_owner_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_at_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_allow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_crontab" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_file_permissions_user_cfg" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_group_unique_id" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_group_unique_name" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_has_nonlocal_mta" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_compress" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_forward_to_syslog" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_journald_storage" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_forward_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_avahi_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_bind_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cups_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dhcp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dnsmasq_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_dovecot_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_ftp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_httpd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_libselinux_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_nginx_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsync_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_samba_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_squid_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_telnet_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_dev_shm" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_root_path_no_dot" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_not_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_nfs_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_rpcbind_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su" selected="true"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_dac_actions" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_file_deletion_events" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_file_modification" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_kernel_module_loading" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_login_events" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_privileged_commands" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_auditd_configure_rules" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_auditing" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_configure_auditd_data_retention" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_file_permissions_auditd" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_firewalld_activation" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-firewalld" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-nftables" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
    <select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" selector="all_dotfiles"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" selector="027"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="15_min"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="30"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="365"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" selector="SHA512"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" selector="sha512"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" selector="requisite_or_required"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" selector="5"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="900"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="4"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="14"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" selector="cis"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="15_minutes"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" selector="60"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" selector="10"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" selector="10:30:60"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" selector="4"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" selector="enabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" selector="disabled"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" selector="loopback-only"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="amazon"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="default_policy"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_motd_banner_text" selector="cis_banners"/>
    <refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
  </Profile>
  <Group id="xccdf_org.ssgproject.content_group_system">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Settings</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Contains rules that check correct system settings.</description>
    <Group id="xccdf_org.ssgproject.content_group_software">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Installing and Maintaining Software</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</description>
      <Group id="xccdf_org.ssgproject.content_group_integrity">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System and Software Integrity</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System and software integrity can be gained by installing antivirus, increasing
system encryption strength with FIPS, verifying installed software, enabling SELinux,
installing an Intrusion Prevention System, etc. However, installing or enabling integrity
checking tools cannot <html:i xmlns:html="http://www.w3.org/1999/xhtml">prevent</html:i> intrusions, but they can detect that an intrusion
may have occurred. Requirements for integrity checking may be highly dependent on
the environment in which the system will be used. Snapshot-based approaches such
as AIDE may induce considerable overhead in the presence of frequent software updates.</description>
        <Group id="xccdf_org.ssgproject.content_group_software-integrity">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Software Integrity Checking</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.</description>
          <Group id="xccdf_org.ssgproject.content_group_aide">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Integrity with AIDE</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">AIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update.  AIDE is highly configurable, with further configuration
information located in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/aide-<html:i>VERSION</html:i>
         </html:code>.</description>
            <platform idref="#system_with_kernel"/>
            <Rule id="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install AIDE</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">aide</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install aide</html:pre>
         </description>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.3.1</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1034</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1288</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1341</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1417</reference>
              <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The AIDE package must be installed if it is to be available for integrity checking.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "aide"
version = "*"
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=aide
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_aide_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_aide_installed

- name: Ensure aide is installed
  ansible.builtin.package:
    name: aide
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_aide_installed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-package_aide_installed:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-package_aide_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Build and Test AIDE Database</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Run the following command to generate a new database:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo /usr/sbin/aide --init</html:pre>

By default, the database will be written to the file

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/lib/aide/aide.db.new.gz</html:code>.

Storing the database, the configuration file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/aide.conf</html:code>, and the binary
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/sbin/aide</html:code>
(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>

To initiate a manual check, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo /usr/sbin/aide --check</html:pre>
If this check produces any unexpected output, investigate.</description>
              <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">In RHEL Image Mode (bootc) systems, the AIDE database must be regenerated after each system update.
Image Mode systems receive updates through new container images that may include modified files.
After applying system updates, run the following commands to regenerate the AIDE database:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo /usr/sbin/aide --init</html:pre>
Then replace the existing database:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>
Failure to regenerate the AIDE database after updates will result in false positive alerts
for legitimate system changes introduced by the update process.</warning>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.3.1</reference>
              <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_build_database" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_build_database" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Ensure AIDE Is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Check Whether the Stock AIDE Database Exists
  ansible.builtin.stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Build and Test AIDE Database
  ansible.builtin.command: /usr/sbin/aide --init
  changed_when: true
  when:
  - '"kernel" in ansible_facts.packages'
  - not (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  register: aide_database_init
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Build and Test AIDE Database - Stage AIDE Database
  ansible.builtin.copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
  - '"kernel" in ansible_facts.packages'
  - aide_database_init is changed
  - not ansible_check_mode
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_build_database
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-aide_build_database:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-aide_build_database_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure AIDE to Verify the Audit Tools</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The operating system file integrity tool must be configured to protect the integrity of the audit tools.</description>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3).1</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.3.3</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protecting the integrity of the tools used for auditing purposes is a
critical step toward ensuring the integrity of audit information. Audit
information includes all information (e.g., audit records, audit settings,
and audit reports) needed to successfully audit information system
activity.

Audit tools include but are not limited to vendor-provided and open-source
audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators.

It is not uncommon for attackers to replace the audit tools or inject code
into the existing tools to provide the capability to hide or erase system
activity from the audit logs.

To address this risk, audit tools must be cryptographically signed to
provide the capability to identify when the audit tools have been modified,
manipulated, or replaced. An example is a checksum hash of the file or
files.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_check_audit_tools" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi










if grep -i -E '^.*(/usr)?/sbin/auditctl.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/auditctl.*#/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/auditd.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/auditd.*#/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/ausearch.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/ausearch.*#/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/aureport.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/aureport.*#/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/autrace.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/autrace.*#/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/augenrules.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/augenrules.*#/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

if grep -i -E '^.*(/usr)?/sbin/audispd.*$' /etc/aide.conf; then
sed -i -r "s#.*(/usr)?/sbin/audispd.*#/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512#" /etc/aide.conf
else
echo "/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" &gt;&gt; /etc/aide.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_check_audit_tools" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  ansible.builtin.package_facts:
    manager: auto
  when: '"kernel" in ansible_facts.packages'

- name: Ensure aide is installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - aide
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to Verify the Audit Tools - Gather the package facts
  ansible.builtin.package_facts:
    manager: auto
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set audit_tools fact
  ansible.builtin.set_fact:
    audit_tools:
    - /usr/sbin/audispd
    - /usr/sbin/auditctl
    - /usr/sbin/auditd
    - /usr/sbin/augenrules
    - /usr/sbin/aureport
    - /usr/sbin/ausearch
    - /usr/sbin/autrace
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure existing AIDE configuration for audit tools are correct
  ansible.builtin.lineinfile:
    path: /etc/aide.conf
    regexp: ^{{ item }}\s
    line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
    create: true
  with_items: '{{ audit_tools }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"aide" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure AIDE to properly protect audit tools
  ansible.builtin.lineinfile:
    path: /etc/aide.conf
    line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
    create: true
  with_items: '{{ audit_tools }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"aide" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-9(3)
  - NIST-800-53-AU-9(3).1
  - aide_check_audit_tools
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-aide_check_audit_tools:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Periodic Execution of AIDE</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">05 4 * * * root /usr/sbin/aide --check</html:pre>
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">05 4 * * 0 root /usr/sbin/aide --check</html:pre>
AIDE can be executed periodically through other means; this is merely one example.
The usage of cron's special time codes, such as  <html:code xmlns:html="http://www.w3.org/1999/xhtml">@daily</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">@weekly</html:code> is acceptable.</description>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">13</reference>
              <reference href="https://www.cisecurity.org/controls/">14</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">2</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">7</reference>
              <reference href="https://www.cisecurity.org/controls/">8</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</reference>
              <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI01.06</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI02.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS04.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-11.5</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R76</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.3.2</reference>
              <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">11.5.2</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
          <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
          <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</rationale>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi


if ! rpm -q --quiet "cronie" ; then
    dnf install -y "cronie"
fi



CRON_FILE="/etc/crontab"


if ! grep -q "/usr/sbin/aide --check" "${CRON_FILE}" ; then
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; "${CRON_FILE}"
else
    sed -i '\!^.* --check.*$!d' "${CRON_FILE}"
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; "${CRON_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure AIDE is installed
  ansible.builtin.package:
    name: aide
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Install cron
  ansible.builtin.package:
    name: cronie
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Gather list of installed packages
  ansible.builtin.package_facts:
    manager: auto
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Configure Periodic Execution of AIDE
  ansible.builtin.cron:
    name: run AIDE check
    minute: 5
    hour: 4
    user: root
    job: /usr/sbin/aide --check
  register: crontab_check
  when:
  - '"kernel" in ansible_facts.packages'
  - '''cronie'' in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-7
  - NIST-800-53-SI-7(1)
  - PCI-DSS-Req-11.5
  - PCI-DSSv4-11.5.2
  - aide_periodic_cron_checking
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-content-ref name="oval:ssg-aide_periodic_cron_checking:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_crypto">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Cryptographic Policies</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux has the capability to centrally configure cryptographic polices. The command
<html:code xmlns:html="http://www.w3.org/1999/xhtml">update-crypto-policies</html:code> is used to set the policy applicable for the various
cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic
policies will be the default policy used by these backends unless the application
user configures them otherwise. When the system has been configured to use the
centralized cryptographic policies, the administrator is assured that any application
that utilizes the supported backends will follow a policy that adheres to the
configured profile.

Currently the supported backends are:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>GnuTLS library</html:li><html:li>OpenSSL library</html:li><html:li>NSS library</html:li><html:li>OpenJDK</html:li><html:li>Libkrb5</html:li><html:li>BIND</html:li><html:li>OpenSSH</html:li></html:ul>
Applications and languages which rely on any of these backends will follow the
system policies as well. Examples are apache httpd, nginx, php, and others.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_system_crypto_policy" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system-provided crypto policies</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the crypto policy for the system.</description>
            <value>DEFAULT</value>
            <value selector="default_policy">DEFAULT</value>
            <value selector="default_nosha1">DEFAULT:NO-SHA1</value>
            <value selector="fips">FIPS</value>
            <value selector="fips_ospp">FIPS:OSPP</value>
            <value selector="fips_stig">FIPS:STIG</value>
            <value selector="legacy">LEGACY</value>
            <value selector="future">FUTURE</value>
            <value selector="next">NEXT</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure System Cryptography Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system cryptography policy to use ciphers only from the <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
policy, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo update-crypto-policies --set <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
         </html:pre>
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crypto-policies/back-ends</html:code> are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</warning>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R7.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.9</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1446</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_crypto_policy" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
var_system_crypto_policy='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>'




stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Configure System Cryptography Policy - Check current crypto policy (runtime)
  ansible.builtin.command: /usr/bin/update-crypto-policies --show
  register: current_crypto_policy
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Configure System Cryptography Policy - Get mtime of /etc/crypto-policies/config
  ansible.builtin.stat:
    path: /etc/crypto-policies/config
  register: config_file_stat
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Configure System Cryptography Policy - Get mtime of /etc/crypto-policies/state/current
  ansible.builtin.stat:
    path: /etc/crypto-policies/state/current
  register: current_file_stat
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Configure System Cryptography Policy - Check existence of /etc/crypto-policies/back-ends/nss.config
  ansible.builtin.stat:
    path: /etc/crypto-policies/back-ends/nss.config
  register: nss_config_stat
  changed_when: false
  failed_when: false
  check_mode: false
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Configure System Cryptography Policy - Verify that Crypto Policy is Set (runtime)
  ansible.builtin.command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy
    }}
  when: (current_crypto_policy.stdout.strip() != var_system_crypto_policy) or (config_file_stat.stat.exists
    and current_file_stat.stat.exists and config_file_stat.stat.mtime &gt; current_file_stat.stat.mtime)
    or (not nss_config_stat.stat.exists)
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-12(2)
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SC-13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_crypto_policy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SSH to use System Crypto Policy</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">CRYPTO_POLICY</html:code> variable is either commented or not set at all
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/sshd</html:code>.</description>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R7.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSH_EXT.1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHS_EXT.1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_SSHC_EXT.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.14</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SSH_CONF="/etc/sysconfig/sshd"

sed -i "/^\s*CRYPTO_POLICY.*$/Id" $SSH_CONF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_ssh_crypto_policy
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Configure SSH to use System Crypto Policy
  ansible.builtin.lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: (?i)^\s*CRYPTO_POLICY.*$
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(2)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-MA-4(6)
  - NIST-800-53-SC-13
  - PCI-DSS-Req-2.2
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.7
  - configure_ssh_crypto_policy
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disk_partitioning">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disk Partitioning</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">swap</html:code>.
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>If starting with any of the default layouts, check the box to
\"Review and modify partitioning.\" This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <html:code>/</html:code>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</html:li><html:li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</html:li></html:ul>
If a system has already been installed, and the default
partitioning
scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.</description>
        <platform idref="#not_bootc_and_not_container"/>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_dev_shm" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /dev/shm is configured</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> is a traditional shared memory concept.
One program will create a memory portion, which other processes
(if permitted) can access. If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> is not configured,
tmpfs will be mounted to /dev/shm by systemd.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule does not have a remediation.
It is expected that this will be managed by systemd and will be a tmpfs partition.</warning>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.8.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any user can upload and execute files inside the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> similar to
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> partition. Configuring <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> allows an administrator
to set the noexec option on the mount, making /dev/shm useless for an attacker to
install executable code. It would also prevent an attacker from establishing a
hardlink to a system setuid program and wait for it to be updated. Once the program
was updated, the hardlink would be broken and the attacker would have his own copy
of the program. If the program happened to have a security vulnerability, the attacker
could continue to exploit the known flaw.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_dev_shm:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_dev_shm_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /home Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If user home directories will be stored locally, create a separate partition
for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> at installation time (or migrate it later using LVM). If
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> will be mounted from another system such as an NFS server, then
creating a separate partition is not necessary at installation time, and the
mountpoint can instead be configured later.</description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.7.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code> is mounted on its own partition enables the
setting of more restrictive mount options, and also helps ensure that
users cannot trivially fill partitions used for log or audit data storage.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_home" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /home
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_home:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_home_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /tmp Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.2.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_tmp" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_tmp:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_tmp_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory is used by daemons and other system
services to store frequently-changing data. Ensure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> has its own partition
or logical volume at installation time, or migrate it using LVM.</description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.3.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> is mounted on its own partition enables the
setting of more restrictive mount options. This helps protect
system services such as daemons or other programs which use it.
It is not uncommon for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> directory to contain
world-writable directories installed by other software packages.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var/log Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> directory.

Ensure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.5.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> in its own partition
enables better separation between log files
and other files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/</html:code>.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var_log" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_log_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var/log/audit Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit logs are stored in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> directory.

Ensure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> has its own partition or logical
volume at installation time, or migrate it using LVM.
Make absolutely certain that it is large enough to store all
audit logs that will be created by the auditing daemon.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000357-CTR-000800</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.6.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> in its own partition
enables better separation between audit files
and other files, and helps ensure that
auditing cannot be halted due to the partition running out
of space.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var_log_audit" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_log_audit:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure /var/tmp Located On Separate Partition</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> directory is a world-writable directory used
for temporary file storage. Ensure it has its own partition or
logical volume at installation time, or migrate it using LVM.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.4.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> partition is used as temporary storage by many programs.
Placing <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> in its own partition enables the setting of more
restrictive mount options, which can help protect programs which use it.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="partition_for_var_tmp" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/tmp
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-partition_for_var_tmp:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-partition_for_var_tmp_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_sudo">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sudo</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code>, which stands for "su 'do'", provides the ability to delegate authority
to certain users, groups of users, or system administrators. When configured for system
users and/or groups, <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> can allow a user or group to execute privileged commands
that normally only <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> is allowed to execute.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For more information on <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> and addition <html:code xmlns:html="http://www.w3.org/1999/xhtml">Sudo</html:code> configuration options, see
<html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://www.sudo.ws">https://www.sudo.ws</html:a></html:b>.</description>
        <platform idref="#system_with_kernel"/>
        <Value id="xccdf_org.ssgproject.content_value_var_sudo_logfile" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sudo - logfile value</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the sudo logfile to use. The default value used here matches the example
location from CIS, which uses /var/log/sudo.log.</description>
          <value>/var/log/sudo.log</value>
          <value selector="var_log_sudo_log">/var/log/sudo.log</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sudo - timestamp_timeout value</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Defines the number of minutes that can elapse before <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> will ask for a passwd again.
If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always prompt for a 
password. The default timeout value is 5 minutes.</description>
          <value>5</value>
          <value selector="always_prompt">0</value>
          <value selector="1_minute">1</value>
          <value selector="2_minutes">2</value>
          <value selector="3_minutes">3</value>
          <value selector="5_minutes">5</value>
          <value selector="15_minutes">15</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_package_sudo_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install sudo Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install sudo</html:pre>
       </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000324-GPOS-00125</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.1</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1386</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_sudo

class install_sudo {
  package { 'sudo':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "sudo" ; then
    dnf install -y "sudo"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "sudo"
version = "*"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=sudo
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_sudo_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sudo_installed

- name: Ensure sudo is installed
  ansible.builtin.package:
    name: sudo
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_sudo_installed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_sudo_installed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_sudo_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">use_pty</html:code> tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the <html:code xmlns:html="http://www.w3.org/1999/xhtml">use_pty</html:code> tag exists in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.</description>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R39</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing.</rationale>
          <platform idref="#package_sudo"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_use_pty" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q sudo; }; then

if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults\b[^!\n]*\buse_pty.*$' /etc/sudoers; then
        # sudoers file doesn't define Option use_pty
        echo "Defaults use_pty" &gt;&gt; /etc/sudoers
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_add_use_pty" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_use_pty

- name: Ensure use_pty is enabled in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\buse_pty\b.*$
    line: Defaults use_pty
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_add_use_pty
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_add_use_pty:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Sudo Logfile Exists - sudo logfile</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A custom log sudo file can be configured with the 'logfile' tag. This rule configures
a sudo custom logfile at the default location suggested by CIS, which uses
/var/log/sudo.log.</description>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A sudo log file simplifies auditing of sudo commands.</rationale>
          <platform idref="#package_sudo"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_custom_logfile" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q sudo; }; then

var_sudo_logfile='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>'


if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults\b[^!\n]*\blogfile\s*=\s*(?:"?([^",\s]+)"?).*$' /etc/sudoers; then
        # sudoers file doesn't define Option logfile
        echo "Defaults logfile=${var_sudo_logfile}" &gt;&gt; /etc/sudoers
    else
        # sudoers file defines Option logfile, remediate if appropriate value is not set
        if ! grep -P "^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$" /etc/sudoers; then
            
            escaped_variable=${var_sudo_logfile//$'/'/$'\/'}
            sed -Ei "s/(^[\s]*Defaults.*\blogfile=)[-]?.+(\b.*$)/\1$escaped_variable\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_custom_logfile" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile
- name: XCCDF Value var_sudo_logfile # promote to variable
  set_fact:
    var_sudo_logfile: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_logfile" use="legacy"/>
  tags:
    - always

- name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?.+\b(.*)$
    line: Defaults \1logfile={{ var_sudo_logfile }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_logfile_option
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile

- name: Enable logfile option with appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    line: Defaults logfile={{ var_sudo_logfile }}
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  - edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed
  tags:
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_custom_logfile
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sudo_logfile:var:1" value-id="xccdf_org.ssgproject.content_value_var_sudo_logfile"/>
            <check-content-ref name="oval:ssg-sudo_custom_logfile:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Require Re-Authentication When Using the sudo Command</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The sudo <html:code xmlns:html="http://www.w3.org/1999/xhtml">timestamp_timeout</html:code> tag sets the amount of time sudo password prompt waits.
The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">timestamp_timeout</html:code> value is 5 minutes.
The timestamp_timeout should be configured by making sure that the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">timestamp_timeout</html:code> tag exists in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers</html:code> configuration file or any sudo configuration snippets
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sudoers.d/</html:code>.
If the value is set to an integer less than 0, the user's time stamp will not expire
and the user will not have to re-authenticate for privileged actions until the user's session is terminated.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-11</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00156</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00157</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000373-GPOS-00158</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.4</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.5</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
When operating systems provide the capability to escalate a functional capability, it
is critical that the user re-authenticate.</rationale>
          <platform idref="#package_sudo"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_require_reauthentication" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q sudo; }; then

var_sudo_timestamp_timeout='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" use="legacy"/>'


if grep -Px '^[\s]*Defaults.*timestamp_timeout[\s]*=.*' /etc/sudoers.d/*; then
    find /etc/sudoers.d/ -type f -exec sed -Ei "/^[[:blank:]]*Defaults.*timestamp_timeout[[:blank:]]*=.*/d" {} \;
fi

if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults.*timestamp_timeout[\s]*=[\s]*[-]?\w+.*$' /etc/sudoers; then
        # sudoers file doesn't define Option timestamp_timeout
        echo "Defaults timestamp_timeout=${var_sudo_timestamp_timeout}" &gt;&gt; /etc/sudoers
    else
        # sudoers file defines Option timestamp_timeout, remediate wrong values if present
        if grep -qP "^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!${var_sudo_timestamp_timeout}\b)[-]?\w+\b.*$" /etc/sudoers; then
            sed -Ei "s/(^[[:blank:]]*Defaults.*timestamp_timeout[[:blank:]]*=)[[:blank:]]*[-]?\w+(.*$)/\1${var_sudo_timestamp_timeout}\2/" /etc/sudoers
        fi
    fi
    
    # Check validity of sudoers and cleanup bak
    if /usr/sbin/visudo -qcf /etc/sudoers; then
        rm -f /etc/sudoers.bak
    else
        echo "Fail to validate remediated /etc/sudoers, reverting to original file."
        mv /etc/sudoers.bak /etc/sudoers
        false
    fi
else
    echo "Skipping remediation, /etc/sudoers failed to validate"
    false
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sudo_require_reauthentication" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication
- name: XCCDF Value var_sudo_timestamp_timeout # promote to variable
  set_fact:
    var_sudo_timestamp_timeout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" use="legacy"/>
  tags:
    - always

- name: Require Re-Authentication When Using the sudo Command - Find /etc/sudoers.d/*
    files containing 'Defaults timestamp_timeout'
  ansible.builtin.find:
    path: /etc/sudoers.d
    patterns: '*'
    contains: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
  register: sudoers_d_defaults_timestamp_timeout
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Remove 'Defaults timestamp_timeout'
    from /etc/sudoers.d/* files
  ansible.builtin.lineinfile:
    path: '{{ item.path }}'
    regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
    state: absent
  with_items: '{{ sudoers_d_defaults_timestamp_timeout.files }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Ensure timestamp_timeout
    has the appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s(.*)\btimestamp_timeout[\s]*=[\s]*[-]?\w+\b(.*)$
    line: Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2
    validate: /usr/sbin/visudo -cf %s
    backrefs: true
  register: edit_sudoers_timestamp_timeout_option
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Enable timestamp_timeout
    option with correct value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    line: Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  - |
    edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication

- name: Require Re-Authentication When Using the sudo Command - Remove timestamp_timeout
    wrong values in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!{{ var_sudo_timestamp_timeout
      }}\b)[-]?\w+\b.*$
    state: absent
    validate: /usr/sbin/visudo -cf %s
  when:
  - '"kernel" in ansible_facts.packages'
  - '"sudo" in ansible_facts.packages'
  tags:
  - NIST-800-53-IA-11
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sudo_require_reauthentication
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sudo_require_reauthentication:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sudo_require_reauthentication_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_updating">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Updating Software</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <html:b xmlns:html="http://www.w3.org/1999/xhtml">System</html:b> menu, in the <html:b xmlns:html="http://www.w3.org/1999/xhtml">Administration</html:b> submenu,
called <html:b xmlns:html="http://www.w3.org/1999/xhtml">Software Update</html:b>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Amazon Linux 2023 systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<html:code xmlns:html="http://www.w3.org/1999/xhtml">dnf</html:code> or the graphical <html:b xmlns:html="http://www.w3.org/1999/xhtml">Software Update</html:b> for all software installation
allows for insight into the current inventory of installed software on the system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure gpgcheck Enabled In Main dnf Configuration</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">gpgcheck</html:code> option controls whether
RPM packages' signatures are always checked prior to installation.
To configure dnf to check package signatures before installing
them, ensure the following line appears in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/dnf/dnf.conf</html:code> in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[main]</html:code> section:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">gpgcheck=1</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI06.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-6.2</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R59</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.2.2</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1493</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">6.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by the
organization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>Verifying the authenticity of the software prior to installation
validates the integrity of the patch or upgrade received from a vendor.
This ensures the software has not been tampered with and that it has been
provided by a trusted vendor. Self-signed certificates are disallowed by
this requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA).</rationale>
          <platform idref="#package_dnf"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q dnf; then

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\&gt;" "/etc/dnf/dnf.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^gpgcheck\\&gt;.*/$escaped_formatted_output/gi" "/etc/dnf/dnf.conf"
else
    if [[ -s "/etc/dnf/dnf.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/dnf/dnf.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/dnf/dnf.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/dnf/dnf.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - configure_strategy
  - ensure_gpgcheck_globally_activated
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed

- name: Ensure GPG check is globally activated
  community.general.ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when: '"dnf" in ansible_facts.packages'
  tags:
  - CJIS-5.10.4.1
  - NIST-800-171-3.4.8
  - NIST-800-53-CM-11(a)
  - NIST-800-53-CM-11(b)
  - NIST-800-53-CM-5(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SA-12
  - NIST-800-53-SA-12(10)
  - NIST-800-53-SC-12
  - NIST-800-53-SC-12(3)
  - NIST-800-53-SI-7
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-6.3
  - PCI-DSSv4-6.3.3
  - configure_strategy
  - ensure_gpgcheck_globally_activated
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_accounts">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account and Access Control</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Amazon Linux 2023.</description>
      <Group id="xccdf_org.ssgproject.content_group_accounts-banners">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Warning Banners for System Accesses</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Each system should expose as little information about
itself as possible.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</description>
        <Value id="xccdf_org.ssgproject.content_value_login_banner_text" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Login Banner Verbiage</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</description>
          <value selector="cis_banners">^(Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</value>
          <value selector="cis_default">^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
          <value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</value>
          <value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</value>
          <value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</value>
          <value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</value>
          <value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</value>
          <value>^Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_motd_banner_text" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">MotD Banner Verbiage</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</description>
          <value selector="cis_banners">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</value>
          <value selector="cis_default">^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
          <value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</value>
          <value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</value>
          <value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</value>
          <value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</value>
          <value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</value>
          <value>^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_remote_login_banner_text" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote Login Banner Verbiage</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</description>
          <value selector="cis_banners">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</value>
          <value selector="cis_default">^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
          <value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</value>
          <value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\),[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to,[\s\n]+penetration[\s\n]+testing,[\s\n]+COMSEC[\s\n]+monitoring,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\),[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\),[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring,[\s\n]+interception,[\s\n]+and[\s\n]+search,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications,[\s\n]+or[\s\n]+work[\s\n]+product,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys,[\s\n]+psychotherapists,[\s\n]+or[\s\n]+clergy,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</value>
          <value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</value>
          <value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication,[\s\n]+transmission,[\s\n]+processing,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</value>
          <value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</value>
          <value>^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Modify the System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system login banner edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.


The DoD required text is either:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
OR:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">I've read &amp; consent to terms in IS user agreem't.</html:code>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

login_banner_text='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>'

# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
login_banner_text=$(echo "$login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
login_banner_text=$(echo "$login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
login_banner_text=$(echo "$login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
login_banner_text=$(echo "$login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
login_banner_text=$(echo "$login_banner_text" | sed 's/\\//g')
formatted=$(echo "$login_banner_text" | fold -sw 80)
cat &lt;&lt;EOF &gt;/etc/issue
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - banner_etc_issue
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value login_banner_text # promote to variable
  set_fact:
    login_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner - Ensure Correct Banner
  ansible.builtin.copy:
    dest: /etc/issue
    content: '{{ login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - banner_etc_issue
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_login_banner_text"/>
            <check-content-ref name="oval:ssg-banner_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-banner_etc_issue_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_banner_etc_issue_net" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Modify the System Login Banner for Remote Connections</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system login banner edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue.net</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
OR:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">I've read &amp; consent to terms in IS user agreem't.</html:code>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue_net" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

remote_login_banner_text='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
remote_login_banner_text=$(echo "$remote_login_banner_text" | sed 's/\\//g')
formatted=$(echo "$remote_login_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/issue.net
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_issue_net" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - banner_etc_issue_net
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value remote_login_banner_text # promote to variable
  set_fact:
    remote_login_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_remote_login_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Login Banner for Remote Connections - ensure correct banner
  ansible.builtin.copy:
    dest: /etc/issue.net
    content: '{{ remote_login_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - banner_etc_issue_net
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-remote_login_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_remote_login_banner_text"/>
            <check-content-ref name="oval:ssg-banner_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-banner_etc_issue_net_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_banner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Modify the System Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the system message banner edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>. Replace the
default text with a message compliant with the local site policy or a legal
disclaimer.

The DoD required text is either:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">You are accessing a U.S. Government (USG) Information System (IS) that
is provided for USG-authorized use only. By using this IS (which includes
any device attached to this IS), you consent to the following conditions:
<html:br/>-The USG routinely intercepts and monitors communications on this IS
for purposes including, but not limited to, penetration testing, COMSEC
monitoring, network operations and defense, personnel misconduct (PM), law
enforcement (LE), and counterintelligence (CI) investigations.
<html:br/>-At any time, the USG may inspect and seize data stored on this IS.
<html:br/>-Communications using, or data stored on, this IS are not private,
are subject to routine monitoring, interception, and search, and may be
disclosed or used for any USG-authorized purpose.
<html:br/>-This IS includes security measures (e.g., authentication and access
controls) to protect USG interests -- not for your personal benefit or
privacy.
<html:br/>-Notwithstanding the above, using this IS does not constitute consent
to PM, LE or CI investigative searching or monitoring of the content of
privileged communications, or work product, related to personal
representation or services by attorneys, psychotherapists, or clergy, and
their assistants. Such communications and work product are private and
confidential. See User Agreement for details.</html:code>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
OR:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:code xmlns:html="http://www.w3.org/1999/xhtml">I've read &amp; consent to terms in IS user agreem't.</html:code>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System use notifications are required only for access via login interfaces
with human users and are not required when such human interfaces do not
exist.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_motd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

motd_banner_text='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_motd_banner_text" use="legacy"/>'


# Multiple regexes transform the banner regex into a usable banner
# 0 - Remove anchors around the banner text
motd_banner_text=$(echo "$motd_banner_text" | sed 's/^\^\(.*\)\$$/\1/g')
# 1 - Keep only the first banners if there are multiple
#    (dod_banners contains the long and short banner)
motd_banner_text=$(echo "$motd_banner_text" | sed 's/^(\(.*\.\)|.*)$/\1/g')
# 2 - Add spaces ' '. (Transforms regex for "space or newline" into a " ")
motd_banner_text=$(echo "$motd_banner_text" | sed 's/\[\\s\\n\]+/ /g')
# 3 - Adds newlines. (Transforms "(?:\[\\n\]+|(?:\\n)+)" into "\n")
motd_banner_text=$(echo "$motd_banner_text" | sed 's/(?:\[\\n\]+|(?:\\\\n)+)/\n/g')
# 4 - Remove any leftover backslash. (From any parenthesis in the banner, for example).
motd_banner_text=$(echo "$motd_banner_text" | sed 's/\\//g')
formatted=$(echo "$motd_banner_text" | fold -sw 80)

cat &lt;&lt;EOF &gt;/etc/motd
$formatted
EOF

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="banner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - banner_etc_motd
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
- name: XCCDF Value motd_banner_text # promote to variable
  set_fact:
    motd_banner_text: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_motd_banner_text" use="legacy"/>
  tags:
    - always

- name: Modify the System Message of the Day Banner - ensure correct banner
  ansible.builtin.copy:
    dest: /etc/motd
    content: '{{ motd_banner_text | regex_replace("^\^(.*)\$$", "\1") | regex_replace("^\((.*\.)\|.*\)$",
      "\1") | regex_replace("\[\\s\\n\]\+"," ") | regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)",
      "\n") | regex_replace("\\", "") | wordwrap() }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - banner_etc_motd
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - unknown_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-motd_banner_text:var:1" value-id="xccdf_org.ssgproject.content_value_motd_banner_text"/>
            <check-content-ref name="oval:ssg-banner_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-banner_etc_motd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership of System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/issue</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper group ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/issue" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/issue
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_issue_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_issue_newgroup: '0'
  tags:
  - configure_strategy
  - file_groupowner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/issue
  ansible.builtin.stat:
    path: /etc/issue
  register: file_exists
  tags:
  - configure_strategy
  - file_groupowner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/issue
  ansible.builtin.file:
    path: /etc/issue
    follow: false
    group: '{{ file_groupowner_etc_issue_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_etc_issue_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership of System Login Banner for Remote Connections</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue.net</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/issue.net</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper group ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue_net" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/issue.net" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/issue.net
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_issue_net" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_issue_net_newgroup variable if represented by
    gid
  ansible.builtin.set_fact:
    file_groupowner_etc_issue_net_newgroup: '0'
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_groupowner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/issue.net
  ansible.builtin.stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_groupowner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/issue.net
  ansible.builtin.file:
    path: /etc/issue.net
    follow: false
    group: '{{ file_groupowner_etc_issue_net_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_groupowner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_etc_issue_net_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership of Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/motd</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper group ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/motd" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/motd
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_motd_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_motd_newgroup: '0'
  tags:
  - configure_strategy
  - file_groupowner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/motd
  ansible.builtin.stat:
    path: /etc/motd
  register: file_exists
  tags:
  - configure_strategy
  - file_groupowner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/motd
  ansible.builtin.file:
    path: /etc/motd
    follow: false
    group: '{{ file_groupowner_etc_motd_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupowner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_etc_motd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ownership of System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/issue </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/issue" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/issue
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_issue_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_issue_newown: '0'
  tags:
  - configure_strategy
  - file_owner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/issue
  ansible.builtin.stat:
    path: /etc/issue
  register: file_exists
  tags:
  - configure_strategy
  - file_owner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/issue
  ansible.builtin.file:
    path: /etc/issue
    follow: false
    owner: '{{ file_owner_etc_issue_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ownership of System Login Banner for Remote Connections</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue.net</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/issue.net </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue_net" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/issue.net" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/issue.net
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_issue_net" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_issue_net_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_issue_net_newown: '0'
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_owner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/issue.net
  ansible.builtin.stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_owner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/issue.net
  ansible.builtin.file:
    path: /etc/issue.net
    follow: false
    owner: '{{ file_owner_etc_issue_net_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_owner_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_etc_issue_net_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify ownership of Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/motd </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper ownership will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/motd" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/motd
fi

fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_motd_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_motd_newown: '0'
  tags:
  - configure_strategy
  - file_owner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/motd
  ansible.builtin.stat:
    path: /etc/motd
  register: file_exists
  tags:
  - configure_strategy
  - file_owner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/motd
  ansible.builtin.file:
    path: /etc/motd
    follow: false
    owner: '{{ file_owner_etc_motd_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_owner_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_etc_motd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify permissions on System Login Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/issue</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper permissions will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/issue
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/issue
  ansible.builtin.stat:
    path: /etc/issue
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/issue
  ansible.builtin.file:
    path: /etc/issue
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_issue
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_etc_issue_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify permissions on System Login Banner for Remote Connections</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/issue.net</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/issue.net</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper permissions will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue_net" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/issue.net
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_issue_net" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/issue.net
  ansible.builtin.stat:
    path: /etc/issue.net
  register: file_exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_permissions_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/issue.net
  ansible.builtin.file:
    path: /etc/issue.net
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.8
  - configure_strategy
  - file_permissions_etc_issue_net
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_etc_issue_net_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify permissions on Message of the Day Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/motd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/motd</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.7.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Proper permissions will ensure that only root user can modify the banner.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_motd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/motd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_motd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/motd
  ansible.builtin.stat:
    path: /etc/motd
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/motd
  ansible.builtin.file:
    path: /etc/motd
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_etc_motd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_etc_motd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-pam">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Accounts by Configuring PAM</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
PAM looks in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d</html:code> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/login</html:code>
to determine what actions should be taken.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
One very important file in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d</html:code> is
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Be careful when making changes to PAM's configuration files.
The syntax for these files is complex, and modifications can
have unexpected consequences. The default configurations shipped
with applications should be sufficient for most users.</warning>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Running <html:code xmlns:html="http://www.w3.org/1999/xhtml">authconfig</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">system-config-authentication</html:code>
will re-write the PAM configuration files, destroying any manually
made changes and replacing them with a series of system defaults.
One reference to the configuration file syntax can be found at

<html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://fossies.org/linux/Linux-PAM-docs/doc/sag/Linux-PAM_SAG.pdf">https://fossies.org/linux/Linux-PAM-docs/doc/sag/Linux-PAM_SAG.pdf</html:a>.</warning>
        <Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password Hashing algorithm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the system default encryption algorithm for encrypting passwords.
Defines the value set as ENCRYPT_METHOD in /etc/login.defs.</description>
          <value>SHA512</value>
          <value selector="SHA512">SHA512</value>
          <value selector="SHA256">SHA256</value>
          <value selector="yescrypt">YESCRYPT</value>
          <value selector="cis_ubuntu2204">SHA512|YESCRYPT</value>
          <value selector="cis_ubuntu2404">SHA512|YESCRYPT</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Password Hashing algorithm for pam_unix.so</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the system default encryption algorithm for encrypting passwords.
Defines the hashing algorithm to be used in pam_unix.so.</description>
          <value>sha512</value>
          <value selector="sha512">sha512</value>
          <value selector="yescrypt">yescrypt</value>
        </Value>
        <Group id="xccdf_org.ssgproject.content_group_locking_out_password_attempts">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Lockouts for Failed Password Attempts</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock</html:code> PAM module provides the capability to
lock out user accounts after a number of failed login attempts. Its
documentation is available in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/pam-VERSION/txts/README.pam_faillock</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</warning>
          <platform idref="#system_with_kernel"/>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fail_deny</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Number of failed login attempts before account lockout</description>
            <value selector="10">10</value>
            <value selector="3">3</value>
            <value selector="4">4</value>
            <value selector="5">5</value>
            <value selector="6">6</value>
            <value selector="8">8</value>
            <value>3</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">faillock directory</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The directory where the user files with the failure records are kept</description>
            <value selector="ol8">/var/log/faillock</value>
            <value>/var/log/faillock</value>
            <value selector="run">/var/run/faillock</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">fail_unlock_time</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Seconds before automatic unlocking or permanently locking after excessive failed logins</description>
            <value selector="1800">1800</value>
            <value selector="3600">3600</value>
            <value selector="600">600</value>
            <value selector="604800">604800</value>
            <value selector="86400">86400</value>
            <value selector="900">900</value>
            <value selector="300">300</value>
            <value>0</value>
            <value selector="never">0</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pwhistory_remember</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Prevent password reuse using password history lookup</description>
            <value selector="0">0</value>
            <value selector="1">1</value>
            <value selector="2">2</value>
            <value selector="3">3</value>
            <value selector="4">4</value>
            <value selector="5">5</value>
            <value selector="6">6</value>
            <value selector="7">7</value>
            <value selector="8">8</value>
            <value selector="9">9</value>
            <value selector="24">24</value>
            <value>5</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">PAM pwhistory remember - control flag</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">'Specify the control flag required for password remember requirement. If multiple
values are allowed write them separated by commas as in "required,requisite",
for remediations the first value will be taken'</description>
            <value selector="required">required</value>
            <value selector="optional">optional</value>
            <value selector="requisite">requisite</value>
            <value selector="sufficient">sufficient</value>
            <value selector="binding">binding</value>
            <value selector="ol8">required,requisite</value>
            <value selector="requisite_or_required">requisite,required</value>
            <value>requisite</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_faillock.so module must be loaded in preauth in /etc/pam.d/password-auth.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.4.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent
password guessing attacks.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_password_pam_faillock_password_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_password_pam_faillock_password_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Remediation where authselect tool is present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Informative message based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Ensure "with-faillock" feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Remediation where authselect tool is not present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Enable pam_faillock.so account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-account_password_pam_faillock_password_auth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_password_pam_faillock_password_auth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_faillock.so module must be loaded in preauth in /etc/pam.d/system-auth.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7 (a)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.4.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the pam_faillock.so module is not loaded the system will not correctly lockout accounts to prevent
password guessing attacks.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_password_pam_faillock_system_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_password_pam_faillock_system_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Check if system relies on authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Remediation where authselect tool is present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Check integrity of authselect current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Informative message based on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Ensure "with-faillock" feature is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
    File. - Remediation where authselect tool is not present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Check if pam_faillock.so is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so preauth editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so authfail editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Enable pam_faillock.so account section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_system_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-account_password_pam_faillock_system_auth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_password_pam_faillock_system_auth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Password Reuse: password-auth</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">remember</html:code> option for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> PAM module.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

On systems with newer versions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code>, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> PAM module
can be enabled via authselect feature:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">authselect enable-feature with-pwhistory</html:pre>

Otherwise, it should be enabled using an authselect custom profile.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Newer systems also have the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwhistory.conf</html:code> file for setting
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> module options. This file should be used whenever available.
Otherwise, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> module options can be set in PAM files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The value for <html:code xmlns:html="http://www.w3.org/1999/xhtml">remember</html:code> option must be equal or greater than
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the system relies on <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Newer versions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> contain an authselect feature to easily and properly
enable <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory.so</html:code> module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.
If a custom profile was created and used in the system before this authselect feature was
available, the new feature can't be used with this custom profile and the
remediation will fail. In this case, the custom profile should be recreated or manually
updated.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Preventing reuse of previous passwords helps ensure that a compromised password is not
reused by a user.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_pwhistory_remember_password_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_password_pam_remember='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"

if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-pwhistory; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect enable-feature with-pwhistory

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        
        if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "$PAM_FILE_PATH"
                else
                    echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
    fi
else

    
    if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "/etc/pam.d/password-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "/etc/pam.d/password-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "/etc/pam.d/password-auth"
        else
            LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "/etc/pam.d/password-auth" | tail -n 1 | cut -d: -f 1)
            if [ ! -z $LAST_MATCH_LINE ]; then
                sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "/etc/pam.d/password-auth"
            else
                echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "/etc/pam.d/password-auth"
            fi
        fi
    fi

fi

PWHISTORY_CONF="/etc/security/pwhistory.conf"
if [ -f $PWHISTORY_CONF ]; then
    regex="^\s*remember\s*="
    line="remember = $var_password_pam_remember"
    if ! grep -q $regex $PWHISTORY_CONF; then
        echo $line &gt;&gt; $PWHISTORY_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(remember\s*=\s*\)\(\S\+\)|\1'"$var_password_pam_remember"'|g' $PWHISTORY_CONF
    fi
    if [ -e "/etc/pam.d/password-auth" ] ; then
        PAM_FILE_PATH="/etc/pam.d/password-auth"
        if [ -f /usr/bin/authselect ]; then
            
            if ! authselect check; then
            echo "
            authselect integrity check failed. Remediation aborted!
            This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
            It is not recommended to manually edit the PAM files when authselect tool is available.
            In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
            exit 1
            fi

            CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
            # If not already in use, a custom profile is created preserving the enabled features.
            if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                # The "local" profile does not contain essential security features required by multiple Benchmarks.
                # If currently used, it is replaced by "sssd", which is the best option in this case.
                if [[ $CURRENT_PROFILE == local ]]; then
                    CURRENT_PROFILE="sssd"
                fi
                authselect create-profile hardening -b $CURRENT_PROFILE
                CURRENT_PROFILE="custom/hardening"
                
                authselect apply-changes -b --backup=before-hardening-custom-profile
                authselect select $CURRENT_PROFILE
                for feature in $ENABLED_FEATURES; do
                    authselect enable-feature $feature;
                done
                
                authselect apply-changes -b --backup=after-hardening-custom-profile
            fi
            PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
            PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

            authselect apply-changes -b
        fi
        
    if grep -qP "^\s*password\s.*\bpam_pwhistory.so\s.*\bremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "s/(.*password.*pam_pwhistory.so.*)\bremember\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
    fi
        if [ -f /usr/bin/authselect ]; then
            
            authselect apply-changes -b
        fi
    else
        echo "/etc/pam.d/password-auth was not found" &gt;&amp;2
    fi
else
    PAM_FILE_PATH="/etc/pam.d/password-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/password-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
    else
        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
    fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_pwhistory_remember_password_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
    tool'
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Collect the available authselect features'
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  check_mode: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so using authselect
    feature'
  block:

  - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
      profile'
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: 'Limit Password Reuse: password-auth - Informative message based on the
      authselect integrity check result'
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: 'Limit Password Reuse: password-auth - Get authselect current features'
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: 'Limit Password Reuse: password-auth - Ensure "with-pwhistory" feature is
      enabled using authselect tool'
    ansible.builtin.command:
      cmd: authselect enable-feature with-pwhistory
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-pwhistory")

  - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-pwhistory")
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so in appropriate
    PAM files'
  block:

  - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
      as a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
      is used if authselect is present'
    block:

    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: 'Limit Password Reuse: password-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Get authselect current features
        to also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Restore the authselect features
        in the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0]
        }}'

  - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: password-auth - Include or update the PAM module
      line in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: password-auth - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module
        line is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^password.*requisite.*pam_pwquality\.so
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - |
    (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - Check the presence of /etc/security/pwhistory.conf
    file'
  ansible.builtin.stat:
    path: /etc/security/pwhistory.conf
  register: result_pwhistory_conf_check
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured
    in /etc/security/pwhistory.conf file'
  block:

  - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember
      parameter in /etc/security/pwhistory.conf'
    ansible.builtin.lineinfile:
      path: /etc/security/pwhistory.conf
      regexp: ^\s*remember\s*=
      line: remember = {{ var_password_pam_remember }}
      state: present

  - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember
      parameter is removed from PAM files'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if /etc/pam.d/password-auth
        file is present'
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_file_present

    - name: 'Limit Password Reuse: password-auth - Check the proper remediation for
        the system'
      block:

      - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
          as a local fact'
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
          tool'
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
          is used if authselect is present'
        block:

        - name: 'Limit Password Reuse: password-auth - Check integrity of authselect
            current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: 'Limit Password Reuse: password-auth - Informative message based on
            the authselect integrity check result'
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: password-auth - Define the current authselect
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match("custom/")

        - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Get authselect current features
            to also enable them in the custom profile'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Check if any custom profile
            with the same name was already created'
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
            profile based on the current profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match("^(custom/|local)")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
            profile based on sssd profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match("local")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom
            profile is selected'
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: password-auth - Restore the authselect features
            in the custom profile'
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
            according to the custom authselect profile'
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: 'Limit Password Reuse: password-auth - Define a fact for control already
          filtered in case filters are used'
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: 'Limit Password Reuse: password-auth - Check if {{ pam_file_path }}
          file is present'
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: 'Limit Password Reuse: password-auth - Ensure the "remember" option
          from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when: result_pam_file_present.stat.exists

      - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
          applied'
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_file_present.stat.exists
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured
    in PAM files'
  block:

  - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited
      as a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile
      is used if authselect is present'
    block:

    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: 'Limit Password Reuse: password-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Get authselect current features
        to also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: password-auth - Restore the authselect features
        in the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: password-auth - Include or update the PAM module
      line in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: password-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: password-auth - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module
        line is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: 'Limit Password Reuse: password-auth - Define a fact for control already
      filtered in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: password-auth - Check if the required PAM module
      option is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present

  - name: 'Limit Password Reuse: password-auth - Ensure the "remember" PAM option
      for "pam_pwhistory.so" is included in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
      line: \1 remember={{ var_password_pam_remember }}
      state: present
    register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_add
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found
      is defined
    - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found
      == 0

  - name: 'Limit Password Reuse: password-auth - Ensure the required value for "remember"
      PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]*\s*(.*)
      line: \1\2={{ var_password_pam_remember }} \3
    register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_edit
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found
      &gt; 0

  - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - (result_pam_remember_add is defined and result_pam_remember_add.changed) or
      (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_password_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
              <check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Password Reuse: system-auth</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Do not allow users to reuse recent passwords. This can be accomplished by using the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">remember</html:code> option for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> PAM module.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>

On systems with newer versions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code>, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> PAM module
can be enabled via authselect feature:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">authselect enable-feature with-pwhistory</html:pre>

Otherwise, it should be enabled using an authselect custom profile.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Newer systems also have the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwhistory.conf</html:code> file for setting
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> module options. This file should be used whenever available.
Otherwise, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory</html:code> module options can be set in PAM files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The value for <html:code xmlns:html="http://www.w3.org/1999/xhtml">remember</html:code> option must be equal or greater than
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the system relies on <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Newer versions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> contain an authselect feature to easily and properly
enable <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwhistory.so</html:code> module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Preventing reuse of previous passwords helps ensure that a compromised password is not
reused by a user.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_pwhistory_remember_system_auth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_password_pam_remember='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>'
var_password_pam_remember_control_flag='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>'


var_password_pam_remember_control_flag="$(echo $var_password_pam_remember_control_flag | cut -d \, -f 1)"

if [ -f /usr/bin/authselect ]; then
    if authselect list-features sssd | grep -q with-pwhistory; then
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi
        authselect enable-feature with-pwhistory

        authselect apply-changes -b
    else
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
        
        if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "$PAM_FILE_PATH"
                else
                    echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
    fi
else

    
    if ! grep -qP "^\s*password\s+\$var_password_pam_remember_control_flag\s+pam_pwhistory.so\s*.*" "/etc/pam.d/system-auth"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "/etc/pam.d/system-auth")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1$var_password_pam_remember_control_flag \2/" "/etc/pam.d/system-auth"
        else
            LAST_MATCH_LINE=$(grep -nP "^password.*requisite.*pam_pwquality\.so" "/etc/pam.d/system-auth" | tail -n 1 | cut -d: -f 1)
            if [ ! -z $LAST_MATCH_LINE ]; then
                sed -i --follow-symlinks $LAST_MATCH_LINE" a password     $var_password_pam_remember_control_flag    pam_pwhistory.so" "/etc/pam.d/system-auth"
            else
                echo "password    $var_password_pam_remember_control_flag    pam_pwhistory.so" &gt;&gt; "/etc/pam.d/system-auth"
            fi
        fi
    fi

fi

PWHISTORY_CONF="/etc/security/pwhistory.conf"
if [ -f $PWHISTORY_CONF ]; then
    regex="^\s*remember\s*="
    line="remember = $var_password_pam_remember"
    if ! grep -q $regex $PWHISTORY_CONF; then
        echo $line &gt;&gt; $PWHISTORY_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(remember\s*=\s*\)\(\S\+\)|\1'"$var_password_pam_remember"'|g' $PWHISTORY_CONF
    fi
    if [ -e "/etc/pam.d/system-auth" ] ; then
        PAM_FILE_PATH="/etc/pam.d/system-auth"
        if [ -f /usr/bin/authselect ]; then
            
            if ! authselect check; then
            echo "
            authselect integrity check failed. Remediation aborted!
            This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
            It is not recommended to manually edit the PAM files when authselect tool is available.
            In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
            exit 1
            fi

            CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
            # If not already in use, a custom profile is created preserving the enabled features.
            if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                # The "local" profile does not contain essential security features required by multiple Benchmarks.
                # If currently used, it is replaced by "sssd", which is the best option in this case.
                if [[ $CURRENT_PROFILE == local ]]; then
                    CURRENT_PROFILE="sssd"
                fi
                authselect create-profile hardening -b $CURRENT_PROFILE
                CURRENT_PROFILE="custom/hardening"
                
                authselect apply-changes -b --backup=before-hardening-custom-profile
                authselect select $CURRENT_PROFILE
                for feature in $ENABLED_FEATURES; do
                    authselect enable-feature $feature;
                done
                
                authselect apply-changes -b --backup=after-hardening-custom-profile
            fi
            PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
            PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

            authselect apply-changes -b
        fi
        
    if grep -qP "^\s*password\s.*\bpam_pwhistory.so\s.*\bremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "s/(.*password.*pam_pwhistory.so.*)\bremember\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
    fi
        if [ -f /usr/bin/authselect ]; then
            
            authselect apply-changes -b
        fi
    else
        echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
    fi
else
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*" "$PAM_FILE_PATH"; then
        # Line matching group + control + module was not found. Check group + module.
        if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwhistory.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
            # The control is updated only if one single line matches.
            sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwhistory.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
        else
            echo "password    requisite    pam_pwhistory.so" &gt;&gt; "$PAM_FILE_PATH"
        fi
    fi
    # Check the option
    if ! grep -qP "^\s*password\s+requisite\s+pam_pwhistory.so\s*.*\sremember\b" "$PAM_FILE_PATH"; then
        sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwhistory.so.*/ s/$/ remember=$var_password_pam_remember/" "$PAM_FILE_PATH"
    else
        sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwhistory.so\s+.*)(remember=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_remember \3/" "$PAM_FILE_PATH"
    fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_pwhistory_remember_system_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_remember # promote to variable
  set_fact:
    var_password_pam_remember: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_password_pam_remember_control_flag # promote to variable
  set_fact:
    var_password_pam_remember_control_flag: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" use="legacy"/>
  tags:
    - always

- name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
    tool'
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Collect the available authselect features'
  ansible.builtin.command:
    cmd: authselect list-features sssd
  register: result_authselect_available_features
  changed_when: false
  check_mode: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so using authselect
    feature'
  block:

  - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
      profile'
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect
      integrity check result'
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: 'Limit Password Reuse: system-auth - Get authselect current features'
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: 'Limit Password Reuse: system-auth - Ensure "with-pwhistory" feature is
      enabled using authselect tool'
    ansible.builtin.command:
      cmd: authselect enable-feature with-pwhistory
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-pwhistory")

  - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  - result_authselect_available_features.stdout is search("with-pwhistory")
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so in appropriate
    PAM files'
  block:

  - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as
      a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is
      used if authselect is present'
    block:

    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: 'Limit Password Reuse: system-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Get authselect current features to
        also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
        the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0]
        }}'

  - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is
      present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line
      in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the
        required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line
        is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        insertafter: ^password.*requisite.*pam_pwquality\.so
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - |
    (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - Check the presence of /etc/security/pwhistory.conf
    file'
  ansible.builtin.stat:
    path: /etc/security/pwhistory.conf
  register: result_pwhistory_conf_check
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured
    in /etc/security/pwhistory.conf file'
  block:

  - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember
      parameter in /etc/security/pwhistory.conf'
    ansible.builtin.lineinfile:
      path: /etc/security/pwhistory.conf
      regexp: ^\s*remember\s*=
      line: remember = {{ var_password_pam_remember }}
      state: present

  - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember
      parameter is removed from PAM files'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if /etc/pam.d/system-auth file
        is present'
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_file_present

    - name: 'Limit Password Reuse: system-auth - Check the proper remediation for
        the system'
      block:

      - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited
          as a local fact'
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
          tool'
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile
          is used if authselect is present'
        block:

        - name: 'Limit Password Reuse: system-auth - Check integrity of authselect
            current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: 'Limit Password Reuse: system-auth - Informative message based on
            the authselect integrity check result'
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: system-auth - Define the current authselect
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match("custom/")

        - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
            profile as a local fact'
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Get authselect current features
            to also enable them in the custom profile'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
            the same name was already created'
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")

        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
            based on the current profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match("^(custom/|local)")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
            based on sssd profile'
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match("local")
          - not result_authselect_custom_profile_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom
            profile is selected'
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match("custom/")
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: 'Limit Password Reuse: system-auth - Restore the authselect features
            in the custom profile'
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
            applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
            according to the custom authselect profile'
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: 'Limit Password Reuse: system-auth - Define a fact for control already
          filtered in case filters are used'
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: 'Limit Password Reuse: system-auth - Check if {{ pam_file_path }} file
          is present'
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: 'Limit Password Reuse: system-auth - Ensure the "remember" option from
          "pam_pwhistory.so" is not present in {{ pam_file_path }}'
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when: result_pam_file_present.stat.exists

      - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_file_present.stat.exists
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured
    in PAM files'
  block:

  - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as
      a local fact'
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect
      tool'
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is
      used if authselect is present'
    block:

    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current
        profile'
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: 'Limit Password Reuse: system-auth - Informative message based on the
        authselect integrity check result'
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile
        as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom
        profile as a local fact'
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Get authselect current features to
        also enable them in the custom profile'
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with
        the same name was already created'
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on the current profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
        based on sssd profile'
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
        is selected'
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
        the custom profile'
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
        according to the custom authselect profile'
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is
      present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line
      in {{ pam_file_path }}'
    block:

    - name: 'Limit Password Reuse: system-auth - Check if required PAM module line
        is present in {{ pam_file_path }} with different control'
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the
        required PAM module line in {{ pam_file_path }}'
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line
        is included in {{ pam_file_path }}'
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_pwhistory.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered
      in case filters are used'
    ansible.builtin.set_fact:
      pam_module_control: requisite

  - name: 'Limit Password Reuse: system-auth - Check if the required PAM module option
      is present in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present

  - name: 'Limit Password Reuse: system-auth - Ensure the "remember" PAM option for
      "pam_pwhistory.so" is included in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
      line: \1 remember={{ var_password_pam_remember }}
      state: present
    register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_add
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found
      is defined
    - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found
      == 0

  - name: 'Limit Password Reuse: system-auth - Ensure the required value for "remember"
      PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]*\s*(.*)
      line: \1\2={{ var_password_pam_remember }} \3
    register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_edit
    when:
    - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found
      &gt; 0

  - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - (result_pam_remember_add is defined and result_pam_remember_add.changed) or
      (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_pwhistory_conf_check.stat.exists
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-IA-5(1)(e)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.5
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.7
  - accounts_password_pam_pwhistory_remember_system_auth
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_remember_control_flag:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag"/>
              <check-export export-name="oval:ssg-var_password_pam_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_remember"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Lock Accounts After Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This rule configures the system to lock out accounts after a number of incorrect login attempts
using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected.
Ensure that the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> contains the following entry:
<html:code xmlns:html="http://www.w3.org/1999/xhtml">deny = &lt;count&gt;</html:code>
Where count should be less than or equal to
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> and greater than 0.

In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">authconfig</html:code>,
depending on the OS version.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the system relies on <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code xmlns:html="http://www.w3.org/1999/xhtml">faillock.conf</html:code> file.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.6</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_accounts_passwords_pam_faillock_deny='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*deny\s*="
    line="deny = $var_accounts_passwords_pam_faillock_deny"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(deny\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_deny"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bdeny\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bdeny\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so\s+(preauth|authfail).*deny' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ deny='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*\)\('"deny"'=\)\S\+\b\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"deny"'=\)\S\+\b\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_deny"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect
    tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is present
  block:

  - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
      current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: Lock Accounts After Failed Password Attempts - Informative message based
      on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Lock Accounts After Failed Password Attempts - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: Lock Accounts After Failed Password Attempts - Ensure "with-faillock" feature
      is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so preauth
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so authfail
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so account
      section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>
  tags:
    - always

- name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*deny\s*=
    line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
    state: present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter not in PAM files
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Lock Accounts After Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Lock Accounts After Failed Password Attempts - Informative message based
          on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts After Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Check if any custom profile
          with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts After Failed Password Attempts - Change the PAM file to
          be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts After Failed Password Attempts - Check if {{ pam_file_path
        }} file is present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: result_pam_file_present

    - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option
        from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal
      when: result_pam_file_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Lock Accounts After Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Lock Accounts After Failed Password Attempts - Informative message based
          on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Lock Accounts After Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Check if any custom profile
          with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Lock Accounts After Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Lock Accounts After Failed Password Attempts - Change the PAM file to
          be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Lock Accounts After Failed Password Attempts - Check if {{ pam_file_path
        }} file is present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: result_pam_file_present

    - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option
        from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal
      when: result_pam_file_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
    deny parameter in PAM files
  block:

  - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
      deny parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*deny
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_deny_parameter_is_present

  - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so
      preauth deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found == 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so
      authfail deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found == 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
      for pam_faillock.so preauth deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found &gt; 0

  - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
      for pam_faillock.so authfail deny parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_deny_parameter_is_present.found &gt; 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.6
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_deny
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Lockout Time for Failed Password Attempts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This rule configures the system to lock out accounts during a specified time period after a
number of incorrect login attempts using <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_faillock.so</html:code>.

Ensure that the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> contains the following entry:
<html:code xmlns:html="http://www.w3.org/1999/xhtml">unlock_time=&lt;interval-in-seconds&gt;</html:code> where
<html:code xmlns:html="http://www.w3.org/1999/xhtml">interval-in-seconds</html:code> is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/></html:code> or greater.

pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid any errors when manually editing these files,
it is recommended to use the appropriate tools, such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">authconfig</html:code>,
depending on the OS version.

If <html:code xmlns:html="http://www.w3.org/1999/xhtml">unlock_time</html:code> is set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>, manual intervention by an administrator is required
to unlock a user. This should be done using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">faillock</html:code> tool.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the system supports the new <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> file but the
pam_faillock.so parameters are defined directly in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code>, the remediation will migrate the <html:code xmlns:html="http://www.w3.org/1999/xhtml">unlock_time</html:code> parameter
to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> to ensure compatibility with <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool.
The parameters <html:code xmlns:html="http://www.w3.org/1999/xhtml">deny</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">fail_interval</html:code>, if used, also have to be migrated
by their respective remediation.</warning>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the system relies on <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool to manage PAM settings, the remediation
will also use <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> tool. However, if any manual modification was made in
PAM files, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">authselect</html:code> integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/faillock.conf</html:code> file, the pam_faillock
parameters should be defined in <html:code xmlns:html="http://www.w3.org/1999/xhtml">faillock.conf</html:code> file.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_accounts_passwords_pam_faillock_unlock_time='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>'


if [ -f /usr/bin/authselect ]; then
    if ! authselect check; then
echo "
authselect integrity check failed. Remediation aborted!
This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
It is not recommended to manually edit the PAM files when authselect tool is available.
In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
exit 1
fi
authselect enable-feature with-faillock

authselect apply-changes -b
else
    
AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
for pam_file in "${AUTH_FILES[@]}"
do
    if ! grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+(preauth silent|authfail).*$' "$pam_file" ; then
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix\.so.*/i auth        required      pam_faillock.so preauth silent' "$pam_file"
        sed -i --follow-symlinks '/^auth.*required.*pam_deny\.so.*/i auth        required      pam_faillock.so authfail' "$pam_file"
        sed -i --follow-symlinks '/^account.*required.*pam_unix\.so.*/i account     required      pam_faillock.so' "$pam_file"
    fi
    sed -Ei 's/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required     \3/g' "$pam_file"
done

fi

AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")
SKIP_FAILLOCK_CHECK=false

FAILLOCK_CONF="/etc/security/faillock.conf"
if [ -f $FAILLOCK_CONF ] || [ "$SKIP_FAILLOCK_CHECK" = "true" ]; then
    regex="^\s*unlock_time\s*="
    line="unlock_time = $var_accounts_passwords_pam_faillock_unlock_time"
    if ! grep -q $regex $FAILLOCK_CONF; then
        echo $line &gt;&gt; $FAILLOCK_CONF
    else
        sed -i --follow-symlinks 's|^\s*\(unlock_time\s*=\s*\)\(\S\+\)|\1'"$var_accounts_passwords_pam_faillock_unlock_time"'|g' $FAILLOCK_CONF
    fi
    
    for pam_file in "${AUTH_FILES[@]}"
    do
        if [ -e "$pam_file" ] ; then
            PAM_FILE_PATH="$pam_file"
            if [ -f /usr/bin/authselect ]; then
                
                if ! authselect check; then
                echo "
                authselect integrity check failed. Remediation aborted!
                This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                It is not recommended to manually edit the PAM files when authselect tool is available.
                In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
                exit 1
                fi

                CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
                # If not already in use, a custom profile is created preserving the enabled features.
                if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                    ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
                    # If currently used, it is replaced by "sssd", which is the best option in this case.
                    if [[ $CURRENT_PROFILE == local ]]; then
                        CURRENT_PROFILE="sssd"
                    fi
                    authselect create-profile hardening -b $CURRENT_PROFILE
                    CURRENT_PROFILE="custom/hardening"
                    
                    authselect apply-changes -b --backup=before-hardening-custom-profile
                    authselect select $CURRENT_PROFILE
                    for feature in $ENABLED_FEATURES; do
                        authselect enable-feature $feature;
                    done
                    
                    authselect apply-changes -b --backup=after-hardening-custom-profile
                fi
                PAM_FILE_NAME=$(basename "$pam_file")
                PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

                authselect apply-changes -b
            fi
            
        if grep -qP "^\s*auth\s.*\bpam_faillock.so\s.*\bunlock_time\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "s/(.*auth.*pam_faillock.so.*)\bunlock_time\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
        fi
            if [ -f /usr/bin/authselect ]; then
                
                authselect apply-changes -b
            fi
        else
            echo "$pam_file was not found" &gt;&amp;2
        fi
    done
    
else
    for pam_file in "${AUTH_FILES[@]}"
    do
        if ! grep -qE '^\s*auth.*pam_faillock\.so\s+(preauth|authfail).*unlock_time' "$pam_file"; then
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*preauth.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock\.so.*authfail.*/ s/$/ unlock_time='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        else
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*preauth.*\)\('"unlock_time"'=\)\S\+\b\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock\.so.*authfail.*\)\('"unlock_time"'=\)\S\+\b\(.*\)/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'\3/' "$pam_file"
        fi
    done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Check if system relies on
    authselect tool
  ansible.builtin.stat:
    path: /usr/bin/authselect
  register: result_authselect_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is present
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
      current profile
    ansible.builtin.command:
      cmd: authselect check
    register: result_authselect_check_cmd
    changed_when: false
    check_mode: false
    failed_when: false

  - name: Set Lockout Time for Failed Password Attempts - Informative message based
      on the authselect integrity check result
    ansible.builtin.assert:
      that:
      - ansible_check_mode or result_authselect_check_cmd.rc == 0
      fail_msg:
      - authselect integrity check failed. Remediation aborted!
      - This remediation could not be applied because an authselect profile was not
        selected or the selected profile is not intact.
      - It is not recommended to manually edit the PAM files when authselect tool
        is available.
      - In cases where the default authselect profile does not cover a specific demand,
        a custom authselect profile is recommended.
      success_msg:
      - authselect integrity check passed

  - name: Set Lockout Time for Failed Password Attempts - Get authselect current features
    ansible.builtin.shell:
      cmd: authselect current | tail -n+3 | awk '{ print $2 }'
    register: result_authselect_features
    changed_when: false
    check_mode: false
    when:
    - result_authselect_check_cmd is success

  - name: Set Lockout Time for Failed Password Attempts - Ensure "with-faillock" feature
      is enabled using authselect tool
    ansible.builtin.command:
      cmd: authselect enable-feature with-faillock
    register: result_authselect_enable_feature_cmd
    when:
    - result_authselect_check_cmd is success
    - result_authselect_features.stdout is not search("with-faillock")

  - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
      are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_enable_feature_cmd is not skipped
    - result_authselect_enable_feature_cmd is success
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
    tool is not present
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
      is already enabled
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail)
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_is_enabled

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so preauth
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so preauth
      insertbefore: ^auth.*sufficient.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so authfail
      editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: auth        required      pam_faillock.so authfail
      insertbefore: ^auth.*required.*pam_deny\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so account
      section editing PAM files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      line: account     required      pam_faillock.so
      insertbefore: ^account.*required.*pam_unix\.so.*
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_is_enabled.found == 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_authselect_present.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>
  tags:
    - always

- name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf
    file
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: result_faillock_conf_check
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in /etc/security/faillock.conf
  ansible.builtin.lineinfile:
    path: /etc/security/faillock.conf
    regexp: ^\s*unlock_time\s*=
    line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
    state: present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter not in PAM files
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_file_present

  - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set Lockout Time for Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Lockout Time for Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Lockout Time for Failed Password Attempts - Check if {{ pam_file_path
        }} file is present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: result_pam_file_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal
      when: result_pam_file_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists

  - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_file_present

  - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
      for the system
    block:

    - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to
        be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
          current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set Lockout Time for Failed Password Attempts - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set Lockout Time for Failed Password Attempts - Define the current authselect
          profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match("^(custom/|local)")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match("local")
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match("custom/")
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: ''

    - name: Set Lockout Time for Failed Password Attempts - Check if {{ pam_file_path
        }} file is present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: result_pam_file_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time"
        option from "pam_faillock.so" is not present in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
        replace: \1\2
      register: result_pam_option_removal
      when: result_pam_file_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_option_removal is changed
    when:
    - result_pam_file_present.stat.exists
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
    unlock_time parameter in PAM files
  block:

  - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
      unlock_time parameter is already enabled in pam files
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: .*auth.*pam_faillock\.so (preauth|authfail).*unlock_time
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_faillock_unlock_time_parameter_is_present

  - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
      pam_faillock.so preauth unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
      line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
      pam_faillock.so authfail unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
      line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
        }}
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found == 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
      for pam_faillock.so preauth unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0

  - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
      for pam_faillock.so authfail unlock_time parameter in auth section
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      backrefs: true
      regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
      line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
      state: present
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - not result_faillock_conf_check.stat.exists
  tags:
  - CJIS-5.5.3
  - NIST-800-171-3.1.8
  - NIST-800-53-AC-7(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.1.7
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.4
  - accounts_passwords_pam_faillock_unlock_time
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_password_quality">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Quality Requirements</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> module is the preferred way of configuring
password requirements.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The man pages <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality(8)</html:code>
provide information on the capabilities and configuration of
each.</description>
          <platform idref="#system_with_kernel"/>
          <Group id="xccdf_org.ssgproject.content_group_password_quality_pwquality">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Quality Requirements with pam_pwquality</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, to configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, make sure that <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality</html:code> exists in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</html:pre>
If no such line exists, add one as the first line of the password section in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code>.
Next, modify the settings in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> to match the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3</html:pre>
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</description>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_minclass" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minclass</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of categories of characters that must exist in a password</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value>3</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_minlen" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minlen</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum number of characters in password</description>
              <value selector="10">10</value>
              <value selector="12">12</value>
              <value selector="14">14</value>
              <value selector="15">15</value>
              <value selector="17">17</value>
              <value selector="18">18</value>
              <value selector="20">20</value>
              <value selector="6">6</value>
              <value selector="7">7</value>
              <value selector="8">8</value>
              <value>15</value>
            </Value>
            <Value id="xccdf_org.ssgproject.content_value_var_password_pam_retry" type="number">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">retry</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Number of retry attempts before erroring out</description>
              <value selector="1">1</value>
              <value selector="2">2</value>
              <value selector="3">3</value>
              <value selector="4">4</value>
              <value selector="5">5</value>
              <value>3</value>
            </Value>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Different Categories</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">minclass</html:code> parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)
</html:pre>
Modify the <html:code xmlns:html="http://www.w3.org/1999/xhtml">minclass</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/pwquality.conf</html:code> entry
to require <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
differing categories of characters when changing passwords.</description>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000072-GPOS-00040</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.1</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
          <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity is one factor of several that determines how long it takes to crack a password. The
more complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
          <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Requiring a minimum number of character categories makes password guessing attacks more difficult
by ensuring a larger search space.</rationale>
              <platform idref="#package_libpwquality"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minclass" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q libpwquality; }; then

var_password_pam_minclass='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>'








# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minclass")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minclass"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minclass\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^minclass\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minclass" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_minclass # promote to variable
  set_fact:
    var_password_pam_minclass: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories -
    Ensure PAM variable minclass is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minclass
    line: minclass = {{ var_password_pam_minclass }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - accounts_password_pam_minclass
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_minclass:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minclass"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_minclass:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Length</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The pam_pwquality module's <html:code xmlns:html="http://www.w3.org/1999/xhtml">minlen</html:code> parameter controls requirements for
minimum characters required in a password. Add <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
          </html:code>
after pam_pwquality to set minimum password length requirements.</description>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
              <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.3</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R31</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.1</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
              <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
              <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.6</reference>
              <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromise the password.</rationale>
              <platform idref="#package_libpwquality"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q libpwquality; }; then

var_password_pam_minlen='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>'








# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minlen")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minlen"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minlen\\&gt;" "/etc/security/pwquality.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^minlen\\&gt;.*/$escaped_formatted_output/gi" "/etc/security/pwquality.conf"
else
    if [[ -s "/etc/security/pwquality.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/security/pwquality.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/security/pwquality.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable
    minlen is set accordingly
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(a)
  - NIST-800-53-IA-5(4)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.3
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.6
  - accounts_password_pam_minlen
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
            <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="false" role="full" severity="medium">
              <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</title>
              <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure the number of retry prompts that are permitted per-session:

Edit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_pwquality.so</html:code> statement in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/system-auth</html:code> to show


<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
          </html:code>, or a lower value if site
policy is more restrictive. The profile requirement is a maximum of <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">retry=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
          </html:code> prompts
per session.</description>
              <reference href="https://www.cisecurity.org/controls/">1</reference>
              <reference href="https://www.cisecurity.org/controls/">11</reference>
              <reference href="https://www.cisecurity.org/controls/">12</reference>
              <reference href="https://www.cisecurity.org/controls/">15</reference>
              <reference href="https://www.cisecurity.org/controls/">16</reference>
              <reference href="https://www.cisecurity.org/controls/">3</reference>
              <reference href="https://www.cisecurity.org/controls/">5</reference>
              <reference href="https://www.cisecurity.org/controls/">9</reference>
              <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
              <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
              <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
              <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
              <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
              <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
              <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</reference>
              <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
              <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</reference>
              <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.1</reference>
              <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module.</rationale>
              <platform idref="#package_libpwquality"/>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_retry" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q libpwquality; }; then

var_password_pam_retry='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>'



	
		if [ -e "/etc/pam.d/system-auth" ] ; then
    PAM_FILE_PATH="/etc/pam.d/system-auth"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "/etc/pam.d/system-auth")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+requisite\s+pam_pwquality.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_pwquality.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_pwquality.so.*)/\1requisite \2/" "$PAM_FILE_PATH"
            else
                LAST_MATCH_LINE=$(grep -nP "^\s*account" "$PAM_FILE_PATH" | tail -n 1 | cut -d: -f 1)
                if [ ! -z $LAST_MATCH_LINE ]; then
                    sed -i --follow-symlinks $LAST_MATCH_LINE" a password     requisite    pam_pwquality.so" "$PAM_FILE_PATH"
                else
                    echo "password    requisite    pam_pwquality.so" &gt;&gt; "$PAM_FILE_PATH"
                fi
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+requisite\s+pam_pwquality.so\s*.*\sretry\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+requisite\s+pam_pwquality.so.*/ s/$/ retry=$var_password_pam_retry/" "$PAM_FILE_PATH"
        else
            sed -i -E --follow-symlinks "s/(\s*password\s+requisite\s+pam_pwquality.so\s+.*)(retry=)[[:alnum:]]*\s*(.*)/\1\2$var_password_pam_retry \3/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "/etc/pam.d/system-auth was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
              <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_pam_retry" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_password_pam_retry # promote to variable
  set_fact:
    var_password_pam_retry: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" use="legacy"/>
  tags:
    - always

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Define a fact for control already filtered in case filters are used
  ansible.builtin.set_fact:
    pam_module_control: requisite
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check if expected PAM module line is present in /etc/pam.d/system-auth
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_line_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Include or update the PAM module line in /etc/pam.d/system-auth
  block:

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if required PAM module line is present in /etc/pam.d/system-auth
      with different control
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_other_control_present

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the correct control for the required PAM module
      line in /etc/pam.d/system-auth
    ansible.builtin.replace:
      dest: /etc/pam.d/system-auth
      regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
      replace: \1{{ pam_module_control }} \2
    register: result_pam_module_edit
    when:
    - result_pam_line_other_control_present.found == 1

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the required PAM module line is included in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      dest: /etc/pam.d/system-auth
      insertafter: ^\s*account
      line: password    {{ pam_module_control }}    pam_pwquality.so
    register: result_pam_module_add
    when:
    - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
      &gt; 1

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present is defined
    - result_authselect_present.stat.exists
    - |-
      (result_pam_module_add is defined and result_pam_module_add.changed)
       or (result_pam_module_edit is defined and result_pam_module_edit.changed)
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  - result_pam_line_present.found is defined
  - result_pam_line_present.found == 0
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Define a fact for control already filtered in case filters are used
  ansible.builtin.set_fact:
    pam_module_control: requisite
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Check if the required PAM module option is present in /etc/pam.d/system-auth
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*\sretry\b
    state: absent
  check_mode: true
  changed_when: false
  register: result_pam_module_accounts_password_pam_retry_option_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Ensure the "retry" PAM option for "pam_pwquality.so" is included
    in /etc/pam.d/system-auth
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    backrefs: true
    regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so.*)
    line: \1 retry={{ var_password_pam_retry }}
    state: present
  register: result_pam_accounts_password_pam_retry_add
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  - result_pam_module_accounts_password_pam_retry_option_present.found is defined
  - result_pam_module_accounts_password_pam_retry_option_present.found == 0
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted
    Per-Session - Ensure the required value for "retry" PAM option from "pam_pwquality.so"
    in /etc/pam.d/system-auth
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    backrefs: true
    regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s+.*)(retry)=[0-9a-zA-Z]*\s*(.*)
    line: \1\2={{ var_password_pam_retry }} \3
  register: result_pam_accounts_password_pam_retry_edit
  when:
  - '"kernel" in ansible_facts.packages'
  - '"libpwquality" in ansible_facts.packages'
  - result_pam_module_accounts_password_pam_retry_option_present.found &gt; 0
  tags:
  - CJIS-5.5.3
  - NIST-800-53-AC-7(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(4)
  - accounts_password_pam_retry
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
</fix>
              <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <check-export export-name="oval:ssg-var_password_pam_retry:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_retry"/>
                <check-content-ref name="oval:ssg-accounts_password_pam_retry:def:1" href="ssg-al2023-oval.xml"/>
              </check>
              <check system="http://scap.nist.gov/schema/ocil/2">
                <check-content-ref name="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
              </check>
            </Rule>
          </Group>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Hashing Algorithm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's default algorithm for storing password hashes in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> is SHA-512. This can be configured in several
locations.</description>
          <platform idref="#system_with_kernel"/>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Hashing Algorithm in /etc/login.defs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>, add or update the following line to ensure the system will use
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/> as the hashing algorithm:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">ENCRYPT_METHOD <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
         </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.4</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Using a stronger hashing algorithm makes password cracking attacks more difficult.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_password_hashing_algorithm='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>'


# Allow multiple algorithms, but choose the first one for remediation
#
var_password_hashing_algorithm="$(echo $var_password_hashing_algorithm | cut -d \| -f 1)"

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ENCRYPT_METHOD")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_password_hashing_algorithm"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ENCRYPT_METHOD\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^ENCRYPT_METHOD\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_logindefs
- name: XCCDF Value var_password_hashing_algorithm # promote to variable
  set_fact:
    var_password_hashing_algorithm: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/login.defs
  ansible.builtin.lineinfile:
    dest: /etc/login.defs
    regexp: ^#?ENCRYPT_METHOD
    line: ENCRYPT_METHOD {{ var_password_hashing_algorithm.split('|')[0] }}
    state: present
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_password_hashing_algorithm_logindefs
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set PAM''s Password Hashing Algorithm - password-auth</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The PAM system service can be configured to only store encrypted representations of passwords.
In <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/password-auth</html:code>, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section of the file controls which
PAM modules to execute during a password change.

Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> module in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section to include the option
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/></html:code> and no other hashing
algorithms as shown below:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">password    sufficient    pam_unix.so <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
          <html:i>other arguments...</html:i>
         </html:pre>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This will help ensure that new passwords for local users will be stored using the
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/> algorithm.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The hashing algorithms to be used with pam_unix.so are defined with independent module
options. There are at least 7 possible algorithms and likely more algorithms will be
introduced along the time. Due the the number of options and its possible combinations,
the use of multiple hashing algorithm options may bring unexpected behaviors to the
system. For this reason the check will pass only when one hashing algorithm option is
defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The
remediation will ensure the correct option and remove any other extra hashing algorithm
option.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.4</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">crypt_style</html:code>
configuration option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/libuser.conf</html:code> ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_passwordauth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_password_hashing_algorithm_pam='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>'

PAM_FILE_PATH="/etc/pam.d/password-auth"

if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\s$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi

# Ensure only the correct hashing algorithm option is used.
declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blowfish" "sha256" "md5" "bigcrypt")

for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
  if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then
    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
      if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s+.*\s+pam_unix.so\s.*\b$hash_option\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*.*.*pam_unix.so.*)\b$hash_option\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi
    fi
  fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_passwordauth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth
- name: XCCDF Value var_password_hashing_algorithm_pam # promote to variable
  set_fact:
    var_password_hashing_algorithm_pam: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
  tags:
    - always

- name: Set PAM's Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
    file is present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check the proper remediation
    for the system
  block:

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if expected
      PAM module line is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Include or update
      the PAM module line in {{ pam_file_path }}
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if required
        PAM module line is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the correct
        control for the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the required
        PAM module line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define a fact for
      control already filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if the required
      PAM module option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
        var_password_hashing_algorithm_pam }}\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_set_password_hashing_algorithm_passwordauth_option_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the "{{ var_password_hashing_algorithm_pam
      }}" PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 {{ var_password_hashing_algorithm_pam }}
      state: present
    register: result_pam_set_password_hashing_algorithm_passwordauth_add
    when:
    - result_pam_module_set_password_hashing_algorithm_passwordauth_option_present.found
      is defined
    - result_pam_module_set_password_hashing_algorithm_passwordauth_option_present.found
      == 0

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_set_password_hashing_algorithm_passwordauth_add is defined and result_pam_set_password_hashing_algorithm_passwordauth_add.changed)
       or (result_pam_set_password_hashing_algorithm_passwordauth_edit is defined and result_pam_set_password_hashing_algorithm_passwordauth_edit.changed)
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
    File is Present
  ansible.builtin.stat:
    path: /etc/pam.d/password-auth
  register: result_pam_file_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth

- name: Set PAM's Password Hashing Algorithm - password-auth - Check The Proper Remediation
    For The System
  block:

  - name: Set PAM's Password Hashing Algorithm - password-auth - Define the PAM file
      to be edited as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/password-auth

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      custom profile is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the current
        authselect profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Define the new
        authselect custom profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Get authselect
        current features to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Check if any custom
        profile with the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
        custom profile based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure the authselect
        custom profile is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - password-auth - Restore the authselect
        features in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - password-auth - Change the PAM
        file to be edited according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - password-auth - Check if "{{ pam_file_path
      }}" File is Present
    ansible.builtin.stat:
      path: '{{ pam_file_path }}'
    register: pam_file_path_present

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure That Only
      the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{ pam_file_path
      }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
      replace: \1\2
    when:
    - item != var_password_hashing_algorithm_pam
    - pam_file_path_present.stat.exists
    loop:
    - sha512
    - yescrypt
    - gost_yescrypt
    - blowfish
    - sha256
    - md5
    - bigcrypt
    register: result_pam_hashing_options_removal

  - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
      changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_hashing_options_removal is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_passwordauth
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_hashing_algorithm_pam:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam"/>
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_passwordauth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_passwordauth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set PAM''s Password Hashing Algorithm</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The PAM system service can be configured to only store encrypted representations of passwords.
In "/etc/pam.d/system-auth", the <html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section of the file controls which
PAM modules to execute during a password change.

Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_unix.so</html:code> module in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">password</html:code> section to include the option
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/></html:code> and no other hashing
algorithms as shown below:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">password    sufficient    pam_unix.so <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
          <html:i>other arguments...</html:i>
         </html:pre>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This will help ensure that new passwords for local users will be stored using the
<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/> algorithm.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The hashing algorithms to be used with pam_unix.so are defined with independent module
options. There are at least 7 possible algorithms and likely more algorithms will be
introduced along the time. Due the the number of options and its possible combinations,
the use of multiple hashing algorithm options may bring unexpected behaviors to the
system. For this reason the check will pass only when one hashing algorithm option is
defined and is aligned to the "var_password_hashing_algorithm_pam" variable. The
remediation will ensure the correct option and remove any other extra hashing algorithm
option.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R68</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.5.4</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard method for
protecting passwords. If passwords are not encrypted, they can be plainly read
(i.e., clear text) and easily compromised. Passwords that are encrypted with a weak algorithm
are no more protected than if they are kept in plain text.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This setting ensures user and group account administration utilities are configured to store
only encrypted representations of passwords. Additionally, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">crypt_style</html:code>
configuration option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/libuser.conf</html:code> ensures the use of a strong hashing
algorithm that makes password cracking attacks more difficult.</rationale>
            <platform idref="#package_pam"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_systemauth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q pam; }; then

var_password_hashing_algorithm_pam='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>'


PAM_FILE_PATH="/etc/pam.d/system-auth"


# Ensure all the hashing algorithm option is removed.
declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blowfish" "sha256" "md5" "bigcrypt")

for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
  if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
    if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    
if grep -qP "^\s*password\s+.*\s+pam_unix.so\s.*\b$hash_option\b" "$PAM_FILE_PATH"; then
    sed -i -E --follow-symlinks "s/(.*password.*.*.*pam_unix.so.*)\b$hash_option\b=?[[:alnum:]]*(.*)/\1\2/g" "$PAM_FILE_PATH"
fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi
  fi
done

if [ -e "$PAM_FILE_PATH" ] ; then
    PAM_FILE_PATH="$PAM_FILE_PATH"
    if [ -f /usr/bin/authselect ]; then
        
        if ! authselect check; then
        echo "
        authselect integrity check failed. Remediation aborted!
        This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
        It is not recommended to manually edit the PAM files when authselect tool is available.
        In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
        exit 1
        fi

        CURRENT_PROFILE=$(authselect current -r | awk '{ print $1 }')
        # If not already in use, a custom profile is created preserving the enabled features.
        if [[ ! $CURRENT_PROFILE == custom/* ]]; then
            ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
            # The "local" profile does not contain essential security features required by multiple Benchmarks.
            # If currently used, it is replaced by "sssd", which is the best option in this case.
            if [[ $CURRENT_PROFILE == local ]]; then
                CURRENT_PROFILE="sssd"
            fi
            authselect create-profile hardening -b $CURRENT_PROFILE
            CURRENT_PROFILE="custom/hardening"
            
            authselect apply-changes -b --backup=before-hardening-custom-profile
            authselect select $CURRENT_PROFILE
            for feature in $ENABLED_FEATURES; do
                authselect enable-feature $feature;
            done
            
            authselect apply-changes -b --backup=after-hardening-custom-profile
        fi
        PAM_FILE_NAME=$(basename "$PAM_FILE_PATH")
        PAM_FILE_PATH="/etc/authselect/$CURRENT_PROFILE/$PAM_FILE_NAME"

        authselect apply-changes -b
    fi
    

        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*" "$PAM_FILE_PATH"; then
            # Line matching group + control + module was not found. Check group + module.
            if [ "$(grep -cP '^\s*password\s+.*\s+pam_unix.so\s*' "$PAM_FILE_PATH")" -eq 1 ]; then
                # The control is updated only if one single line matches.
                sed -i -E --follow-symlinks "s/^(\s*password\s+).*(\bpam_unix.so.*)/\1sufficient \2/" "$PAM_FILE_PATH"
            else
                echo "password    sufficient    pam_unix.so" &gt;&gt; "$PAM_FILE_PATH"
            fi
        fi
        # Check the option
        if ! grep -qP "^\s*password\s+sufficient\s+pam_unix.so\s*.*\s$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
            sed -i -E --follow-symlinks "/\s*password\s+sufficient\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH"
        fi
    if [ -f /usr/bin/authselect ]; then
        
        authselect apply-changes -b
    fi
else
    echo "$PAM_FILE_PATH was not found" &gt;&amp;2
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_password_hashing_algorithm_systemauth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth
- name: XCCDF Value var_password_hashing_algorithm_pam # promote to variable
  set_fact:
    var_password_hashing_algorithm_pam: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam" use="legacy"/>
  tags:
    - always

- name: Set PAM's Password Hashing Algorithm - Check if /etc/pam.d/system-auth file
    is present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check the proper remediation for the
    system
  block:

  - name: Set PAM's Password Hashing Algorithm - Define the PAM file to be edited
      as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set PAM's Password Hashing Algorithm - Check if system relies on authselect
      tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect custom profile
      is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - Informative message based on the
        authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - Define the current authselect profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Define the new authselect custom
        profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Get authselect current features
        to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Check if any custom profile with
        the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Ensure the authselect custom profile
        is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Restore the authselect features
        in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - Change the PAM file to be edited
        according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - Define a fact for control already
      filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - Check if expected PAM module line
      is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present

  - name: Set PAM's Password Hashing Algorithm - Include or update the PAM module
      line in {{ pam_file_path }}
    block:

    - name: Set PAM's Password Hashing Algorithm - Check if required PAM module line
        is present in {{ pam_file_path }} with different control
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+.*\s+pam_unix.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Set PAM's Password Hashing Algorithm - Ensure the correct control for
        the required PAM module line in {{ pam_file_path }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Set PAM's Password Hashing Algorithm - Ensure the required PAM module
        line is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        dest: '{{ pam_file_path }}'
        line: password    {{ pam_module_control }}    pam_unix.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0

  - name: Set PAM's Password Hashing Algorithm - Define a fact for control already
      filtered in case filters are used
    ansible.builtin.set_fact:
      pam_module_control: sufficient

  - name: Set PAM's Password Hashing Algorithm - Check if the required PAM module
      option is present in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
        var_password_hashing_algorithm_pam }}\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_set_password_hashing_algorithm_systemauth_option_present

  - name: Set PAM's Password Hashing Algorithm - Ensure the "{{ var_password_hashing_algorithm_pam
      }}" PAM option for "pam_unix.so" is included in {{ pam_file_path }}
    ansible.builtin.lineinfile:
      path: '{{ pam_file_path }}'
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
      line: \1 {{ var_password_hashing_algorithm_pam }}
      state: present
    register: result_pam_set_password_hashing_algorithm_systemauth_add
    when:
    - result_pam_module_set_password_hashing_algorithm_systemauth_option_present.found
      is defined
    - result_pam_module_set_password_hashing_algorithm_systemauth_option_present.found
      == 0

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - |-
      (result_pam_set_password_hashing_algorithm_systemauth_add is defined and result_pam_set_password_hashing_algorithm_systemauth_add.changed)
       or (result_pam_set_password_hashing_algorithm_systemauth_edit is defined and result_pam_set_password_hashing_algorithm_systemauth_edit.changed)
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check if /etc/pam.d/system-auth File
    is Present
  ansible.builtin.stat:
    path: /etc/pam.d/system-auth
  register: result_pam_file_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth

- name: Set PAM's Password Hashing Algorithm - Check The Proper Remediation For The
    System
  block:

  - name: Set PAM's Password Hashing Algorithm - Define the PAM file to be edited
      as a local fact
    ansible.builtin.set_fact:
      pam_file_path: /etc/pam.d/system-auth

  - name: Set PAM's Password Hashing Algorithm - Check if system relies on authselect
      tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect custom profile
      is used if authselect is present
    block:

    - name: Set PAM's Password Hashing Algorithm - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set PAM's Password Hashing Algorithm - Informative message based on the
        authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set PAM's Password Hashing Algorithm - Get authselect current profile
      ansible.builtin.shell:
        cmd: authselect current -r | awk '{ print $1 }'
      register: result_authselect_profile
      changed_when: false
      when:
      - result_authselect_check_cmd is success

    - name: Set PAM's Password Hashing Algorithm - Define the current authselect profile
        as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Define the new authselect custom
        profile as a local fact
      ansible.builtin.set_fact:
        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
        authselect_custom_profile: custom/hardening
      when:
      - result_authselect_profile is not skipped
      - result_authselect_profile.stdout is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Get authselect current features
        to also enable them in the custom profile
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Check if any custom profile with
        the same name was already created
      ansible.builtin.stat:
        path: /etc/authselect/{{ authselect_custom_profile }}
      register: result_authselect_custom_profile_present
      changed_when: false
      when:
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on the current profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b {{ authselect_current_profile
          }}
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is not match("^(custom/|local)")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
        based on sssd profile
      ansible.builtin.command:
        cmd: authselect create-profile hardening -b sssd
      when:
      - result_authselect_profile is not skipped
      - result_authselect_check_cmd is success
      - authselect_current_profile is match("local")
      - not result_authselect_custom_profile_present.stat.exists

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Ensure the authselect custom profile
        is selected
      ansible.builtin.command:
        cmd: authselect select {{ authselect_custom_profile }}
      register: result_pam_authselect_select_profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - authselect_current_profile is not match("custom/")
      - authselect_custom_profile is not match(authselect_current_profile)

    - name: Set PAM's Password Hashing Algorithm - Restore the authselect features
        in the custom profile
      ansible.builtin.command:
        cmd: authselect enable-feature {{ item }}
      loop: '{{ result_authselect_features.stdout_lines }}'
      register: result_pam_authselect_restore_features
      when:
      - result_authselect_profile is not skipped
      - result_authselect_features is not skipped
      - result_pam_authselect_select_profile is not skipped

    - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
      when:
      - result_authselect_check_cmd is success
      - result_authselect_profile is not skipped
      - result_pam_authselect_restore_features is not skipped

    - name: Set PAM's Password Hashing Algorithm - Change the PAM file to be edited
        according to the custom authselect profile
      ansible.builtin.set_fact:
        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
          | basename }}
      when:
      - authselect_custom_profile is defined
    when:
    - result_authselect_present.stat.exists

  - name: Set PAM's Password Hashing Algorithm - Check if "{{ pam_file_path }}" File
      is Present
    ansible.builtin.stat:
      path: '{{ pam_file_path }}'
    register: pam_file_path_present

  - name: Set PAM's Password Hashing Algorithm - Ensure That Only the Correct Hashing
      Algorithm Option For pam_unix.so Is Used in {{ pam_file_path }}
    ansible.builtin.replace:
      dest: '{{ pam_file_path }}'
      regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
      replace: \1\2
    when:
    - item != var_password_hashing_algorithm_pam
    - pam_file_path_present.stat.exists
    loop:
    - sha512
    - yescrypt
    - gost_yescrypt
    - blowfish
    - sha256
    - md5
    - bigcrypt
    register: result_pam_hashing_options_removal

  - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
    ansible.builtin.command:
      cmd: authselect apply-changes -b
    when:
    - result_authselect_present.stat.exists
    - result_pam_hashing_options_removal is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - '"pam" in ansible_facts.packages'
  - result_pam_file_present.stat.exists
  tags:
  - CJIS-5.6.2.2
  - NIST-800-171-3.13.11
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(c)
  - PCI-DSS-Req-8.2.1
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - set_password_hashing_algorithm_systemauth
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_hashing_algorithm_pam:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam"/>
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protect Accounts by Restricting Password-Based Login</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_account_unique_id" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Accounts on the System Have Unique User IDs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change user IDs (UIDs), or delete accounts, so each has a unique name.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available due to unique requirements of each
system.</warning>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000121-GPOS-00062</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system.</rationale>
          <platform idref="#system_with_kernel"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-account_unique_id:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-account_unique_id_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_group_unique_id" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Groups on the System Have Unique Group ID</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the group name or delete groups, so each has a unique id.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available due to the unique requirements of each system.</warning>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.5</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.</rationale>
          <platform idref="#system_with_kernel"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-group_unique_id:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-group_unique_id_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_group_unique_name" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Groups on the System Have Unique Group Names</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the group name or delete groups, so each has a unique name.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available due to the unique requirements of each system.</warning>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system.</rationale>
          <platform idref="#system_with_kernel"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-group_unique_name:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-group_unique_name_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_account_expiration">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Account Expiration Parameters</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>NUM_DAYS</html:i></html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>USER</html:i></html:code> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -I <html:i>NUM_DAYS USER</html:i>
        </html:pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">-E</html:code> option.
The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/useradd</html:code> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
          <platform idref="#system_with_kernel"/>
          <Value id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">number of days after a password expires until the account is permanently disabled</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of days to wait after a password expires, until the account will be permanently disabled.</description>
            <value selector="0">0</value>
            <value selector="180">180</value>
            <value selector="30">30</value>
            <value selector="35">35</value>
            <value selector="40">40</value>
            <value selector="45">45</value>
            <value selector="60">60</value>
            <value selector="90">90</value>
            <value>35</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Account Expiration Following Inactivity</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/useradd</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">INACTIVE=<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:i>
         </html:pre>
If a password is currently on the verge of expiration, then
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code>
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code> day(s) could
elapse until the account would be automatically disabled. See the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">useradd</html:code> man page for more information.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system.
Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_account_disable_post_pw_expiration='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^INACTIVE")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_account_disable_post_pw_expiration"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^INACTIVE\\&gt;" "/etc/default/useradd"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^INACTIVE\\&gt;.*/$escaped_formatted_output/gi" "/etc/default/useradd"
else
    if [[ -s "/etc/default/useradd" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/default/useradd" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/default/useradd"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/default/useradd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - account_disable_post_pw_expiration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - account_disable_post_pw_expiration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
              <check-content-ref name="oval:ssg-account_disable_post_pw_expiration:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_account_unique_name" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Accounts on the System Have Unique Names</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure accounts on the system have unique names.

To ensure all accounts have unique names, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</html:pre>
If a username is returned, change or delete the username.</description>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unique usernames allow for accountability on the system.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-account_unique_name:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-account_unique_name_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_password_expiration">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Expiration Parameters</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> controls several
password-related settings. Programs such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code>, and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">login</html:code> consult <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">login.defs(5)</html:code> for more information.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_MAX_DAYS</html:code> and apply it to existing accounts with the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">-M</html:code> flag.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_MIN_DAYS</html:code> (<html:code xmlns:html="http://www.w3.org/1999/xhtml">-m</html:code>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">PASS_WARN_AGE</html:code> (<html:code xmlns:html="http://www.w3.org/1999/xhtml">-W</html:code>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
For example, for each existing human user <html:i xmlns:html="http://www.w3.org/1999/xhtml">USER</html:i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -M 180 -m 7 -W 7 USER</html:pre>
       </description>
          <platform idref="#system_with_kernel"/>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">maximum password age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum age of password in days</description>
            <value selector="365">365</value>
            <value selector="120">120</value>
            <value selector="180">180</value>
            <value selector="90">90</value>
            <value selector="60">60</value>
            <value selector="45">45</value>
            <value>60</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">minimum password age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Minimum age of password in days</description>
            <value selector="0">0</value>
            <value selector="1">1</value>
            <value selector="2">2</value>
            <value selector="3">3</value>
            <value selector="4">4</value>
            <value selector="5">5</value>
            <value selector="6">6</value>
            <value selector="7">7</value>
            <value>7</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">warning days before password expires</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The number of days' warning given before a password expires.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This will only apply to newly created accounts</warning>
            <value selector="0">0</value>
            <value selector="14">14</value>
            <value selector="10">10</value>
            <value selector="7">7</value>
            <value>7</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Maximum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify password maximum age for new accounts,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>
and add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_MAX_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
         </html:pre>
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.1</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_accounts_maximum_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_MAX_DAYS")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_maximum_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_MAX_DAYS\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_MAX_DAYS\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1
  - NIST-800-171-3.5.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_maximum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Age
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1
  - NIST-800-171-3.5.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_maximum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_maximum_age_login_defs:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Minimum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify password minimum age for new accounts,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code>
and add or correct the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_MIN_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
         </html:pre>
A value of 1 day is considered sufficient for many
environments.
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Setting the minimum password age protects against users cycling back to a
favorite password after satisfying the password reuse requirement.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_minimum_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_accounts_minimum_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_MIN_DAYS")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_minimum_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_MIN_DAYS\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_MIN_DAYS\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_minimum_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_minimum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Minimum Age
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MIN_DAYS
    line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - CJIS-5.6.2.1.1
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_minimum_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_minimum_age_login_defs:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Existing Passwords Maximum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure non-compliant accounts to enforce a <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>-day maximum password lifetime
restriction by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo chage -M <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
          <html:i>USER</html:i>
         </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any password, no matter how complex, can eventually be cracked. Therefore,
passwords need to be changed periodically. If the operating system does
not limit the lifetime of passwords and force users to change their
passwords, there is the risk that the operating system passwords could be
compromised.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_max_life_existing" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_accounts_maximum_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    
    chage -M $var_accounts_maximum_age_login_defs $i

done &lt;   &lt;(awk -v var="$var_accounts_maximum_age_login_defs" -F: '(/^[^:]+:[^!*]/ &amp;&amp; ($5 &gt; var || $5 == "")) {print $1}' /etc/shadow)

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_max_life_existing" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_max_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct maximum time period between password changes
  ansible.builtin.command:
    cmd: awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($5 &gt; {{ var_accounts_maximum_age_login_defs
      }} || $5 == "")) {print $1}' /etc/shadow
  register: user_names
  changed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_max_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the maximum time period between password changes
  ansible.builtin.user:
    user: '{{ item }}'
    password_expire_max: '{{ var_accounts_maximum_age_login_defs }}'
  with_items: '{{ user_names.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - user_names.stdout_lines | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_max_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
              <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_set_max_life_existing:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_set_max_life_existing_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Existing Passwords Minimum Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure non-compliant accounts to enforce a 24 hours/1 day minimum password
lifetime by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage -m 1 <html:i>USER</html:i>
         </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000075-GPOS-00043</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password, the
password could be repeatedly changed in a short period of time to defeat the
organization's policy regarding password reuse.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_min_life_existing" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_accounts_minimum_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    
    chage -m $var_accounts_minimum_age_login_defs $i

done &lt;   &lt;(awk -v var="$var_accounts_minimum_age_login_defs" -F: '(/^[^:]+:[^!*]/ &amp;&amp; ($4 &lt; var || $4 == "")) {print $1}' /etc/shadow)

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_min_life_existing" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_password_set_min_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_minimum_age_login_defs # promote to variable
  set_fact:
    var_accounts_minimum_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct minimum time period between password changes
  ansible.builtin.command: |
    awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($4 &lt; {{ var_accounts_minimum_age_login_defs }} || $4 == "")) {print $1}' /etc/shadow
  register: user_names
  changed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_password_set_min_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the minimum time period between password changes
  ansible.builtin.command: |
    chage -m {{ var_accounts_minimum_age_login_defs }} {{ item }}
  with_items: '{{ user_names.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - user_names.stdout_lines | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - accounts_password_set_min_life_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_minimum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs"/>
              <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_set_min_life_existing:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_set_min_life_existing_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Existing Passwords Warning Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure how many days prior to password expiration that a warning will be issued to
users, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">$ sudo chage --warndays <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
          <html:i>USER</html:i>
         </html:pre>
This profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Providing an advance warning that a password will be expiring gives users
time to think of a secure password. Users caught unaware may choose a simple
password or write it down where it may be discovered.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_warn_age_existing" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_accounts_password_warn_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>'


while IFS= read -r i; do
    chage --warndays $var_accounts_password_warn_age_login_defs $i
done &lt;   &lt;(awk -v var="$var_accounts_password_warn_age_login_defs" -F: '(($6 &lt; var || $6 == "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow)

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_set_warn_age_existing" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_warn_age_existing
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Existing Passwords Warning Age - Collect Users With Incorrect Number of
    Days of Warning Before Password Expires
  ansible.builtin.command:
    cmd: awk -F':' '(($6 &lt; {{ var_accounts_password_warn_age_login_defs }} || $6 ==
      "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow
  register: result_pass_warn_age_user_names
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_warn_age_existing
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set Existing Passwords Warning Age - Ensure the Number of Days of Warning
    Before Password Expires
  ansible.builtin.command:
    cmd: chage --warndays {{ var_accounts_password_warn_age_login_defs }} {{ item
      }}
  with_items: '{{ result_pass_warn_age_user_names.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - result_pass_warn_age_user_names is not skipped and result_pass_warn_age_user_names.stdout_lines
    | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_set_warn_age_existing
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_set_warn_age_existing:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_set_warn_age_existing_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Password Warning Age</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> and add or correct
 the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">PASS_WARN_AGE <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
         </html:pre>
The profile requirement is <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/></html:code>.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.4</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.3</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0418</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1055</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.9</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the password warning age enables users to
make the change at a practical time.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_warn_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_accounts_password_warn_age_login_defs='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>'

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^PASS_WARN_AGE")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_password_warn_age_login_defs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^PASS_WARN_AGE\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^PASS_WARN_AGE\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_password_warn_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_warn_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_password_warn_age_login_defs # promote to variable
  set_fact:
    var_accounts_password_warn_age_login_defs: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Warning Age
  ansible.builtin.lineinfile:
    dest: /etc/login.defs
    regexp: ^PASS_WARN_AGE *[0-9]*
    state: present
    line: PASS_WARN_AGE        {{ var_accounts_password_warn_age_login_defs }}
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.5.8
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)(d)
  - NIST-800-53-IA-5(f)
  - PCI-DSS-Req-8.2.4
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.9
  - accounts_password_warn_age_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_password_warn_age_login_defs:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set existing passwords a period of inactivity before they been locked</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure user accounts that have been inactive for over a given period of time
to be automatically disabled by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chage --inactive 30 USER</html:pre>
        </description>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inactive accounts pose a threat to system security since the users are not logging in to
notice failed login attempts or other anomalies.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_set_post_pw_existing" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_account_disable_post_pw_expiration='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>'


while IFS= read -r i; do
    chage --inactive $var_account_disable_post_pw_expiration $i
done &lt;   &lt;(awk -v var="$var_account_disable_post_pw_expiration" -F: '(($7 &gt; var || $7 == "") &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow)

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_set_post_pw_existing" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - accounts_set_post_pw_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Collect users with not correct INACTIVE parameter set
  ansible.builtin.command:
    cmd: awk -F':' '(($7 &gt; {{ var_account_disable_post_pw_expiration }} || $7 == "")
      &amp;&amp; $2 ~ /^\$/) {print $1}' /etc/shadow
  register: user_names
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - accounts_set_post_pw_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Change the period of inactivity
  ansible.builtin.command:
    cmd: chage --inactive {{ var_account_disable_post_pw_expiration }} {{ item }}
  with_items: '{{ user_names.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - user_names is not skipped and user_names.stdout_lines | length &gt; 0
  tags:
  - NIST-800-171-3.5.6
  - NIST-800-53-AC-2(3)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-4(e)
  - PCI-DSS-Req-8.1.4
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.6
  - accounts_set_post_pw_existing
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
              <check-content-ref name="oval:ssg-accounts_set_post_pw_existing:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_set_post_pw_existing_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_password_storage">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Proper Storage and Existence of Password
Hashes</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify All Account Password Hashes are Shadowed</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any password hashes are stored in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> (in the second field,
instead of an <html:code xmlns:html="http://www.w3.org/1999/xhtml">x</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">*</html:code>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.10</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.2.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.1</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1402</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The hashes for all user account passwords should be stored in
the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> and never in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>,
which is readable by all users.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_password_all_shadowed:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure all users last password change date is in the past</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All users should have a password change date in the past.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation is not available, in order to avoid any system disruption.</warning>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.1.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a user recorded password change date is in the future then they could
bypass any set password expiration.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_password_last_change_is_in_past:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_password_last_change_is_in_past_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="false" role="full" severity="low">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add a group to the system for each GID referenced without a corresponding group.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.5.a</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Group Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure There Are No Accounts With Blank or Null Passwords</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Check the "/etc/shadow" file for blank passwords with the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo awk -F: '!$2 {print $1}' /etc/shadow</html:pre>
If the command returns any results, this is a finding.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo passwd [username]</html:pre>
Lock an account:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo passwd -l [username]</html:pre>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.6</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_empty_passwords_etc_shadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

readarray -t users_with_empty_pass &lt; &lt;(sudo awk -F: '!$2 {print $1}' /etc/shadow)

for user_with_empty_pass in "${users_with_empty_pass[@]}"
do
    passwd -l $user_with_empty_pass
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_empty_passwords_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy

- name: Collect users with no password
  ansible.builtin.command: |
    awk -F: '!$2 {print $1}' /etc/shadow
  register: users_nopasswd
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy

- name: Lock users with no password
  ansible.builtin.command: |
    passwd -l {{ item }}
  with_items: '{{ users_nopasswd.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - users_nopasswd is not skipped and users_nopasswd.stdout_lines | length &gt; 0
  tags:
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.2
  - high_severity
  - low_complexity
  - low_disruption
  - no_empty_passwords_etc_shadow
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_empty_passwords_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_empty_passwords_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_forward_files" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify No .forward Files Exist</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">.forward</html:code> file specifies an email address to forward the user's mail to.</description>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Use of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">.forward</html:code> file poses a security risk in that sensitive data may
be inadvertently transferred outside the organization. The .forward file
also poses a risk as it can be used to execute commands that may perform
unintended actions.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_forward_files:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_forward_files_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_root_logins">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Root Logins</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">sudo</html:code> to execute
privileged commands. Discouraging administrators from accessing the
root account directly ensures an audit trail in organizations with
multiple administrators. Locking down the channels through which
root can connect directly also reduces opportunities for
password-guessing against the root account. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">login</html:code> program
uses the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/securetty</html:code> to determine which interfaces
should allow root logins.

The virtual devices <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/console</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/tty*</html:code> represent the system consoles (accessible via
the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
installation). The default securetty file also contains <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/vc/*</html:code>.
These are likely to be deprecated in most environments, but may be retained
for compatibility. Root should also be prohibited from connecting
via network protocols. Other sections of this document
include guidance describing how to prevent root from logging in via SSH.</description>
          <Value id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Group Name Used by pam_wheel Group Parameter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">pam_wheel module has a parameter called group, which controls which groups
can access the su command.
This variable holds the valid value for the parameter.</description>
            <value>sugroup</value>
            <value selector="cis">sugroup</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Only Root Has UID 0</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned.</description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(b)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.9</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_no_uid_except_zero" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

awk -F: '$3 == 0 &amp;&amp; $1 != "root" { print $1 }' /etc/passwd | xargs --no-run-if-empty --max-lines=1 passwd -l

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_no_uid_except_zero" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6(5)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-4(b)
  - PCI-DSS-Req-8.5
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.1
  - accounts_no_uid_except_zero
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Get all /etc/passwd file entries
  ansible.builtin.getent:
    database: passwd
    split: ':'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6(5)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-4(b)
  - PCI-DSS-Req-8.5
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.1
  - accounts_no_uid_except_zero
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy

- name: Lock the password of the user accounts other than root with uid 0
  ansible.builtin.command: passwd -l {{ item.key }}
  loop: '{{ getent_passwd | dict2items | rejectattr(''key'', ''search'', ''root'')
    | list }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.value.1  == '0'
  tags:
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-6(5)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-4(b)
  - PCI-DSS-Req-8.5
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.1
  - accounts_no_uid_except_zero
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_no_uid_except_zero:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" selected="false" role="full" severity="high">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Root Has A Primary GID 0</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user should have a primary group of 0.</description>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To help ensure that root-owned files are not inadvertently exposed to other users.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_root_gid_zero:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_root_gid_zero_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that the group <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" use="legacy"/></html:code> referenced by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">var_pam_wheel_group_for_su</html:code> variable and used as value for the <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_wheel.so</html:code>
         <html:code xmlns:html="http://www.w3.org/1999/xhtml">group</html:code> option exists and has no members. This empty group used by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_wheel.so</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/su</html:code> ensures that no user can run commands with
altered privileges through the <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> command.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that this rule just ensures the group exists and has no members. This rule does not
configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_wheel.so</html:code> module. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_wheel.so</html:code> module configuration is
accomplished by <html:code xmlns:html="http://www.w3.org/1999/xhtml">use_pam_wheel_group_for_su</html:code> rule.</warning>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_pam_wheel_group_for_su:var:1" value-id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su"/>
              <check-content-ref name="oval:ssg-ensure_pam_wheel_group_empty:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-ensure_pam_wheel_group_empty_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_ensure_root_password_configured" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Authentication Required for Single User Mode</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Single user mode is used for recovery when the system detects an
issue during boot or by manual selection from the bootloader.</description>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Requiring authentication in single user mode prevents an unauthorized
user from rebooting the system into single user to gain root privileges
without credentials.</rationale>
            <platform idref="#system_with_kernel"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_root_password_configured:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-ensure_root_password_configured_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that System Accounts Are Locked</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some accounts are not associated with a human user of the system, and exist to perform some
administrative functions. An attacker should not be able to log into these accounts.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
System accounts are those user accounts with a user ID less than <html:code xmlns:html="http://www.w3.org/1999/xhtml">1000</html:code>.
If any system account other than <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">sync</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">shutdown</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfsnobody</html:code> has an unlocked password, disable it with the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo usermod -L <html:i>account</html:i>
         </html:pre>
        </description>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling authentication for default system accounts makes it more difficult for attackers
to make use of them to compromise a system.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_password_auth_for_systemaccounts" system="urn:xccdf:fix:script:sh" complexity="low" disruption="medium" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

readarray -t systemaccounts &lt; &lt;(awk -F: \
  '($3 &lt; 1000 &amp;&amp; $3 != root &amp;&amp; $3 != halt &amp;&amp; $3 != sync &amp;&amp; $3 != shutdown \
  &amp;&amp; $3 != nfsnobody) { print $1 }' /etc/passwd)

for systemaccount in "${systemaccounts[@]}"; do
    usermod -L "$systemaccount"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_password_auth_for_systemaccounts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy

- name: Ensure that System Accounts Are Locked - Get All Local Users From /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy

- name: Ensure that System Accounts Are Locked - Create local_users Variable From
    getent_passwd Facts
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd | dict2items }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy

- name: Ensure that System Accounts Are Locked - Lock System Accounts
  ansible.builtin.user:
    name: '{{ item.key }}'
    password_lock: true
  loop: '{{ local_users }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.value[1]|int &lt; 1000
  - item.key not in ['root', 'halt', 'sync', 'shutdown', 'nfsnobody']
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_password_auth_for_systemaccounts
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_password_auth_for_systemaccounts:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that System Accounts Do Not Run a Shell Upon Login</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Some accounts are not associated with a human user of the system, and exist to perform some
administrative functions. Should an attacker be able to log into these accounts, they should
not be granted access to a shell.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The login shell for each local account is stored in the last field of each line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>. System accounts are those user accounts with a user ID less than
<html:code xmlns:html="http://www.w3.org/1999/xhtml">1000</html:code>. The user ID is stored in the third field. If any system account
other than <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> has a login shell, disable it with the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo usermod -s /sbin/nologin <html:i>account</html:i>
         </html:pre>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Do not perform the steps in this section on the root account. Doing so might cause the
system to become inaccessible.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1491</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensuring shells are not given to system accounts upon login makes it more difficult for
attackers to make use of system accounts.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_shelllogin_for_systemaccounts" system="urn:xccdf:fix:script:sh" complexity="low" disruption="medium" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

readarray -t systemaccounts &lt; &lt;(awk -F: '($3 &lt; 1000 &amp;&amp; $3 != root \
  &amp;&amp; $7 != "\/sbin\/shutdown" &amp;&amp; $7 != "\/sbin\/halt" &amp;&amp; $7 != "\/bin\/sync") \
  { print $1 }' /etc/passwd)

for systemaccount in "${systemaccounts[@]}"; do
    usermod -s /sbin/nologin "$systemaccount"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_shelllogin_for_systemaccounts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Get All Local
    Users From /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login - Create local_users
    Variable From getent_passwd Facts
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd | dict2items }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy

- name: Ensure that System Accounts Do Not Run a Shell Upon Login -  Disable Login
    Shell for System Accounts
  ansible.builtin.user:
    name: '{{ item.key }}'
    shell: /sbin/nologin
  loop: '{{ local_users }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.key not in ['root']
  - item.value[1]|int &lt; 1000
  - item.value[5] not in ['/sbin/shutdown', '/sbin/halt', '/bin/sync']
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.2
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - no_shelllogin_for_systemaccounts
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-no_shelllogin_for_systemaccounts:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enforce Usage of pam_wheel with Group Parameter for su Authentication</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure that only users who are members of the group set in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">group</html:code> option of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">pam_wheel.so</html:code> module can run commands with altered privileges through the <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code>
command, make sure that the following line exists in the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/pam.d/su</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">auth required pam_wheel.so use_uid group=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su" use="legacy"/>
         </html:pre>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that <html:code xmlns:html="http://www.w3.org/1999/xhtml">ensure_pam_wheel_group_empty</html:code> rule complements this requirement by
ensuring the referenced group exists and has no members.</warning>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.3.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">su</html:code> program allows to run commands with a substitute user and group ID.
It is commonly used to run commands as the root user.
Limiting access to such command is considered a good security practice.</rationale>
            <platform idref="#package_pam"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_pam_wheel_group_for_su:var:1" value-id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su"/>
              <check-content-ref name="oval:ssg-use_pam_wheel_group_for_su:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-use_pam_wheel_group_for_su_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_accounts-session">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Secure Session Configuration Files for Login Accounts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When a user logs into a Unix account, the system
configures the user's session by reading a number of files. Many of
these files are located in the user's home directory, and may have
weak permissions as a result of user error or misconfiguration. If
an attacker can modify or even read certain types of account
configuration information, they can often gain full access to the
affected user's account. Therefore, it is important to test and
correct configuration file permissions for interactive accounts,
particularly those of privileged users such as root or system
administrators.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_accounts_tmout" type="number">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account Inactivity Timeout (seconds)</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In an interactive shell, the value is interpreted as the
number of seconds to wait for input after issuing the primary prompt.
Bash terminates after waiting for that number of seconds if input does
not arrive.</description>
          <value selector="30_min">1800</value>
          <value selector="10_min">600</value>
          <value selector="15_min">900</value>
          <value selector="5_min">300</value>
          <value>600</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Interactive users initialization files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">'A regular expression describing a list of file names
for files that are sourced at login time for interactive users'</description>
          <value>^(\.bashrc|\.zshrc|\.cshrc|\.profile|\.bash_login|\.bash_profile)$</value>
          <value selector="all_dotfiles">^\.[\w\- ]+$</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Interactive Session Timeout</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the <html:code xmlns:html="http://www.w3.org/1999/xhtml">TMOUT</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> ensures that
all user sessions will terminate based on inactivity. A value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code> (zero)
disables the automatic logout feature and is therefore not a compliant setting.
The value of TMOUT should be a positive integer, exported, and read only.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">TMOUT</html:code>

setting in a file loaded by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code>, e.g.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile.d/tmout.sh</html:code> should read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">typeset -xr TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
        </html:pre>
or
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">declare -xr TMOUT=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
        </html:pre>
Using the <html:code xmlns:html="http://www.w3.org/1999/xhtml">typeset</html:code> keyword is preferred for wider compatibility with ksh and other shells.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R32</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_tmout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_accounts_tmout='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>'


# if 0, no occurrence of tmout found, if 1, occurrence found
tmout_found=0


for f in /etc/profile /etc/profile.d/*.sh; do

    if grep --silent '^[^#].*TMOUT' $f; then
        sed -i -E "s/^(.*)TMOUT\s*=\s*(\w|\$)*(.*)$/typeset -xr TMOUT=$var_accounts_tmout\3/g" $f
        tmout_found=1
    fi
done

if [ $tmout_found -eq 0 ]; then
        echo -e "\n# Set TMOUT to $var_accounts_tmout per security requirements" &gt;&gt; /etc/profile.d/tmout.sh
        echo "typeset -xr TMOUT=$var_accounts_tmout" &gt;&gt; /etc/profile.d/tmout.sh
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_tmout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_tmout # promote to variable
  set_fact:
    var_accounts_tmout: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" use="legacy"/>
  tags:
    - always

- name: Correct any occurrence of TMOUT in /etc/profile
  ansible.builtin.replace:
    path: /etc/profile
    regexp: ^[^#].*TMOUT=.*
    replace: typeset -xr TMOUT={{ var_accounts_tmout }}
  register: profile_replaced
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set Interactive Session Timeout
  ansible.builtin.lineinfile:
    path: /etc/profile.d/tmout.sh
    create: true
    regexp: TMOUT=
    line: typeset -xr TMOUT={{ var_accounts_tmout }}
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSSv4-8.6
  - PCI-DSSv4-8.6.1
  - accounts_tmout
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_accounts_tmout:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_tmout"/>
            <check-content-ref name="oval:ssg-accounts_tmout:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_tmout_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">User Initialization Files Must Be Group-Owned By The Primary Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the group owner of interactive users files to the group found
in <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:pre> for the user. To change the group owner of a local
interactive user home directory, use the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp <html:i>USER_GROUP</html:i> /home/<html:i>USER</html:i>/.<html:i>INIT_FILE</html:i>
        </html:pre>

This rule ensures every initialization file related to an interactive user
is group-owned by an interactive user.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective initialization files.</warning>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Local initialization files for interactive users are used to configure the
user's shell environment upon logon. Malicious modification of these files could
compromise accounts upon logon.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_dot_group_ownership" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

awk -F: '{if ($4 &gt;= 1000 &amp;&amp; $4 != 65534) print $4":"$6}' /etc/passwd | while IFS=: read -r gid home; do find -P "$home" -maxdepth 1 -type f -name "\.[^.]*" -exec chgrp -f --no-dereference -- $gid "{}" \;; done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_dot_group_ownership" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Group-Owned By The Primary Group - Get interactive
    users from passwd file
  ansible.builtin.getent:
    database: passwd
  register: passwd_entries
  when: '"kernel" in ansible_facts.packages'
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Group-Owned By The Primary Group - Create
    list of interactive users with GID and home directory
  ansible.builtin.set_fact:
    interactive_users: '{{ interactive_users | default([]) + [{''home'': item.value[4],
      ''gid'': item.value[2]}] }}'
  loop: '{{ passwd_entries.ansible_facts.getent_passwd | dict2items }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.value[2] | int &gt;= 1000 | int
  - item.value[2] | int != 65534 | int
  - item.value[4] != ""
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Group-Owned By The Primary Group - Find
    dot files in interactive user home directories
  ansible.builtin.find:
    paths: '{{ item.home }}'
    patterns: .*
    file_type: file
    hidden: true
    depth: 1
    follow: false
  register: user_dotfiles
  loop: '{{ interactive_users | default([]) }}'
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - item.home != ""
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Group-Owned By The Primary Group - Set correct
    group ownership for user initialization files
  ansible.builtin.file:
    path: '{{ item.1.path }}'
    group: '{{ item.0.item.gid }}'
    follow: false
  loop: '{{ user_dotfiles.results | subelements(''files'', skip_missing=True) }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.0 is not skipped
  - item.1.path is defined
  tags:
  - accounts_user_dot_group_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_user_dot_group_ownership:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_user_dot_group_ownership_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">User Initialization Files Must Be Owned By the Primary User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the owner of the user initialization files for interactive users to
the primary owner with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown <html:i>USER</html:i> /home/<html:i>USER</html:i>/.*</html:pre>

This rule ensures every initialization file related to an interactive user
is owned by an interactive user.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
their respective initialization files.</warning>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_dot_user_ownership" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

awk -F: '{if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $3":"$6}' /etc/passwd | while IFS=: read -r uid home; do find -P "$home" -maxdepth 1 -type f -name "\.[^.]*" -exec chown -f --no-dereference -- $uid "{}" \;; done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_dot_user_ownership" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Owned By the Primary User - Get interactive
    users from passwd file
  ansible.builtin.getent:
    database: passwd
  register: passwd_entries
  when: '"kernel" in ansible_facts.packages'
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Owned By the Primary User - Create list
    of interactive users with UID and home directory
  ansible.builtin.set_fact:
    interactive_users: '{{ interactive_users | default([]) + [{''uid'': item.value[1],
      ''home'': item.value[4], ''username'': item.key}] }}'
  loop: '{{ passwd_entries.ansible_facts.getent_passwd | dict2items }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.value[1] | int &gt;= 1000 | int
  - item.value[1] | int != 65534 | int
  - item.value[4] != ""
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Owned By the Primary User - Find dot files
    in interactive user home directories
  ansible.builtin.find:
    paths: '{{ item.home }}'
    patterns: .*
    file_type: file
    hidden: true
    depth: 1
    follow: false
  register: user_dotfiles
  loop: '{{ interactive_users | default([]) }}'
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - item.home != ""
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: User Initialization Files Must Be Owned By the Primary User - Set correct
    ownership for user initialization files
  ansible.builtin.file:
    path: '{{ item.1.path }}'
    owner: '{{ item.0.item.username }}'
    follow: false
  loop: '{{ user_dotfiles.results | subelements(''files'', skip_missing=True) }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.0 is not skipped
  - item.0 is not failed
  - item.0.item is defined
  - item.0.item.username is defined
  - item.1.path is defined
  tags:
  - accounts_user_dot_user_ownership
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_user_dot_user_ownership:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_user_dot_user_ownership_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All Interactive Users Home Directories Must Exist</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Create home directories to all local interactive users that currently do not
have a home directory assigned. Use the following commands to create the user
home directory assigned in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo mkdir /home/<html:i>USER</html:i>
        </html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.10</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a local interactive user has a home directory defined that does not exist,
the user may be given access to the / directory as the current working directory
upon logon. This could create a Denial of Service because the user would not be
able to access their logon configuration files, and it may give them visibility
to system files they normally would not be able to access.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_interactive_home_directory_exists" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $1}' /etc/passwd); do
    mkhomedir_helper $user 0077;
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_user_interactive_home_directory_exists" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive users have a home directory exists
  ansible.builtin.user:
    name: '{{ item.key }}'
    create_home: true
  loop: '{{ local_users }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  tags:
  - accounts_user_interactive_home_directory_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_user_interactive_home_directory_exists:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_user_interactive_home_directory_exists_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_accounts_users_netrc_file_permissions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure users' .netrc Files are not group or world accessible</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">While the system administrator can establish secure permissions for users' .netrc files, the
users can easily override these.

This rule ensures every .netrc file or directory under the home directory related
to an interactive user is not group or world accessible</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">.netrc files may contain unencrypted passwords that may be used to attack other systems.
Note: While the complete removal of .netrc files is recommended, if any are required on the
      system, secure permissions must be applied.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_users_netrc_file_permissions" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
for user in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) print $1 }' /etc/passwd); do
    home_dir=$(getent passwd "$user" | cut -d: -f6)
    find "${home_dir}/.netrc" -exec chmod 0600 {} \;
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_users_netrc_file_permissions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - accounts_users_netrc_file_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - accounts_users_netrc_file_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of .netrc file in home directories to avoid creating them,
    but only fixing permissions
  ansible.builtin.stat:
    path: '{{ item.value[4] }}/.netrc'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  tags:
  - accounts_users_netrc_file_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure group and world cannot access respective .netrc files
  ansible.builtin.file:
    path: '{{ item.item.value[4] }}/.netrc'
    mode: '0600'
    state: file
  loop: '{{ path_exists.results }}'
  when: item.stat is defined and item.stat.exists
  tags:
  - accounts_users_netrc_file_permissions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-accounts_users_netrc_file_permissions:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-accounts_users_netrc_file_permissions_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All Interactive User Home Directories Must Be Group-Owned By The Primary Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the group owner of interactive users home directory to the
group found in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>. To change the group owner of
interactive users home directory, use the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp <html:i>USER_GROUP</html:i> /home/<html:i>USER</html:i>
        </html:pre>

This rule ensures every home directory related to an interactive user is
group-owned by an interactive user. It also ensures that interactive users
are group-owners of one and only one home directory.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective home directories.</warning>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.10</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the Group Identifier (GID) of a local interactive users home directory is
not the same as the primary GID of the user, this would allow unauthorized
access to the users files, and users that share the same group may not be
able to access files that they legitimately should.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_home_directories" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_home_directories" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    group ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the group-owners of their respective home
    directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    group: '{{ item.0.value[2] }}'
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupownership_home_directories:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupownership_home_directories_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_home_directories" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All Interactive User Home Directories Must Be Owned By The Primary User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the owner of interactive users home directories to that correct
owner. To change the owner of a interactive users home directory, use
the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown <html:i>USER</html:i> /home/<html:i>USER</html:i>
        </html:pre>

This rule ensures every home directory related to an interactive user is
owned by an interactive user. It also ensures that interactive users are
owners of one and only one home directory.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the ownership of
their respective home directories.</warning>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.10</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a local interactive user does not own their home directory, unauthorized
users could access or modify the user's files, and the users may not be able to
access their own files.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_home_directories" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534) system("chown -f " $3" "$6) }' /etc/passwd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_home_directories" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - file_ownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - file_ownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  tags:
  - file_ownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the owners of their respective home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    owner: '{{ item.0.value[1] }}'
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - file_ownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_ownership_home_directories:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_ownership_home_directories_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All User Initialization Files Have Mode 0740 Or Less Permissive</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set the mode of the user initialization files to <html:code xmlns:html="http://www.w3.org/1999/xhtml">0740</html:code> with the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0740 /home/<html:i>USER</html:i>/.<html:i>INIT_FILE</html:i>
        </html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Local initialization files are used to configure the user's shell environment
upon logon. Malicious modification of these files could compromise accounts upon
logon.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permission_user_init_files" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
var_user_initialization_files_regex='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" use="legacy"/>'


readarray -t interactive_users &lt; &lt;(awk -F: '$3&gt;=1000   {print $1}' /etc/passwd)
readarray -t interactive_users_home &lt; &lt;(awk -F: '$3&gt;=1000   {print $6}' /etc/passwd)
readarray -t interactive_users_shell &lt; &lt;(awk -F: '$3&gt;=1000   {print $7}' /etc/passwd)

USERS_IGNORED_REGEX='nobody|nfsnobody'

for (( i=0; i&lt;"${#interactive_users[@]}"; i++ )); do
    if ! grep -qP "$USERS_IGNORED_REGEX" &lt;&lt;&lt; "${interactive_users[$i]}" &amp;&amp; \
        [ "${interactive_users_shell[$i]}" != "/sbin/nologin" ]; then
        
        readarray -t init_files &lt; &lt;(find "${interactive_users_home[$i]}" -maxdepth 1 \
            -exec basename {} \; | grep -P "$var_user_initialization_files_regex")
        for file in "${init_files[@]}"; do
            chmod u-s,g-wxs,o= "${interactive_users_home[$i]}/$file"
        done
    fi
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permission_user_init_files" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_user_initialization_files_regex # promote to variable
  set_fact:
    var_user_initialization_files_regex: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex" use="legacy"/>
  tags:
    - always

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Gather
    User Info
  ansible.builtin.getent:
    database: passwd
  tags:
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Find
    Init Files
  ansible.builtin.find:
    paths: '{{ item.value[4] }}'
    pattern: '{{ var_user_initialization_files_regex }}'
    hidden: true
    use_regex: true
  with_dict: '{{ ansible_facts.getent_passwd }}'
  when:
  - item.value[4] != "/sbin/nologin"
  - item.key not in ["nobody", "nfsnobody"]
  - item.value[1] | int &gt;= 1000
  register: found_init_files
  tags:
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Fix
    Init Files Permissions
  ansible.builtin.file:
    path: '{{ item.1.path }}'
    mode: u-s,g-wxs,o=
  loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'',
    {''skip_missing'': True}) }}'
  tags:
  - file_permission_user_init_files
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_user_initialization_files_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex"/>
            <check-content-ref name="oval:ssg-file_permission_user_init_files:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permission_user_init_files_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All Interactive User Home Directories Must Have mode 0750 Or Less Permissive</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Change the mode of interactive users home directories to <html:code xmlns:html="http://www.w3.org/1999/xhtml">0750</html:code>. To
change the mode of interactive users home directory, use the
following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0750 /home/<html:i>USER</html:i>
        </html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.10</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Excessive permissions on local interactive user home directories may allow
unauthorized access to user files by other users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_home_directories" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict">
for home_dir in $(awk -F':' '{ if ($3 &gt;= 1000 &amp;&amp; $3 != 65534 &amp;&amp; $6 != "/") print $6 }' /etc/passwd); do
    # Only update the permissions when necessary. This will avoid changing the inode timestamp when
    # the permission is already defined as expected, therefore not impacting in possible integrity
    # check systems that also check inodes timestamps.
    find "$home_dir" -maxdepth 0 -perm /7027 \! -type l -exec chmod u-s,g-w-s,o=- {} \;
done
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_home_directories" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence home directories to avoid creating them.
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int &gt;= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users have proper permissions on their respective
    home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    mode: u-s,g-w-s,o=-
    follow: false
    recurse: false
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - file_permissions_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_home_directories:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_home_directories_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_root_paths">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that No Dangerous Directories Exist in Root's Path</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The active path of the root account can be obtained by
starting a new root shell and running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># echo $PATH</html:pre>
This will produce a colon-separated list of
directories in the path.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Certain path elements could be considered dangerous, as they could lead
to root executing unknown or
untrusted programs, which could contain malicious
code.
Since root may sometimes work inside
untrusted directories, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character, which represents the
current directory, should never be in the root path, nor should any
directory which can be written to by an unprivileged or
semi-privileged (system) user.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
It is a good practice for administrators to always execute
privileged commands by typing the full path to the
command.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">For each element in root's path, run:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># ls -ld <html:i>DIR</html:i>
         </html:pre>
and ensure that write permissions are disabled for group and
other.</description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_root_path_dirs_no_write" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="restrict">- name: Get root paths which are not symbolic links
  ansible.builtin.stat:
    path: '{{ item }}'
  changed_when: false
  failed_when: false
  register: root_paths
  with_items: '{{ ansible_env.PATH.split('':'') }}'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - accounts_root_path_dirs_no_write
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable writability to root directories
  ansible.builtin.file:
    path: '{{ item.item }}'
    mode: g-w,o-w
  with_items: '{{ root_paths.results }}'
  when:
  - root_paths.results is defined
  - item.stat.exists
  - not item.stat.islnk
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - accounts_root_path_dirs_no_write
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-accounts_root_path_dirs_no_write:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_root_path_no_dot" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Root's Path Does Not Include Relative Paths or Null Directories</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that none of the directories in root's path is equal to a single
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character, or
that it contains any instances that lead to relative path traversal, such as
<html:code xmlns:html="http://www.w3.org/1999/xhtml">..</html:code> or beginning a path without the slash (<html:code xmlns:html="http://www.w3.org/1999/xhtml">/</html:code>) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin</html:pre>
These empty elements have the same effect as a single <html:code xmlns:html="http://www.w3.org/1999/xhtml">.</html:code> character.</description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Including these entries increases the risk that root could
execute code from an untrusted location.</rationale>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-root_path_no_dot:def:1" href="ssg-al2023-oval.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_user_umask">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that Users Have Sensible Umask Values</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask setting controls the default permissions
for the creation of new files.
With a default <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> setting of 077, files and directories
created by users will not be readable by any other user on the
system. Users who wish to make specific files group- or
world-readable can accomplish this by using the chmod command.
Additionally, users can make all their files readable to their
group by default by setting a <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> of 027 in their shell
configuration files. If default per-user groups exist (that is, if
every user has a default group whose name is the same as that
user's username and whose only member is the user), then it may
even be safe for users to select a <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> of 007, making it very
easy to intentionally share files with groups of which the user is
a member.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       </description>
          <platform idref="#system_with_kernel"/>
          <Value id="xccdf_org.ssgproject.content_value_var_accounts_user_umask" type="string">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Sensible umask</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enter default user umask</description>
            <value selector="007">007</value>
            <value selector="022">022</value>
            <value selector="027">027</value>
            <value selector="077">077</value>
            <value>027</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Default Bash Umask is Set Correctly</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the default umask for users of the Bash shell is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/bashrc</html:code> to read
as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</rationale>
            <platform idref="#package_bash"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_bashrc" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q bash; }; then

var_accounts_user_umask='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'






grep -q "^[^#]*\bumask" /etc/bashrc &amp;&amp; \
  sed -i -E -e "s/^([^#]*\bumask)[[:space:]]+[[:digit:]]+/\1 $var_accounts_user_umask/g" /etc/bashrc
if ! [ $? -eq 0 ]; then
    echo "umask $var_accounts_user_umask" &gt;&gt; /etc/bashrc
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_bashrc" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Check if umask in /etc/bashrc is already set
  ansible.builtin.lineinfile:
    path: /etc/bashrc
    regexp: ^[^#]*\bumask\s+\d+$
    state: absent
  check_mode: true
  changed_when: false
  register: umask_replace
  when:
  - '"kernel" in ansible_facts.packages'
  - '"bash" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Replace user umask in /etc/bashrc
  ansible.builtin.replace:
    path: /etc/bashrc
    regexp: ^([^#]*\b)umask\s+\d+$
    replace: \g&lt;1&gt;umask {{ var_accounts_user_umask }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"bash" in ansible_facts.packages'
  - umask_replace.found &gt; 0
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default umask is Appended Correctly
  ansible.builtin.lineinfile:
    create: true
    path: /etc/bashrc
    line: umask {{ var_accounts_user_umask }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"bash" in ansible_facts.packages'
  - umask_replace.found == 0
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_bashrc
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
              <check-content-ref name="oval:ssg-accounts_umask_etc_bashrc:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_umask_etc_bashrc_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Default Umask is Set Correctly in login.defs</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the default umask controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">UMASK</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/login.defs</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">UMASK <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users.</rationale>
            <platform idref="#package_shadow-utils"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q shadow-utils; }; then

var_accounts_user_umask='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^UMASK")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "$var_accounts_user_umask"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^UMASK\\&gt;" "/etc/login.defs"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^UMASK\\&gt;.*/$escaped_formatted_output/gi" "/etc/login.defs"
else
    if [[ -s "/etc/login.defs" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/login.defs" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/login.defs"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/login.defs"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Check if UMASK is already set
  ansible.builtin.lineinfile:
    path: /etc/login.defs
    regexp: ^(\s*)UMASK\s+.*
    state: absent
  check_mode: true
  changed_when: false
  register: result_umask_is_set
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Replace user UMASK in /etc/login.defs
  ansible.builtin.replace:
    path: /etc/login.defs
    regexp: ^(\s*)UMASK(\s+).*
    replace: \g&lt;1&gt;UMASK\g&lt;2&gt;{{ var_accounts_user_umask }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  - result_umask_is_set.found &gt; 0
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default UMASK is Appended Correctly
  ansible.builtin.lineinfile:
    create: true
    path: /etc/login.defs
    line: UMASK {{ var_accounts_user_umask }}
  when:
  - '"kernel" in ansible_facts.packages'
  - '"shadow-utils" in ansible_facts.packages'
  - result_umask_is_set.found == 0
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_login_defs
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
              <check-content-ref name="oval:ssg-accounts_umask_etc_login_defs:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the Default Umask is Set Correctly in /etc/profile</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure the default umask controlled by <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> is set properly,
add or correct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">umask</html:code> setting in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> to read as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">umask <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
         </html:pre>

Note that <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile</html:code> also reads scripts within <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/profile.d</html:code> directory.
These scripts are also valid files to set umask value. Therefore, they should also be
considered during the check and properly remediated, if necessary.</description>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00228</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R36</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.6.5</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_profile" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_accounts_user_umask='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>'


readarray -t profile_files &lt; &lt;(find /etc/profile.d/ -type f -name '*.sh' -or -name 'sh.local')

for file in "${profile_files[@]}" /etc/profile; do
  grep -qE '^[^#]*umask' "$file" &amp;&amp; sed -i -E "s/^(\s*umask\s*)[0-7]+/\1$var_accounts_user_umask/g" "$file"
done

if ! grep -qrE '^[^#]*umask' /etc/profile*; then
  echo "umask $var_accounts_user_umask" &gt;&gt; /etc/profile
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="accounts_umask_etc_profile" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_user_umask # promote to variable
  set_fact:
    var_accounts_user_umask: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask" use="legacy"/>
  tags:
    - always

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Locate Profile
    Configuration Files Where umask Is Defined
  ansible.builtin.find:
    paths:
    - /etc/profile.d
    patterns:
    - sh.local
    - '*.sh'
    contains: ^[\s]*umask\s+\d+
  register: result_profile_d_files
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Replace Existing
    umask Value in Files From /etc/profile.d
  ansible.builtin.replace:
    path: '{{ item.path }}'
    regexp: ^(\s*)umask\s+\d+
    replace: \1umask {{ var_accounts_user_umask }}
  loop: '{{ result_profile_d_files.files }}'
  register: result_umask_replaced_profile_d
  when:
  - '"kernel" in ansible_facts.packages'
  - result_profile_d_files.matched
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Is
    Set in /etc/profile if Not Already Set Elsewhere
  ansible.builtin.lineinfile:
    create: true
    mode: 420
    path: /etc/profile
    line: umask {{ var_accounts_user_umask }}
  when:
  - '"kernel" in ansible_facts.packages'
  - not result_profile_d_files.matched
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Value
    For All Existing umask Definition in /etc/profile
  ansible.builtin.replace:
    path: /etc/profile
    regexp: ^(\s*)umask\s+\d+
    replace: \1umask {{ var_accounts_user_umask }}
  register: result_umask_replaced_profile
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - accounts_umask_etc_profile
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_user_umask:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_user_umask"/>
              <check-content-ref name="oval:ssg-accounts_umask_etc_profile:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_bootloader-grub2">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">GRUB2 bootloader configuration</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">During the boot process, the boot loader is
responsible for starting the execution of the kernel and passing
options to it. The boot loader allows for the selection of
different kernels - possibly on different partitions or media.
The default Amazon Linux 2023 boot loader for x86 systems is called GRUB2.
Options it can pass to the kernel include <html:i xmlns:html="http://www.w3.org/1999/xhtml">single-user mode</html:i>, which
provides root access without any authentication, and the ability to
disable SELinux. To prevent local users from modifying the boot
parameters and endangering security, protect the boot loader configuration
with a password and ensure its configuration file's permissions
are set properly.</description>
      <platform idref="#grub2_and_system_with_kernel"/>
      <Group id="xccdf_org.ssgproject.content_group_non-uefi">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</description>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg Group Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /boot/grub2/grub.cfg</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/boot/grub2/grub.cfg" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /boot/grub2/grub.cfg
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_grub2_cfg_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_grub2_cfg_newgroup: '0'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  ansible.builtin.stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /boot/grub2/grub.cfg
  ansible.builtin.file:
    path: /boot/grub2/grub.cfg
    follow: false
    group: '{{ file_groupowner_grub2_cfg_newgroup }}'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_grub2_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/user.cfg Group Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code> should be group-owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
group to prevent reading or modification of the file.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /boot/grub2/user.cfg</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. Non-root users who read the boot parameters
may be able to identify weaknesses in security upon boot and be able to exploit them.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_user_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/boot/grub2/user.cfg" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /boot/grub2/user.cfg
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_user_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_user_cfg_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_user_cfg_newgroup: '0'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  ansible.builtin.stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /boot/grub2/user.cfg
  ansible.builtin.file:
    path: /boot/grub2/user.cfg
    follow: false
    group: '{{ file_groupowner_user_cfg_newgroup }}'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_user_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_user_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg User Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /boot/grub2/grub.cfg </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only root should be able to modify important boot parameters.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/boot/grub2/grub.cfg" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /boot/grub2/grub.cfg
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_grub2_cfg_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_grub2_cfg_newown: '0'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  ansible.builtin.stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /boot/grub2/grub.cfg
  ansible.builtin.file:
    path: /boot/grub2/grub.cfg
    follow: false
    owner: '{{ file_owner_grub2_cfg_newown }}'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_grub2_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_user_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/user.cfg User Ownership</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code> should be owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
user to prevent reading or modification of the file.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /boot/grub2/user.cfg </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-7.1</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Only root should be able to modify important boot parameters. Also, non-root users who read
the boot parameters may be able to identify weaknesses in security upon boot and be able to
exploit them.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_user_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/boot/grub2/user.cfg" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /boot/grub2/user.cfg
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_user_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_user_cfg_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_user_cfg_newown: '0'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  ansible.builtin.stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /boot/grub2/user.cfg
  ansible.builtin.file:
    path: /boot/grub2/user.cfg
    follow: false
    owner: '{{ file_owner_user_cfg_newown }}'
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-7.1
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_user_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_user_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/grub.cfg Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permissions for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/grub.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 600 /boot/grub2/grub.cfg</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proper permissions ensure that only the root user can modify important boot
parameters.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/grub.cfg
  ansible.builtin.stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /boot/grub2/grub.cfg
  ansible.builtin.file:
    path: /boot/grub2/grub.cfg
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_grub2_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_grub2_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_user_cfg" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify /boot/grub2/user.cfg Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File permissions for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code> should be set to 600.

To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/boot/grub2/user.cfg</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 600 /boot/grub2/user.cfg</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R29</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.4.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proper permissions ensure that only the root user can read or modify important boot
parameters.</rationale>
          <platform idref="#not_container"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_user_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q grub2-common &amp;&amp; rpm --quiet -q kernel ) &amp;&amp; { ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ); }; then

chmod u-xs,g-xwrs,o-xwrt /boot/grub2/user.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_user_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /boot/grub2/user.cfg
  ansible.builtin.stat:
    path: /boot/grub2/user.cfg
  register: file_exists
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /boot/grub2/user.cfg
  ansible.builtin.file:
    path: /boot/grub2/user.cfg
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - ( "grub2-common" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-171-3.4.5
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_user_cfg
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_user_cfg:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_user_cfg_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_logging">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Syslog</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
In Amazon Linux 2023, rsyslog has replaced ksyslogd as the
syslog daemon of choice, and it includes some additional security features
such as reliable, connection-oriented (i.e. TCP) transmission of logs, the
option to log to database formats, and the encryption of log data en route to
a central logging server.
This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</description>
      <platform idref="#system_with_kernel"/>
      <Rule id="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog is Installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rsyslog is installed by default. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> package can be installed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf install rsyslog</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.1.1</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyslog package provides the rsyslog daemon, which provides
system logging services.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_rsyslog

class install_rsyslog {
  package { 'rsyslog':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "rsyslog" ; then
    dnf install -y "rsyslog"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "rsyslog"
version = "*"
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=rsyslog
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsyslog_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog_installed

- name: Ensure rsyslog is installed
  ansible.builtin.package:
    name: rsyslog
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsyslog_installed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_rsyslog_installed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog Default File Permissions Configured</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">rsyslog will create logfiles that do not already exist on the system.
This settings controls what permissions will be applied to these newly
created files.</description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.1.4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is important to ensure that log files have the correct permissions
to ensure that sensitive data is archived and protected.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_filecreatemode" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

sed -i '/^\s*$FileCreateMode/d' /etc/rsyslog.d/*

if ! grep -qE '^\s*\$FileCreateMode\s+0640' /etc/rsyslog.conf; then
    if grep -qE '^\s*\$FileCreateMode' /etc/rsyslog.conf; then
        sed -i '/^\s*\$FileCreateMode/ s/^/#/' /etc/rsyslog.conf
    fi
    ## Assume there is no filter named as 00-, otherwise those filters might be included before this configuration and create file with different permissions
    echo '$FileCreateMode 0640' &gt; /etc/rsyslog.d/00-rsyslog_filecreatemode.conf
fi

systemctl restart rsyslog.service

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_filecreatemode" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Search for $FileCreateMode
    Parameter in rsyslog Main Config File
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: ^\s*\$FileCreateMode\s*\d+
  register: rsyslog_main_file_with_filecreatemode
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Search for $FileCreateMode
    Parameter in rsyslog Include Files
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: ^\s*\$FileCreateMode\s*\d+
  register: rsyslog_includes_with_filecreatemode
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Assemble List of rsyslog
    Configuration Files with $FileCreateMode Parameter
  ansible.builtin.set_fact:
    rsyslog_filecreatemode_files: '{{ rsyslog_main_file_with_filecreatemode.files
      | map(attribute=''path'') | list + rsyslog_includes_with_filecreatemode.files
      | map(attribute=''path'') | list }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Remove $FileCreateMode
    Parameter from Multiple Files to Avoid Conflicts
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    regexp: \$FileCreateMode.*
    state: absent
  register: result_rsyslog_filecreatemode_removed
  loop: '{{ rsyslog_filecreatemode_files }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_filecreatemode_files | length &gt; 1
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Add $FileCreateMode Parameter
    and Expected Value
  ansible.builtin.lineinfile:
    path: /etc/rsyslog.d/00-rsyslog_filecreatemode.conf
    line: $FileCreateMode 0640
    mode: 416
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_filecreatemode_files | length == 0 or result_rsyslog_filecreatemode_removed
    is not skipped
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode

- name: Ensure rsyslog Default File Permissions Configured - Ensure Correct Value
    of Existing $FileCreateMode Parameter
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    regexp: ^\$FileCreateMode
    line: $FileCreateMode 0640
  loop: '{{ rsyslog_filecreatemode_files }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_filecreatemode_files | length == 1
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_filecreatemode
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-rsyslog_filecreatemode:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-rsyslog_filecreatemode_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Proper Configuration of Log Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i xmlns:html="http://www.w3.org/1999/xhtml">rules</html:i>, which consist of a
<html:i xmlns:html="http://www.w3.org/1999/xhtml">selector</html:i> and an <html:i xmlns:html="http://www.w3.org/1999/xhtml">action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Amazon Linux 2023 are:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log</html:pre>
See the man page <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog.conf(5)</html:code> for more information.
<html:i xmlns:html="http://www.w3.org/1999/xhtml">Note that the <html:code>rsyslog</html:code> daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file <html:code>/etc/rsyslog.conf</html:code> and add or edit the following line:</html:i>
       <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre>
      </description>
        <platform idref="#package_rsyslog"/>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Log Files Are Owned By Appropriate Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The group-owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.
These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the owner is not <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>,
run the following command to
correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root <html:i>LOGFILE</html:i>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.3</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_groupownership" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chgrp"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "root" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_groupownership" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership

- name: Ensure Log Files Are Owned By Appropriate Group -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    group: root
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_groupownership
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_groupownership:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Log Files Are Owned By Appropriate User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The owner of all log files written by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should be

<html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.

These log files are determined by the second part of each Rule line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i> referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the owner is not

<html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>,

run the following command to
correct this:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root <html:i>LOGFILE</html:i>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.3</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_ownership" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chown"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "root" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_ownership" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership

- name: Ensure Log Files Are Owned By Appropriate User -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    owner: root
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_ownership
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_ownership:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure System Log Files Have Correct Permissions</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file permissions for all log files written by <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> should
be set to 640, or more restrictive. These log files are determined by the
second part of each Rule line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and typically
all appear in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>. For each log file <html:i xmlns:html="http://www.w3.org/1999/xhtml">LOGFILE</html:i>
referenced in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>, run the following command to
inspect the file's permissions:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ ls -l <html:i>LOGFILE</html:i>
        </html:pre>
If the permissions are not 640 or more restrictive, run the following
command to correct this:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 640 <html:i>LOGFILE</html:i>
        </html:pre>"</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.3</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_permissions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; rpm --quiet -q rsyslog; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t OLD_INC &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
readarray -t NEW_INC &lt; &lt;(sed -n '/^\s*include(/,/)/Ip' /etc/rsyslog.conf | sed -n 's@.*file\s*=\s*"\([/[:alnum:][:punct:]]*\)".*@\1@Ip')
readarray -t RSYSLOG_INCLUDE &lt; &lt;(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

# Array to hold all rsyslog config entries
RSYSLOG_CONFIGS=()
RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")

# Get full list of files to be checked
# RSYSLOG_CONFIGS may contain globs such as
# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
RSYSLOG_CONFIG_FILES=()
for ENTRY in "${RSYSLOG_CONFIGS[@]}"
do
	# If directory, rsyslog will search for config files in recursively.
	# However, files in hidden sub-directories or hidden files will be ignored.
	if [ -d "${ENTRY}" ]
	then
		readarray -t FINDOUT &lt; &lt;(find "${ENTRY}" -not -path '*/.*' -type f)
		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
	elif [ -f "${ENTRY}" ]
	then
		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
	else
		echo "Invalid include object: ${ENTRY}"
	fi
done

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the
	# following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(awk '{if(NF&gt;=2&amp;&amp;($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split
		# the particular matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

# Check for RainerScript action log format which might be also multiline so grep regex is a bit
# curly:
# extract possibly multiline action omfile expressions
# extract File="logfile" expression
# match only "logfile" expression
for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
do
	ACTION_OMFILE_LINES=$(grep -iozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" "${LOG_FILE}")
	OMFILE_LINES=$(echo "${ACTION_OMFILE_LINES}"| grep -iaoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)")
	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
done

# Ensure the correct attribute if file exists
FILE_CMD="chmod"
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi
	$FILE_CMD "0640" "$LOG_FILE_PATH"
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_files_permissions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Set rsyslog logfile configuration
    facts
  ansible.builtin.set_fact:
    rsyslog_etc_config: /etc/rsyslog.conf
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Get IncludeConfig directive
  ansible.builtin.shell: |
    set -o pipefail
    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
  register: rsyslog_old_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Get include files directives
  ansible.builtin.shell: |
    set -o pipefail
    awk '/)/{f=0} /include\(/{f=1} f{ nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){ print nf }}' {{ rsyslog_etc_config }} || true
  register: rsyslog_new_inc
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Aggregate rsyslog includes
  ansible.builtin.set_fact:
    include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
      }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - List all config files
  ansible.builtin.find:
    paths: '{{ item | dirname }}'
    patterns: '{{ item | basename }}'
    hidden: false
    follow: true
  loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - include_config_output is defined
  register: rsyslog_config_files
  failed_when: false
  changed_when: false
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Extract log files old format
  ansible.builtin.shell: |
    set -o pipefail
    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
    awk '{print $NF}' | \
    sed -e 's/^-//' || true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_old
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Extract log files new format
  ansible.builtin.shell: |
    set -o pipefail
    grep -ozP "action\s*\(\s*type\s*=\s*\"omfile\"[^\)]*\)" {{ item.1.path }} | \
    grep -aoP "\bFile\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
    grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
    tr -d "\""|| true
  loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
  register: log_files_new
  changed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  - rsyslog_config_files is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions - Sum all log files found
  ansible.builtin.set_fact:
    log_files: '{{ log_files_new.results | map(attribute=''stdout_lines'') | list
      | flatten | unique + log_files_old.results | map(attribute=''stdout_lines'')
      | list | flatten | unique }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions

- name: Ensure System Log Files Have Correct Permissions -Setup log files attribute
  ansible.builtin.file:
    path: '{{ item }}'
    mode: '0640'
    state: file
  loop: '{{ log_files | list | flatten | unique }}'
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"rsyslog" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.1
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_files_permissions
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_files_permissions:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_journald">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">systemd-journald</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">systemd-journald is a system service that collects and stores
logging data. It creates and maintains structured, indexed
journals based on logging information that is received from a
variety of sources.

For more information on <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-journald </html:code> and additional <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-journald</html:code> configuration options, see
<html:b xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://systemd.io/">https://systemd.io/</html:a></html:b>.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable systemd-journald Service</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-journald</html:code> service is an essential component of
systemd.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">systemd-journald</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable systemd-journald.service</html:pre>
       </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-24</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000269-GPOS-00103</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In the event of a system failure, Amazon Linux 2023 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-journald_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_systemd-journald

class enable_systemd-journald {
  service {'systemd-journald':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-journald_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'systemd-journald.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'systemd-journald.service'
fi
"$SYSTEMCTL_EXEC" enable 'systemd-journald.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-journald_enabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
enabled = ["systemd-journald"]
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_systemd-journald_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-SC-24
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-journald_enabled

- name: Enable systemd-journald Service - Enable service systemd-journald
  block:

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto

  - name: Enable systemd-journald Service - Enable Service systemd-journald
    ansible.builtin.systemd:
      name: systemd-journald
      enabled: true
      state: started
      masked: false
    when:
    - '"systemd" in ansible_facts.packages'
  tags:
  - NIST-800-53-SC-24
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_systemd-journald_enabled
  - special_service_block
  when: '"kernel" in ansible_facts.packages'
</fix>
          <check system="http://open-scap.org/page/SCE">
            <check-import import-name="stdout">
                </check-import>
            <check-content-ref href="al2023/checks/sce/service_systemd-journald_enabled.sh"/>
          </check>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_systemd-journald_enabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_systemd-journald_enabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_journald_compress" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure journald is configured to compress large log files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The journald system can compress large log files to avoid fill the system disk.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.2.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log files that are not properly compressed run the risk of growing so large that they fill up the log partition. Valuable logging information could be lost if the log partition becomes full.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_compress" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Compress\s*=\s*/d" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/journald.conf"

cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert before the line matching the regex '^#\s*Compress'.
line_number="$(LC_ALL=C grep -n "^#\s*Compress" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^#\s*Compress', insert at
    # the end of the file.
    printf '%s\n' "Compress=yes" &gt;&gt; "/etc/systemd/journald.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" &gt; "/etc/systemd/journald.conf"
    printf '%s\n' "Compress=yes" &gt;&gt; "/etc/systemd/journald.conf"
    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" &gt;&gt; "/etc/systemd/journald.conf"
fi
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_compress" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - journald_compress
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Setting unquoted shell-style assignment of 'Compress' to 'yes' in '/etc/systemd/journald.conf'
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Compress=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Compress=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Compress=
      line: Compress=yes
      state: present
      insertbefore: ^# Compress
      validate: /usr/bin/bash -n %s
  when: '"kernel" in ansible_facts.packages'
  tags:
  - journald_compress
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-journald_compress:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-journald_compress_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_journald_forward_to_syslog" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure journald is configured to send logs to rsyslog</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Data from journald may be stored in volatile memory or persisted locally.
Utilities exist to accept remote export of journald logs.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.1.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_forward_to_syslog" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/journald.conf"

cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert before the line matching the regex '^#\s*ForwardToSyslog'.
line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^#\s*ForwardToSyslog', insert at
    # the end of the file.
    printf '%s\n' "ForwardToSyslog=yes" &gt;&gt; "/etc/systemd/journald.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" &gt; "/etc/systemd/journald.conf"
    printf '%s\n' "ForwardToSyslog=yes" &gt;&gt; "/etc/systemd/journald.conf"
    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" &gt;&gt; "/etc/systemd/journald.conf"
fi
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_forward_to_syslog" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - journald_forward_to_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Setting unquoted shell-style assignment of 'ForwardToSyslog' to 'yes' in '/etc/systemd/journald.conf'
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*ForwardToSyslog=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*ForwardToSyslog=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*ForwardToSyslog=
      line: ForwardToSyslog=yes
      state: present
      insertbefore: ^# ForwardToSyslog
      validate: /usr/bin/bash -n %s
  when: '"kernel" in ansible_facts.packages'
  tags:
  - journald_forward_to_syslog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-journald_forward_to_syslog:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-journald_forward_to_syslog_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_journald_storage" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure journald is configured to write log files to persistent disk</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The journald system may store log files in volatile memory or locally on disk.
If the logs are only stored in volatile memory they will be lost upon reboot.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.2.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Log files contain valuable data and need to be persistent to aid in possible investigations.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_storage" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -e "/etc/systemd/journald.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/d" "/etc/systemd/journald.conf"
else
    touch "/etc/systemd/journald.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/systemd/journald.conf"

cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
# Insert before the line matching the regex '^#\s*Storage'.
line_number="$(LC_ALL=C grep -n "^#\s*Storage" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^#\s*Storage', insert at
    # the end of the file.
    printf '%s\n' "Storage=persistent" &gt;&gt; "/etc/systemd/journald.conf"
else
    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" &gt; "/etc/systemd/journald.conf"
    printf '%s\n' "Storage=persistent" &gt;&gt; "/etc/systemd/journald.conf"
    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" &gt;&gt; "/etc/systemd/journald.conf"
fi
# Clean up after ourselves.
rm "/etc/systemd/journald.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="journald_storage" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Setting unquoted shell-style assignment of 'Storage' to 'persistent' in '/etc/systemd/journald.conf'
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Storage=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Storage=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/systemd/journald.conf
    ansible.builtin.lineinfile:
      path: /etc/systemd/journald.conf
      create: true
      regexp: (?i)^\s*Storage=
      line: Storage=persistent
      state: present
      insertbefore: ^# Storage
      validate: /usr/bin/bash -n %s
  when: '"kernel" in ansible_facts.packages'
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-journald_storage:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-journald_storage_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable systemd-journal-remote Socket</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Journald supports the ability to receive messages from remote hosts,
thus acting as a log server. Clients should not receive data from
other hosts.
NOTE:
    The same package, systemd-journal-remote , is used for both sending
    logs to remote hosts and receiving incoming logs.
    With regards to receiving logs, there are two Systemd unit files;
    systemd-journal-remote.socket and systemd-journal-remote.service.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.2.1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a client is configured to also receive data, thus turning it into
a server, the client system is acting outside it's operational boundary.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="socket_systemd-journal-remote_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SOCKET_NAME="systemd-journal-remote.socket"
SYSTEMCTL_EXEC='/usr/bin/systemctl'

if "$SYSTEMCTL_EXEC" -q list-unit-files --type socket | grep -q "$SOCKET_NAME"; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop "$SOCKET_NAME"
    fi
    "$SYSTEMCTL_EXEC" mask "$SOCKET_NAME"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="socket_systemd-journal-remote_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled

- name: Disable systemd-journal-remote Socket - Collect systemd Socket Units Present
    in the System
  ansible.builtin.command:
    cmd: systemctl -q list-unit-files --type socket
  register: result_systemd_unit_files
  changed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled

- name: Disable systemd-journal-remote Socket - Ensure systemd-journal-remote.socket
    is Masked
  ansible.builtin.systemd:
    name: systemd-journal-remote.socket
    state: stopped
    enabled: false
    masked: true
  when:
  - '"kernel" in ansible_facts.packages'
  - result_systemd_unit_files.stdout_lines is search("systemd-journal-remote.socket")
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - socket_systemd-journal-remote_disabled
</fix>
          <check system="http://open-scap.org/page/SCE">
            <check-import import-name="stdout">
                </check-import>
            <check-content-ref href="al2023/checks/sce/socket_systemd-journal-remote_disabled.sh"/>
          </check>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-socket_systemd-journal-remote_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-socket_systemd-journal-remote_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the system is not a log server, then lines concerning these modules
should remain commented out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> daemon should not accept remote messages unless the system acts as a log
server. To ensure that it is not listening on the network, ensure any of the following lines
are <html:i xmlns:html="http://www.w3.org/1999/xhtml">not</html:i> found in <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> configuration files.

If using legacy syntax:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ModLoad imtcp
$InputTCPServerRun <html:i>port</html:i>
$ModLoad imudp
$UDPServerRun <html:i>port</html:i>
$ModLoad imrelp
$InputRELPServerRun <html:i>port</html:i>
        </html:pre>

If using RainerScript syntax:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">module(load="imtcp")
module(load="imudp")
input(type="imtcp" port="514")
input(type="imudp" port="514")
</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.1.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Any process which receives messages from the network incurs some risk of receiving malicious
messages. This risk can be eliminated for rsyslog by configuring it not to listen on the
network.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_nolisten" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

legacy_regex='^\s*\$(((Input(TCP|RELP)|UDP)ServerRun)|ModLoad\s+(imtcp|imudp|imrelp))'
rainer_regex='^\s*(module|input)\((load|type)="(imtcp|imudp)".*$'

readarray -t legacy_targets &lt; &lt;(grep -l -E -r "${legacy_regex[@]}" /etc/rsyslog.conf /etc/rsyslog.d/)
readarray -t rainer_targets &lt; &lt;(grep -l -E -r "${rainer_regex[@]}" /etc/rsyslog.conf /etc/rsyslog.d/)

config_changed=false
if [ ${#legacy_targets[@]} -gt 0 ]; then
    for target in "${legacy_targets[@]}"; do
        sed -E -i "/$legacy_regex/ s/^/# /" "$target"
    done
    config_changed=true
fi

if [ ${#rainer_targets[@]} -gt 0 ]; then
    for target in "${rainer_targets[@]}"; do
        sed -E -i "/$rainer_regex/ s/^/# /" "$target"
    done
    config_changed=true
fi

if $config_changed; then
    systemctl restart rsyslog.service
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_nolisten" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Define Rsyslog Config Lines Regex in Legacy Syntax
  ansible.builtin.set_fact:
    rsyslog_listen_legacy_regex: ^\s*\$(((Input(TCP|RELP)|UDP)ServerRun)|ModLoad\s+(imtcp|imudp|imrelp))
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for Legacy Config Lines in Rsyslog Main Config File
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: '{{ rsyslog_listen_legacy_regex }}'
  register: rsyslog_listen_legacy_main_file
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for Legacy Config Lines in Rsyslog Include Files
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: '{{ rsyslog_listen_legacy_regex }}'
  register: rsyslog_listen_legacy_include_files
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Assemble List of Config Files With Listen Lines in Legacy Syntax
  ansible.builtin.set_fact:
    rsyslog_legacy_remote_listen_files: '{{ rsyslog_listen_legacy_main_file.files
      | map(attribute=''path'') | list + rsyslog_listen_legacy_include_files.files
      | map(attribute=''path'') | list }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Comment Listen Config Lines Wherever Defined Using Legacy Syntax
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: '{{ rsyslog_listen_legacy_regex }}'
    replace: '# \1'
  loop: '{{ rsyslog_legacy_remote_listen_files }}'
  register: rsyslog_listen_legacy_comment
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_legacy_remote_listen_files | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Define Rsyslog Config Lines Regex in RainerScript Syntax
  ansible.builtin.set_fact:
    rsyslog_listen_rainer_regex: ^\s*(module|input)\((load|type)="(imtcp|imudp)".*$
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for RainerScript Config Lines in Rsyslog Main Config File
  ansible.builtin.find:
    paths: /etc
    pattern: rsyslog.conf
    contains: '{{ rsyslog_listen_rainer_regex }}'
  register: rsyslog_rainer_remote_main_file
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Search for RainerScript Config Lines in Rsyslog Include Files
  ansible.builtin.find:
    paths: /etc/rsyslog.d/
    pattern: '*.conf'
    contains: '{{ rsyslog_listen_rainer_regex }}'
  register: rsyslog_rainer_remote_include_files
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Assemble List of Config Files With Listen Lines in RainerScript
  ansible.builtin.set_fact:
    rsyslog_rainer_remote_listen_files: '{{ rsyslog_rainer_remote_main_file.files
      | map(attribute=''path'') | list + rsyslog_rainer_remote_include_files.files
      | map(attribute=''path'') | list }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Comment Listen Config Lines Wherever Defined Using RainerScript
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: '{{ rsyslog_listen_rainer_regex }}'
    replace: '# \1'
  loop: '{{ rsyslog_rainer_remote_listen_files }}'
  register: rsyslog_listen_rainer_comment
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_rainer_remote_listen_files | length &gt; 0
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten

- name: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
    - Restart Rsyslog if Any Line Were Commented Out
  ansible.builtin.service:
    name: rsyslog
    state: restarted
  when:
  - '"kernel" in ansible_facts.packages'
  - rsyslog_listen_legacy_comment is changed or rsyslog_listen_rainer_comment is changed
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_nolisten
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_nolisten:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rsyslog Logs Sent To Remote Host</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a system may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</description>
        <Value id="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remote Log Server</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify an URI or IP address of a remote host where the log messages will be sent and stored.</description>
          <value>logcollector</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Logs Sent To Remote Host</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To configure rsyslog to send logs to a remote log server,
open <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code> and read and understand the last section of the file,
which describes the multiple directives necessary to activate remote
logging.
Along with these other directives, the system can be configured
to forward its logs to a particular log server by
adding or correcting one of the following lines,
substituting <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i></html:code> appropriately.
The choice of protocol depends on the environment of the system;
although TCP and RELP provide more reliable message delivery,
they may not be supported in all environments.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use UDP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* @<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Or in RainerScript:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* action(type="omfwd" ... target="<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>" protocol="udp")</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use TCP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* @@<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Or in RainerScript:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* action(type="omfwd" ... target="<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>" protocol="tcp")</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To use RELP for log message delivery:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* :omrelp:<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>
        </html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Or in RainerScript:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">*.* action(type="omfwd" ... target="<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/></html:i>" protocol="relp")</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
There must be a resolvable DNS CNAME or Alias record set to "<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>" for logs to be sent correctly to the centralized logging utility.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">It is important to configure queues in case the client is sending log
messages to a remote server. If queues are not configured,
the system will stop functioning when the connection
to the remote server is not available. Please consult Rsyslog
documentation for more information about configuration of queues. The
example configuration which should go into <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/rsyslog.conf</html:code>
can look like the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ActionQueueType LinkedList
$ActionQueueFileName queuefilename
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionResumeRetryCount -1
</html:pre>
Or if using Rainer Script syntax, it could be:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">*.* action(type="omfwd" queue.type="linkedlist" queue.filename="example_fwd" action.resumeRetryCount="-1" queue.saveOnShutdown="on" target="example.com" port="30514" protocol="tcp")</html:pre>
       </warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(2)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.1.1.6</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A log server (loghost) receives syslog messages from one or more
systems. This data can be used as an additional log source in the event a
system is compromised and its local logs are suspect. Forwarding log messages
to a remote loghost also provides system administrators with a centralized
place to view the status of multiple hosts within the enterprise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_remote_loghost" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

rsyslog_remote_loghost_address='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>'


# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^\*\.\*")

# shellcheck disable=SC2059
printf -v formatted_output "%s %s" "$stripped_key" "@@$rsyslog_remote_loghost_address"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^\*\.\*\\&gt;" "/etc/rsyslog.conf"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^\*\.\*\\&gt;.*/$escaped_formatted_output/gi" "/etc/rsyslog.conf"
else
    if [[ -s "/etc/rsyslog.conf" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "/etc/rsyslog.conf" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/rsyslog.conf"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/rsyslog.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="rsyslog_remote_loghost" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-AU-9(2)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - rsyslog_remote_loghost
- name: XCCDF Value rsyslog_remote_loghost_address # promote to variable
  set_fact:
    rsyslog_remote_loghost_address: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" use="legacy"/>
  tags:
    - always

- name: Set rsyslog remote loghost
  ansible.builtin.lineinfile:
    dest: /etc/rsyslog.conf
    regexp: ^\*\.\*
    line: '*.* @@{{ rsyslog_remote_loghost_address }}'
    create: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-AU-9(2)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - rsyslog_remote_loghost
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-rsyslog_remote_loghost:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_network">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Configuration and Firewalls</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Most systems must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This section also discusses firewalls, network access
controls, and other network security frameworks, which allow
system-level rules to be written that can limit an attackers' ability
to connect to your system. These rules can specify that network
traffic should be allowed or denied from certain IP addresses,
hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</description>
      <Group id="xccdf_org.ssgproject.content_group_network-firewalld">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">firewalld</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The dynamic firewall daemon <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> provides a
dynamically managed firewall with support for network “zones” to assign
a level of trust to a network and its associated connections and interfaces.
It has support for IPv4 and IPv6 firewall settings. It supports Ethernet
bridges and has a separation of runtime and permanent configuration options.
It also has an interface for services or applications to add firewall rules
directly.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A graphical configuration tool, <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code>, is used to configure
<html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code>, which in turn uses <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> tool to communicate
with <html:code xmlns:html="http://www.w3.org/1999/xhtml">Netfilter</html:code> in the kernel which implements packet filtering.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The firewall service provided by <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> is dynamic rather than
static because changes to the configuration can be made at anytime and are
immediately implemented. There is no need to save or apply the changes. No
unintended disruption of existing network connections occurs as no part of
the firewall has to be reloaded.</description>
        <platform idref="#system_with_kernel"/>
        <Group id="xccdf_org.ssgproject.content_group_firewalld_activation">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Inspect and Activate Default firewalld Rules</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Firewalls can be used to separate networks into different zones
based on the level of trust the user has decided to place on the devices and
traffic within that network. <html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code> informs firewalld to which
zone an interface belongs. An interface's assigned zone can be changed by
<html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code> or via the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code> tool.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The zone settings in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/</html:code> are a range of preset settings
which can be quickly applied to a network interface. These are the zones
provided by firewalld sorted according to the default trust level of the
zones from untrusted to trusted:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>drop</html:code><html:br/><html:p>Any incoming network packets are dropped, there is no
reply. Only outgoing network connections are possible.</html:p></html:li><html:li><html:code>block</html:code><html:br/><html:p>Any incoming network connections are rejected with an
<html:code>icmp-host-prohibited</html:code> message for IPv4 and <html:code>icmp6-adm-prohibited</html:code>
for IPv6. Only network connections initiated from within the system are
possible.</html:p></html:li><html:li><html:code>public</html:code><html:br/><html:p>For use in public areas. You do not trust the other
computers on the network to not harm your computer. Only selected incoming
connections are accepted.</html:p></html:li><html:li><html:code>external</html:code><html:br/><html:p>For use on external networks with masquerading enabled
especially for routers. You do not trust the other computers on the network to
not harm your computer. Only selected incoming connections are accepted.</html:p></html:li><html:li><html:code>dmz</html:code><html:br/><html:p>For computers in your demilitarized zone that are
publicly-accessible with limited access to your internal network. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>work</html:code><html:br/><html:p>For use in work areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>home</html:code><html:br/><html:p>For use in home areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>internal</html:code><html:br/><html:p>For use on internal networks. You mostly trust the
other computers on the networks to not harm your computer. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>trusted</html:code><html:br/><html:p>All network connections are accepted.</html:p></html:li></html:ul>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
It is possible to designate one of these zones to be the default zone. When
interface connections are added to <html:code xmlns:html="http://www.w3.org/1999/xhtml">NetworkManager</html:code>, they are assigned
to the default zone. On installation, the default zone in firewalld is set to
be the public zone.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To find out all the settings of a zone, for example the <html:code xmlns:html="http://www.w3.org/1999/xhtml">public zone,</html:code>
enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --zone=public --list-all</html:pre>
Example output of this command might look like the following:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench
</html:pre>
To view the network zones currently active, enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --get-service</html:pre>
The following listing displays the result of this command
on common Amazon Linux 2023 system:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https
</html:pre>
Finally to view the network zones that will be active after the next firewalld
service reload, enter the following command as root:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># firewall-cmd --get-service --permanent</html:pre>
       </description>
          <Rule id="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install firewalld Package</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install firewalld</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000298-GPOS-00116</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.1.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">"Firewalld" provides an easy and effective way to block/limit remote access to the system via ports, services, and protocols.

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.

Remote access is access to nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Amazon Linux 2023 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_firewalld_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_firewalld

class install_firewalld {
  package { 'firewalld':
    ensure =&gt; 'installed',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_firewalld_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_firewalld_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "firewalld"
version = "*"
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_firewalld_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=firewalld
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_firewalld_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed

- name: Ensure firewalld is installed
  ansible.builtin.package:
    name: firewalld
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_firewalld_installed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_firewalld_installed:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-package_firewalld_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify firewalld Enabled</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable firewalld.service</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000297-GPOS-00115</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00231</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00232</reference>
            <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A5</reference>
            <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.1.2</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols.</rationale>
            <platform idref="#package_firewalld"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_firewalld

class enable_firewalld {
  service {'firewalld':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q firewalld; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'firewalld.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'firewalld.service'
fi
"$SYSTEMCTL_EXEC" enable 'firewalld.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
enabled = ["firewalld"]
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_firewalld_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled

- name: Verify firewalld Enabled - Enable service firewalld
  block:

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto

  - name: Verify firewalld Enabled - Enable Service firewalld
    ansible.builtin.systemd:
      name: firewalld
      enabled: true
      state: started
      masked: false
    when:
    - '"firewalld" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.3
  - NIST-800-171-3.4.7
  - NIST-800-53-AC-4
  - NIST-800-53-CA-3(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_firewalld_enabled
  - special_service_block
  when:
  - '"kernel" in ansible_facts.packages'
  - '"firewalld" in ansible_facts.packages'
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/service_firewalld_enabled.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_firewalld_enabled:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_ruleset_modifications">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Strengthen the Default Ruleset</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in configuration files under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/services</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/zones</html:code> directories.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-cmd</html:code> program to load in rules under the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/services</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/zones</html:code> directories.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Instructions apply to both unless otherwise noted. Language and address
conventions for regular firewalld rules are used throughout this section.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The program <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewall-config</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> ruleset(s).</warning>
          <Rule id="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Firewalld to Restrict Loopback Traffic</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> to restrict loopback traffic to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lo</html:code> interface.

The loopback traffic must be trusted by assigning the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lo</html:code> interface to the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code>
         <html:code xmlns:html="http://www.w3.org/1999/xhtml">trusted</html:code> zone. However, the loopback traffic must be restricted
to the loopback interface as an anti-spoofing measure.

To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> to restrict loopback traffic to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">lo</html:code> interface,
run the following commands:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
sudo firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'
</html:pre>

To ensure <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> settings are applied in runtime, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">firewall-cmd --reload</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.2.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Loopback traffic is generated between processes on machine and is typically critical to
operation of the system. The loopback interface is the only place that loopback network
traffic should be seen, all other interfaces should ignore traffic on this network as an
anti-spoofing measure.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="firewalld_loopback_traffic_restricted" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi

ipv4_rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
ipv6_rule='rule family=ipv6 source address="::1" destination not address="::1" drop'

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; }; then
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv6_rule}"
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv4_rule}"
    firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv6_rule}"
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="firewalld_loopback_traffic_restricted" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Package
    is Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  register: result_services_states
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv4 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4
        source address="127.0.0.1" destination not address="127.0.0.1" drop'
    register: result_trusted_ipv4_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv4_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted
      Zone Restricts IPv6 Loopback Traffic
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6
        source address="::1" destination not address="::1" drop'
    register: result_trusted_ipv6_restriction
    changed_when:
    - '''ALREADY_ENABLED'' not in result_trusted_ipv6_restriction.stderr'

  - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_trusted_ipv4_restriction is changed or result_trusted_ipv6_restriction
      is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Restrict Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Restrict Loopback Traffic remediation successfully executed
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_restricted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-firewalld_loopback_traffic_restricted:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-firewalld_loopback_traffic_restricted_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Firewalld to Trust Loopback Traffic</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Assign loopback interface to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code>
         <html:code xmlns:html="http://www.w3.org/1999/xhtml">trusted</html:code> zone in order to
explicitly allow the loopback traffic in the system.

To configure <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> to trust loopback traffic, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">sudo firewall-cmd --permanent --zone=trusted --add-interface=lo</html:pre>
To ensure <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> settings are applied in runtime, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">firewall-cmd --reload</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.2.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Loopback traffic is generated between processes on machine and is typically critical to
operation of the system. The loopback interface is the only place that loopback network
traffic should be seen, all other interfaces should ignore traffic on this network as an
anti-spoofing measure.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="firewalld_loopback_traffic_trusted" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "firewalld" ; then
    dnf install -y "firewalld"
fi

if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)" || { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; }; then
    firewall-offline-cmd --zone=trusted --add-interface=lo
elif systemctl is-active firewalld; then
    firewall-cmd --permanent --zone=trusted --add-interface=lo
    firewall-cmd --reload
else
    echo "
    firewalld service is not active. Remediation aborted!
    This remediation could not be applied because it depends on firewalld service running.
    The service is not started by this remediation in order to prevent connection issues."
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="firewalld_loopback_traffic_trusted" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Package is
    Installed
  ansible.builtin.package:
    name: '{{ item }}'
    state: present
  with_items:
  - firewalld
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Collect Facts About System
    Services
  ansible.builtin.service_facts: null
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Remediation is Applicable
    if firewalld Service is Running
  block:

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld trusted
      Zone Includes lo Interface
    ansible.builtin.command:
      cmd: firewall-cmd --permanent --zone=trusted --add-interface=lo
    register: result_lo_interface_assignment
    changed_when:
    - '''ALREADY_ENABLED'' not in result_lo_interface_assignment.stderr'

  - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Changes
      are Applied
    ansible.builtin.service:
      name: firewalld
      state: reloaded
    when:
    - result_lo_interface_assignment is changed
  when:
  - '"kernel" in ansible_facts.packages'
  - ansible_facts.services['firewalld.service'].state == 'running'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure Firewalld to Trust Loopback Traffic - Informative Message Based
    on Service State
  ansible.builtin.assert:
    that:
    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
    fail_msg:
    - firewalld service is not active. Remediation aborted!
    - This remediation could not be applied because it depends on firewalld service
      running.
    - The service is not started by this remediation in order to prevent connection
      issues.
    success_msg:
    - Configure Firewalld to Trust Loopback Traffic remediation successfully executed
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.1
  - configure_strategy
  - firewalld_loopback_traffic_trusted
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-firewalld_loopback_traffic_trusted:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-firewalld_loopback_traffic_trusted_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set Default firewalld Zone for Incoming Packets</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the default zone to <html:code xmlns:html="http://www.w3.org/1999/xhtml">drop</html:code> for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/firewalld/firewalld.conf</html:code> to be:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">DefaultZone=drop</html:pre>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above.</warning>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.3</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.7</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CA-3(5)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(23)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.2.1</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1416</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to <html:code xmlns:html="http://www.w3.org/1999/xhtml">drop</html:code> implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted.</rationale>
            <platform idref="#package_firewalld"/>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_firewalld_default_zone:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-ipv6">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IPv6</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes support for Internet Protocol
version 6. A major and often-mentioned improvement over IPv4 is its
enormous increase in the number of available addresses. Another
important feature is its support for automatic configuration of
many network settings.</description>
        <Group id="xccdf_org.ssgproject.content_group_configuring_ipv6">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure IPv6 Settings if Necessary</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</description>
          <platform idref="#ipv6_enabled"/>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_ra</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept all router advertisements?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle ICMP Redirect Acceptance</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.all.forwarding</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle IPv6 Forwarding</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_ra</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accept default router advertisements by default?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Toggle ICMP Redirect Acceptance By Default</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv6.conf.default.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Accepting Router Advertisements on All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_ra = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.all.accept_ra from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_ra.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_ra" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_ra_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_ra
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_ra="$sysctl_net_ipv6_conf_all_accept_ra_value"
fi

#
# If net.ipv6.conf.all.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_ra = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_ra\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_ra\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_ra" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_ra_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Set fact
    for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Find all
    files that contain net.ipv6.conf.all.accept_ra
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_ra\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Find all
    files that set net.ipv6.conf.all.accept_ra to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_ra\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_ra_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Comment
    out any occurrences of net.ipv6.conf.all.accept_ra from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_ra
    replace: '#net.ipv6.conf.all.accept_ra'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra

- name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Ensure
    sysctl net.ipv6.conf.all.accept_ra is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.accept_ra
    value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_ra
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_all_accept_ra_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_all_accept_ra.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Accepting ICMP Redirects for All IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit ICMP redirect message could result in a man-in-the-middle attack.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.all.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_redirects="$sysctl_net_ipv6_conf_all_accept_redirects_value"
fi

#
# If net.ipv6.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Set fact for sysctl
    paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Find all files
    that contain net.ipv6.conf.all.accept_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Find all files
    that set net.ipv6.conf.all.accept_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_redirects\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Comment out any
    occurrences of net.ipv6.conf.all.accept_redirects from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
    replace: '#net.ipv6.conf.all.accept_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Ensure sysctl net.ipv6.conf.all.accept_redirects
    is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_all_accept_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_all_accept_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.accept_source_route = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.all.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_accept_source_route_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.accept_source_route
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.accept_source_route="$sysctl_net_ipv6_conf_all_accept_source_route_value"
fi

#
# If net.ipv6.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route
- name: XCCDF Value sysctl_net_ipv6_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
    - Find all files that contain net.ipv6.conf.all.accept_source_route
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_source_route\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
    - Find all files that set net.ipv6.conf.all.accept_source_route to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.accept_source_route\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_source_route_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
    - Comment out any occurrences of net.ipv6.conf.all.accept_source_route from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
    replace: '#net.ipv6.conf.all.accept_source_route'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
    - Ensure sysctl net.ipv6.conf.all.accept_source_route is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_accept_source_route
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_all_accept_source_route_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_all_accept_source_route.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for IPv6 Forwarding</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.forwarding</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.all.forwarding=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.all.forwarding = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.2.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_forwarding" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.all.forwarding from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.all.forwarding.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.all.forwarding" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_all_forwarding_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.all.forwarding
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.all.forwarding="$sysctl_net_ipv6_conf_all_forwarding_value"
fi

#
# If net.ipv6.conf.all.forwarding present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.all.forwarding = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.all.forwarding")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_all_forwarding_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.all.forwarding\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.all.forwarding\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_all_forwarding" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding
- name: XCCDF Value sysctl_net_ipv6_conf_all_forwarding_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_all_forwarding_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for IPv6 Forwarding - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: Disable Kernel Parameter for IPv6 Forwarding - Find all files that contain
    net.ipv6.conf.all.forwarding
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.forwarding\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: Disable Kernel Parameter for IPv6 Forwarding - Find all files that set net.ipv6.conf.all.forwarding
    to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.all.forwarding\s*=\s*{{ sysctl_net_ipv6_conf_all_forwarding_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: Disable Kernel Parameter for IPv6 Forwarding - Comment out any occurrences
    of net.ipv6.conf.all.forwarding from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.all.forwarding
    replace: '#net.ipv6.conf.all.forwarding'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding

- name: Disable Kernel Parameter for IPv6 Forwarding - Ensure sysctl net.ipv6.conf.all.forwarding
    is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.forwarding
    value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_all_forwarding
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_all_forwarding_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_all_forwarding.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_ra = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit router advertisement message could result in a man-in-the-middle attack.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.default.accept_ra from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_ra.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_ra" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_ra_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_ra
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_ra="$sysctl_net_ipv6_conf_default_accept_ra_value"
fi

#
# If net.ipv6.conf.default.accept_ra present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_ra = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_ra")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_ra_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_ra\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_ra\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_ra" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_ra_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_ra_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" use="legacy"/>
  tags:
    - always

- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
    - Find all files that contain net.ipv6.conf.default.accept_ra
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_ra\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
    - Find all files that set net.ipv6.conf.default.accept_ra to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_ra\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_ra_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
    - Comment out any occurrences of net.ipv6.conf.default.accept_ra from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_ra
    replace: '#net.ipv6.conf.default.accept_ra'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra

- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
    - Ensure sysctl net.ipv6.conf.default.accept_ra is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.default.accept_ra
    value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_ra
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_default_accept_ra_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_default_accept_ra.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">An illicit ICMP redirect message could result in a man-in-the-middle attack.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.default.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_redirects="$sysctl_net_ipv6_conf_default_accept_redirects_value"
fi

#
# If net.ipv6.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
    - Find all files that contain net.ipv6.conf.default.accept_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
    - Find all files that set net.ipv6.conf.default.accept_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_redirects\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
    - Comment out any occurrences of net.ipv6.conf.default.accept_redirects from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
    replace: '#net.ipv6.conf.default.accept_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
    - Ensure sysctl net.ipv6.conf.default.accept_redirects is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_default_accept_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_default_accept_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv6.conf.default.accept_source_route = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6.1(iv)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R13</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.

Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv6.conf.default.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv6.conf.default.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv6.conf.default.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv6_conf_default_accept_source_route_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv6.conf.default.accept_source_route
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv6.conf.default.accept_source_route="$sysctl_net_ipv6_conf_default_accept_source_route_value"
fi

#
# If net.ipv6.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv6.conf.default.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv6.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv6_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv6.conf.default.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv6.conf.default.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv6_conf_default_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route
- name: XCCDF Value sysctl_net_ipv6_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv6_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
    by Default - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
    by Default - Find all files that contain net.ipv6.conf.default.accept_source_route
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_source_route\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
    by Default - Find all files that set net.ipv6.conf.default.accept_source_route
    to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv6.conf.default.accept_source_route\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_source_route_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
    by Default - Comment out any occurrences of net.ipv6.conf.default.accept_source_route
    from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
    replace: '#net.ipv6.conf.default.accept_source_route'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
    by Default - Ensure sysctl net.ipv6.conf.default.accept_source_route is set
  ansible.posix.sysctl:
    name: net.ipv6.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv6_conf_default_accept_source_route
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv6_conf_default_accept_source_route_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv6_conf_default_accept_source_route.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-kernel">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Kernel Parameters Which Affect Networking</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.</description>
        <Group id="xccdf_org.ssgproject.content_group_network_host_and_router_parameters">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Related Kernel Runtime Parameters for Hosts and Routers</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</description>
          <platform idref="#system_with_kernel"/>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable ICMP Redirect Acceptance</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.log_martians</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.rp_filter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</description>
            <value>1</value>
            <value selector="enabled">1</value>
            <value selector="loose">2</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.all.secure_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.accept_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable ICMP Redirect Acceptance?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.accept_source_route</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable IP source routing?</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.log_martians</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.rp_filter</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enables source route verification</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.conf.default.secure_redirects</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packages by default.</description>
            <value>0</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.icmp_echo_ignore_broadcasts</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.icmp_ignore_bogus_error_responses</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to prevent unnecessary logging</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" type="number">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">net.ipv4.tcp_syncookies</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable to turn on TCP SYN Cookie
Protection</description>
            <value>1</value>
            <value selector="disabled">0</value>
            <value selector="enabled">1</value>
          </Value>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This feature of the IPv4 protocol has few legitimate uses. It should be
disabled unless absolutely required."</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_accept_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_redirects="$sysctl_net_ipv4_conf_all_accept_redirects_value"
fi

#
# If net.ipv4.conf.all.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Set fact for sysctl
    paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Find all files
    that contain net.ipv4.conf.all.accept_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.accept_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Find all files
    that set net.ipv4.conf.all.accept_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.accept_redirects\s*=\s*{{ sysctl_net_ipv4_conf_all_accept_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Comment out any
    occurrences of net.ipv4.conf.all.accept_redirects from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
    replace: '#net.ipv4.conf.all.accept_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects

- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Ensure sysctl net.ipv4.conf.all.accept_redirects
    is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_all_accept_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_accept_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.accept_source_route = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
         <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_accept_source_route_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.accept_source_route
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.accept_source_route="$sysctl_net_ipv4_conf_all_accept_source_route_value"
fi

#
# If net.ipv4.conf.all.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_all_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
    - Find all files that contain net.ipv4.conf.all.accept_source_route
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.accept_source_route\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
    - Find all files that set net.ipv4.conf.all.accept_source_route to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.accept_source_route\s*=\s*{{ sysctl_net_ipv4_conf_all_accept_source_route_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.conf.all.accept_source_route from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
    replace: '#net.ipv4.conf.all.accept_source_route'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
    - Ensure sysctl net.ipv4.conf.all.accept_source_route is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_accept_source_route
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_all_accept_source_route_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_accept_source_route.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.log_martians</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.log_martians = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_log_martians" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.log_martians from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.log_martians" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_log_martians_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.log_martians
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.log_martians="$sysctl_net_ipv4_conf_all_log_martians_value"
fi

#
# If net.ipv4.conf.all.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.log_martians = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.log_martians\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.log_martians\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_log_martians" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_all_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_log_martians_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - Set
    fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - Find
    all files that contain net.ipv4.conf.all.log_martians
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.log_martians\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - Find
    all files that set net.ipv4.conf.all.log_martians to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.log_martians\s*=\s*{{ sysctl_net_ipv4_conf_all_log_martians_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - Comment
    out any occurrences of net.ipv4.conf.all.log_martians from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.log_martians
    replace: '#net.ipv4.conf.all.log_martians'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces - Ensure
    sysctl net.ipv4.conf.all.log_martians is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.log_martians
    value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_all_log_martians
  - unknown_severity
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_all_log_martians_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_log_martians.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.rp_filter</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.rp_filter = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_rp_filter" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.rp_filter from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.rp_filter" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_rp_filter_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.rp_filter
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.rp_filter="$sysctl_net_ipv4_conf_all_rp_filter_value"
fi

#
# If net.ipv4.conf.all.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.rp_filter = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.rp_filter\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.rp_filter\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_rp_filter" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_all_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_rp_filter_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    - Find all files that contain net.ipv4.conf.all.rp_filter
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.rp_filter\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    - Find all files that set net.ipv4.conf.all.rp_filter to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.rp_filter\s*=\s*{{ sysctl_net_ipv4_conf_all_rp_filter_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.conf.all.rp_filter from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.rp_filter
    replace: '#net.ipv4.conf.all.rp_filter'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    - Ensure sysctl net.ipv4.conf.all.rp_filter is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.rp_filter
    value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_rp_filter
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_all_rp_filter_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_rp_filter.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.secure_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.secure_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_secure_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.secure_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.secure_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_all_secure_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.all.secure_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.secure_redirects="$sysctl_net_ipv4_conf_all_secure_redirects_value"
fi

#
# If net.ipv4.conf.all.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.all.secure_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_all_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.secure_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.secure_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_secure_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_all_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_all_secure_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
    - Find all files that contain net.ipv4.conf.all.secure_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.secure_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
    - Find all files that set net.ipv4.conf.all.secure_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.secure_redirects\s*=\s*{{ sysctl_net_ipv4_conf_all_secure_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.conf.all.secure_redirects from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.secure_redirects
    replace: '#net.ipv4.conf.all.secure_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects

- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
    - Ensure sysctl net.ipv4.conf.all.secure_redirects is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_secure_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_all_secure_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_secure_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>This feature of the IPv4 protocol has few legitimate uses. It should
be disabled unless absolutely required.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.accept_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.accept_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_accept_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.accept_redirects="$sysctl_net_ipv4_conf_default_accept_redirects_value"
fi

#
# If net.ipv4.conf.default.accept_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.accept_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
    - Find all files that contain net.ipv4.conf.default.accept_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.accept_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
    - Find all files that set net.ipv4.conf.default.accept_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.accept_redirects\s*=\s*{{ sysctl_net_ipv4_conf_default_accept_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.conf.default.accept_redirects from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
    replace: '#net.ipv4.conf.default.accept_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects

- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
    - Ensure sysctl net.ipv4.conf.default.accept_redirects is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.accept_redirects
    value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_default_accept_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_accept_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_source_route</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.accept_source_route = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.1</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Accepting source-routed packets in the IPv4 protocol has few legitimate
uses. It should be disabled unless it is absolutely required, such as when
IPv4 forwarding is enabled and the system is legitimately functioning as a
router.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_source_route" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.accept_source_route from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.accept_source_route.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.accept_source_route" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_accept_source_route_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.accept_source_route
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.accept_source_route="$sysctl_net_ipv4_conf_default_accept_source_route_value"
fi

#
# If net.ipv4.conf.default.accept_source_route present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.accept_source_route = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.accept_source_route")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_accept_source_route_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.accept_source_route\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.accept_source_route\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_accept_source_route" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route
- name: XCCDF Value sysctl_net_ipv4_conf_default_accept_source_route_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_accept_source_route_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" use="legacy"/>
  tags:
    - always

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
    by Default - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
    by Default - Find all files that contain net.ipv4.conf.default.accept_source_route
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.accept_source_route\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
    by Default - Find all files that set net.ipv4.conf.default.accept_source_route
    to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.accept_source_route\s*=\s*{{ sysctl_net_ipv4_conf_default_accept_source_route_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
    by Default - Comment out any occurrences of net.ipv4.conf.default.accept_source_route
    from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
    replace: '#net.ipv4.conf.default.accept_source_route'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route

- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
    by Default - Ensure sysctl net.ipv4.conf.default.accept_source_route is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.accept_source_route
    value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_accept_source_route
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_default_accept_source_route_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_accept_source_route.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.log_martians</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.log_martians=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.log_martians = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_log_martians" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.log_martians from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.log_martians.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.log_martians" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_log_martians_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.log_martians
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.log_martians="$sysctl_net_ipv4_conf_default_log_martians_value"
fi

#
# If net.ipv4.conf.default.log_martians present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.log_martians = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.log_martians")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_log_martians_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.log_martians\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.log_martians\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_log_martians" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_conf_default_log_martians_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_log_martians_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
    - Find all files that contain net.ipv4.conf.default.log_martians
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.log_martians\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
    - Find all files that set net.ipv4.conf.default.log_martians to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.log_martians\s*=\s*{{ sysctl_net_ipv4_conf_default_log_martians_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
    - Comment out any occurrences of net.ipv4.conf.default.log_martians from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.log_martians
    replace: '#net.ipv4.conf.default.log_martians'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity

- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
    - Ensure sysctl net.ipv4.conf.default.log_martians is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.log_martians
    value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(3)(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_conf_default_log_martians
  - unknown_severity
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_default_log_martians_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_log_martians.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.rp_filter</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.rp_filter = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.7</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_rp_filter" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.rp_filter from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.rp_filter.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.rp_filter" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_rp_filter_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.rp_filter
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.rp_filter="$sysctl_net_ipv4_conf_default_rp_filter_value"
fi

#
# If net.ipv4.conf.default.rp_filter present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.rp_filter = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.rp_filter")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_rp_filter_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.rp_filter\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.rp_filter\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_rp_filter" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter
- name: XCCDF Value sysctl_net_ipv4_conf_default_rp_filter_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_rp_filter_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    by Default - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    by Default - Find all files that contain net.ipv4.conf.default.rp_filter
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.rp_filter\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    by Default - Find all files that set net.ipv4.conf.default.rp_filter to correct
    value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.rp_filter\s*=\s*{{ sysctl_net_ipv4_conf_default_rp_filter_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    by Default - Comment out any occurrences of net.ipv4.conf.default.rp_filter from
    config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.rp_filter
    replace: '#net.ipv4.conf.default.rp_filter'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter

- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
    by Default - Ensure sysctl net.ipv4.conf.default.rp_filter is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.rp_filter
    value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_rp_filter
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_default_rp_filter_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_rp_filter.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.secure_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.secure_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_secure_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.secure_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.secure_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.secure_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_conf_default_secure_redirects_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>'


#
# Set runtime for net.ipv4.conf.default.secure_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.secure_redirects="$sysctl_net_ipv4_conf_default_secure_redirects_value"
fi

#
# If net.ipv4.conf.default.secure_redirects present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.conf.default.secure_redirects = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.secure_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_conf_default_secure_redirects_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.secure_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.secure_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_secure_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects
- name: XCCDF Value sysctl_net_ipv4_conf_default_secure_redirects_value # promote to variable
  set_fact:
    sysctl_net_ipv4_conf_default_secure_redirects_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" use="legacy"/>
  tags:
    - always

- name: Configure Kernel Parameter for Accepting Secure Redirects By Default - Set
    fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: Configure Kernel Parameter for Accepting Secure Redirects By Default - Find
    all files that contain net.ipv4.conf.default.secure_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.secure_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: Configure Kernel Parameter for Accepting Secure Redirects By Default - Find
    all files that set net.ipv4.conf.default.secure_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.secure_redirects\s*=\s*{{ sysctl_net_ipv4_conf_default_secure_redirects_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: Configure Kernel Parameter for Accepting Secure Redirects By Default - Comment
    out any occurrences of net.ipv4.conf.default.secure_redirects from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.secure_redirects
    replace: '#net.ipv4.conf.default.secure_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects

- name: Configure Kernel Parameter for Accepting Secure Redirects By Default - Ensure
    sysctl net.ipv4.conf.default.secure_redirects is set
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.secure_redirects
    value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_secure_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_conf_default_secure_redirects_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_secure_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_echo_ignore_broadcasts</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_echo_ignore_broadcasts = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Ignoring ICMP echo requests (pings) sent to broadcast or multicast
addresses makes the system slightly more difficult to enumerate on the network.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.icmp_echo_ignore_broadcasts" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_echo_ignore_broadcasts
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.icmp_echo_ignore_broadcasts="$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"
fi

#
# If net.ipv4.icmp_echo_ignore_broadcasts present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_echo_ignore_broadcasts = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_echo_ignore_broadcasts")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.icmp_echo_ignore_broadcasts\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
- name: XCCDF Value sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
    - Find all files that contain net.ipv4.icmp_echo_ignore_broadcasts
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
    - Find all files that set net.ipv4.icmp_echo_ignore_broadcasts to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=\s*{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
    replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
    - Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
  ansible.posix.sysctl:
    name: net.ipv4.icmp_echo_ignore_broadcasts
    value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_icmp_echo_ignore_broadcasts.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_ignore_bogus_error_responses</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.icmp_ignore_bogus_error_responses = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.3</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.icmp_ignore_bogus_error_responses" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>'


#
# Set runtime for net.ipv4.icmp_ignore_bogus_error_responses
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.icmp_ignore_bogus_error_responses="$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"
fi

#
# If net.ipv4.icmp_ignore_bogus_error_responses present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.icmp_ignore_bogus_error_responses = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.icmp_ignore_bogus_error_responses")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.icmp_ignore_bogus_error_responses\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity
- name: XCCDF Value sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value # promote to variable
  set_fact:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
    - Find all files that contain net.ipv4.icmp_ignore_bogus_error_responses
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.icmp_ignore_bogus_error_responses\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
    - Find all files that set net.ipv4.icmp_ignore_bogus_error_responses to correct
    value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.icmp_ignore_bogus_error_responses\s*=\s*{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from
    config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses
    replace: '#net.ipv4.icmp_ignore_bogus_error_responses'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity

- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
    - Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
  ansible.posix.sysctl:
    name: net.ipv4.icmp_ignore_bogus_error_responses
    value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - PCI-DSS-Req-1.4.3
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - low_complexity
  - medium_disruption
  - reboot_required
  - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
  - unknown_severity
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_icmp_ignore_bogus_error_responses.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.tcp_syncookies</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.tcp_syncookies=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.tcp_syncookies = 1</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(1)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5(3)(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000420-GPOS-00186</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000142-GPOS-00071</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.3.8</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A TCP SYN flood attack can cause a denial of service by filling a
system's TCP connection table with connections in the SYN_RCVD state.
Syncookies can be used to track a connection when a subsequent ACK is received,
verifying the initiator is attempting a valid connection and is not a flood
source. This feature is activated when a flood condition is detected, and
enables the system to continue servicing valid connection requests.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_tcp_syncookies" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.tcp_syncookies from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.tcp_syncookies.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.tcp_syncookies" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"

sysctl_net_ipv4_tcp_syncookies_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>'


#
# Set runtime for net.ipv4.tcp_syncookies
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.tcp_syncookies="$sysctl_net_ipv4_tcp_syncookies_value"
fi

#
# If net.ipv4.tcp_syncookies present in /etc/sysctl.conf, change value to appropriate value
#	else, add "net.ipv4.tcp_syncookies = value" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.tcp_syncookies")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$sysctl_net_ipv4_tcp_syncookies_value"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.tcp_syncookies\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.tcp_syncookies\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_tcp_syncookies" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies
- name: XCCDF Value sysctl_net_ipv4_tcp_syncookies_value # promote to variable
  set_fact:
    sysctl_net_ipv4_tcp_syncookies_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" use="legacy"/>
  tags:
    - always

- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - Set
    fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - Find
    all files that contain net.ipv4.tcp_syncookies
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.tcp_syncookies\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - Find
    all files that set net.ipv4.tcp_syncookies to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.tcp_syncookies\s*=\s*{{ sysctl_net_ipv4_tcp_syncookies_value
      }}$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - Comment
    out any occurrences of net.ipv4.tcp_syncookies from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.tcp_syncookies
    replace: '#net.ipv4.tcp_syncookies'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies

- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces - Ensure
    sysctl net.ipv4.tcp_syncookies is set
  ansible.posix.sysctl:
    name: net.ipv4.tcp_syncookies
    value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5(1)
  - NIST-800-53-SC-5(2)
  - NIST-800-53-SC-5(3)(a)
  - PCI-DSS-Req-1.4.1
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_tcp_syncookies
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-export export-name="sysctl_net_ipv4_tcp_syncookies_value" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_tcp_syncookies.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" value-id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value"/>
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_network_host_parameters">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Parameters for Hosts Only</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</description>
          <platform idref="#system_with_kernel"/>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.send_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.all.send_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_send_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.all.send_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.all.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.all.send_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.all.send_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.all.send_redirects="0"
fi

#
# If net.ipv4.conf.all.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.all.send_redirects = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.all.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.all.send_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.all.send_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_all_send_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    - Find all files that contain net.ipv4.conf.all.send_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.send_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    - Find all files that set net.ipv4.conf.all.send_redirects to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.all.send_redirects\s*=\s*0$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    - Comment out any occurrences of net.ipv4.conf.all.send_redirects from config
    files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.all.send_redirects
    replace: '#net.ipv4.conf.all.send_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    - Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
  ansible.posix.sysctl:
    name: net.ipv4.conf.all.send_redirects
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_all_send_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_all_send_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.send_redirects</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.conf.default.send_redirects = 0</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">4</reference>
            <reference href="https://www.cisecurity.org/controls/">6</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.1</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.2.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The ability to send ICMP redirects is only appropriate for systems acting as routers.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_send_redirects" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.conf.default.send_redirects from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.conf.default.send_redirects.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.conf.default.send_redirects" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.conf.default.send_redirects
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.conf.default.send_redirects="0"
fi

#
# If net.ipv4.conf.default.send_redirects present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.conf.default.send_redirects = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.conf.default.send_redirects")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.conf.default.send_redirects\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.conf.default.send_redirects\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_conf_default_send_redirects" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    by Default - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    by Default - Find all files that contain net.ipv4.conf.default.send_redirects
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.send_redirects\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    by Default - Find all files that set net.ipv4.conf.default.send_redirects to correct
    value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.conf.default.send_redirects\s*=\s*0$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    by Default - Comment out any occurrences of net.ipv4.conf.default.send_redirects
    from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.conf.default.send_redirects
    replace: '#net.ipv4.conf.default.send_redirects'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects

- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
    by Default - Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
  ansible.posix.sysctl:
    name: net.ipv4.conf.default.send_redirects
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1.1
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.5
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_conf_default_send_redirects
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_conf_default_send_redirects.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_forward</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w net.ipv4.ip_forward=0</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">net.ipv4.ip_forward = 0</html:pre>
        </description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding.</warning>
            <reference href="https://www.cisecurity.org/controls/">1</reference>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">2</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">7</reference>
            <reference href="https://www.cisecurity.org/controls/">8</reference>
            <reference href="https://www.cisecurity.org/controls/">9</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.20</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.3.1</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.3.2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R12</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.2.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_forward" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of net.ipv4.ip_forward from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*net.ipv4.ip_forward.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "net.ipv4.ip_forward" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for net.ipv4.ip_forward
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w net.ipv4.ip_forward="0"
fi

#
# If net.ipv4.ip_forward present in /etc/sysctl.conf, change value to "0"
#	else, add "net.ipv4.ip_forward = 0" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^net.ipv4.ip_forward")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "0"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^net.ipv4.ip_forward\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^net.ipv4.ip_forward\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_net_ipv4_ip_forward" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - Set fact for
    sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - Find all files
    that contain net.ipv4.ip_forward
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.ip_forward\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - Find all files
    that set net.ipv4.ip_forward to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*net.ipv4.ip_forward\s*=\s*0$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - Comment out
    any occurrences of net.ipv4.ip_forward from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*net.ipv4.ip_forward
    replace: '#net.ipv4.ip_forward'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward

- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces - Ensure sysctl
    net.ipv4.ip_forward is set to 0
  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: '0'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.20
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-SC-5
  - NIST-800-53-SC-7(a)
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.3
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_net_ipv4_ip_forward
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/sysctl_net_ipv4_ip_forward.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-nftables">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nftables</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">If firewalld or iptables are being used in your environment, please follow the guidance in their
respective section and pass-over the guidance in this section.</html:code><html:br xmlns:html="http://www.w3.org/1999/xhtml"/><html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
nftables is a subsystem of the Linux kernel providing filtering and classification of network
packets/datagrams/frames and is the successor to iptables. The biggest change with the
successor nftables is its simplicity. With iptables, we have to configure every single rule and
use the syntax which can be compared with normal commands. With nftables, the simpler
syntax, much like BPF (Berkely Packet Filter) means shorter lines and less repetition.
Support for nftables should also be compiled into the kernel, together with the related
nftables modules.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/> 
It is available in Linux kernels &gt;= 3.13. <html:b xmlns:html="http://www.w3.org/1999/xhtml">Please ensure that your kernel
supports nftables before choosing this option.</html:b>
      </description>
        <Value id="xccdf_org.ssgproject.content_value_var_nftables_family" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Nftables Families</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Netfilter enables filtering at multiple networking levels. With iptables there 
is a separate tool for each level: iptables, ip6tables, arptables, ebtables. 
With nftables the multiple networking levels are abstracted into families, 
all of which are served  by the single tool nft. 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ip</html:code>Tables of this family see IPv4 traffic/packets. 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ip6</html:code>Tables of this family see IPv6 traffic/packets.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">inet</html:code>Tables of this family see both IPv4 and IPv6 traffic/packets, 
simplifying dual stack support. 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">arp</html:code>Tables of this family see ARP-level (i.e, L2) traffic, before 
any L3 handling is done by the kernel. 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">bridge</html:code>Tables of this family see traffic/packets traversing bridges 
(i.e. switching). No assumptions are made about L3 protocols. 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">netdev</html:code>The netdev family is different from the others in that it 
is used to create base chains attached to a single network interface. Such 
base chains see all network traffic on the specified interface, with no 
assumptions about L2 or L3 protocols. Therefore you can filter ARP traffic from here. </description>
          <value>inet</value>
          <value selector="ip">ip</value>
          <value selector="ip6">ip6</value>
          <value selector="inet">inet</value>
          <value selector="arp">arp</value>
          <value selector="bridge">bridge</value>
          <value selector="netdev">netdev</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_nftables_table" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Nftables Tables</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Tables in nftables hold chains. Each table only has one address family and only applies 
to packets of this family. Tables can have one of six families.
 </description>
          <value>filter</value>
          <value selector="filter">filter</value>
          <value selector="firewalld">firewalld</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_package_nftables_installed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install nftables Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nftables</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install nftables</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.1.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">nftables</html:code> is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host.</rationale>
          <platform idref="#service_disabled_iptables_and_service_disabled_ufw_and_system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nftables_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_nftables

class install_nftables {
  package { 'nftables':
    ensure =&gt; 'installed',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nftables_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if ( ! (systemctl is-active iptables &amp;&gt;/dev/null) &amp;&amp; ! (systemctl is-active ufw &amp;&gt;/dev/null) &amp;&amp; rpm --quiet -q kernel ); then

if ! rpm -q --quiet "nftables" ; then
    dnf install -y "nftables"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nftables_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "nftables"
version = "*"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nftables_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=nftables
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nftables_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_nftables_installed

- name: Ensure nftables is installed
  ansible.builtin.package:
    name: nftables
    state: present
  when: ( "kernel" in ansible_facts.packages )
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_nftables_installed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_nftables_installed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_nftables_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_service_nftables_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify nftables Service is Disabled</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">nftables is a subsystem of the Linux kernel providing filtering and classification of network
packets/datagrams/frames and is the successor to iptables.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nftables</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">systemctl disable nftables</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.1.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Running both <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">nftables</html:code> may lead to conflict. <html:code xmlns:html="http://www.w3.org/1999/xhtml">nftables</html:code>
is actually one of the backends for <html:code xmlns:html="http://www.w3.org/1999/xhtml">firewalld</html:code> management tools.</rationale>
          <platform idref="#package_firewalld_and_package_nftables_and_system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nftables_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_nftables

class disable_nftables {
  service {'nftables':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nftables_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q firewalld &amp;&amp; rpm --quiet -q nftables &amp;&amp; rpm --quiet -q kernel ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'nftables.service'
fi
"$SYSTEMCTL_EXEC" disable 'nftables.service'
"$SYSTEMCTL_EXEC" mask 'nftables.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files nftables.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'nftables.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'nftables.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nftables.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nftables_disabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
masked = ["nftables"]
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nftables_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled

- name: Verify nftables Service is Disabled - Disable service nftables
  block:

  - name: Verify nftables Service is Disabled - Collect systemd Services Present in
      the System
    ansible.builtin.command: systemctl -q list-unit-files --type service
    register: service_exists
    changed_when: false
    failed_when: service_exists.rc not in [0, 1]
    check_mode: false

  - name: Verify nftables Service is Disabled - Ensure nftables.service is Masked
    ansible.builtin.systemd:
      name: nftables.service
      state: stopped
      enabled: false
      masked: true
    when: service_exists.stdout_lines is search("nftables.service", multiline=True)

  - name: Unit Socket Exists - nftables.socket
    ansible.builtin.command: systemctl -q list-unit-files nftables.socket
    register: socket_file_exists
    changed_when: false
    failed_when: socket_file_exists.rc not in [0, 1]
    check_mode: false

  - name: Verify nftables Service is Disabled - Disable Socket nftables
    ansible.builtin.systemd:
      name: nftables.socket
      enabled: false
      state: stopped
      masked: true
    when: socket_file_exists.stdout_lines is search("nftables.socket", multiline=True)
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_nftables_disabled
  - special_service_block
  when: ( "firewalld" in ansible_facts.packages and "nftables" in ansible_facts.packages
    and "kernel" in ansible_facts.packages )
</fix>
          <check system="http://open-scap.org/page/SCE">
            <check-import import-name="stdout">
                </check-import>
            <check-content-ref href="al2023/checks/sce/service_nftables_disabled.sh"/>
          </check>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_nftables_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_nftables_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_set_nftables_table" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure a Table Exists for Nftables</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Tables in nftables hold chains. Each table only has one address family and only applies
to packets of this family. Tables can have one of six families.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Adding or editing rules in a running nftables can cause loss of connectivity to the system.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Both the SCE check and remediation for this rule only consider runtime settings.
There is no specific file to check as it depends on each site's policy. Therefore, check
and remediation use the nft command directly. The fix is not persistent across system
reboots.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">SCE check does not support variables, therefore the SCE check in this rule only checks the
address family, regardless of the table name.</warning>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.4.2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Nftables doesn't have any default tables. Without a table being built, nftables will not
filter network traffic.</rationale>
          <platform idref="#package_nftables"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_nftables_table" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q nftables; then

var_nftables_family='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_nftables_family" use="legacy"/>'

var_nftables_table='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_nftables_table" use="legacy"/>'


if ! nft list table $var_nftables_family $var_nftables_table; then
  nft create table "$var_nftables_family" "$var_nftables_table"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="set_nftables_table" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_nftables_table
- name: XCCDF Value var_nftables_family # promote to variable
  set_fact:
    var_nftables_family: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_nftables_family" use="legacy"/>
  tags:
    - always
- name: XCCDF Value var_nftables_table # promote to variable
  set_fact:
    var_nftables_table: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_nftables_table" use="legacy"/>
  tags:
    - always

- name: Collect Existing Nftables
  ansible.builtin.command: nft list table {{ var_nftables_family }} {{ var_nftables_table
    }}
  register: result_nftables_table_family
  changed_when: false
  failed_when: result_nftables_table_family.rc not in [0, 1]
  when: '"nftables" in ansible_facts.packages'
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_nftables_table

- name: Set Nftable Table
  ansible.builtin.command: nft create table {{ var_nftables_family }} {{ var_nftables_table
    }}
  when:
  - '"nftables" in ansible_facts.packages'
  - result_nftables_table_family is not skipped
  - result_nftables_table_family.rc != 0
  tags:
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - set_nftables_table
</fix>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-set_nftables_table_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_network-uncommon">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uncommon Network Protocols</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes support for several network protocols which are not commonly used.
Although security vulnerabilities in kernel networking code are not frequently discovered,
the consequences can be dramatic. Ensuring uncommon network protocols are disabled
reduces the system's risk to attacks targeted at its implementation of those protocols.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.</warning>
        <platform idref="#system_with_kernel"/>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DCCP Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Datagram Congestion Control Protocol (DCCP) is a
relatively new transport layer protocol, designed to support
streaming media and telephony.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">dccp</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/dccp.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install dccp /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">dccp</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install dccp /bin/true</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.2</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000096-GPOS-00050</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.1.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling DCCP protects
the system against exploitation of any flaws in its implementation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_dccp_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
	
	sed -i 's#^install dccp.*#install dccp /bin/false#g' /etc/modprobe.d/dccp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/dccp.conf
	echo "install dccp /bin/false" &gt;&gt; /etc/modprobe.d/dccp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_dccp_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_dccp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'dccp' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/dccp.conf
    regexp: install\s+dccp
    line: install dccp /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_dccp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_dccp_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable RDS Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Reliable Datagram Sockets (RDS) protocol is a transport
layer protocol designed to provide reliable high-bandwidth,
low-latency communications between nodes in a cluster.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">rds</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/rds.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install rds /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">rds</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install rds /bin/true</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling RDS protects
the system against exploitation of any flaws in its implementation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_rds_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install rds" /etc/modprobe.d/rds.conf ; then
	
	sed -i 's#^install rds.*#install rds /bin/false#g' /etc/modprobe.d/rds.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/rds.conf
	echo "install rds /bin/false" &gt;&gt; /etc/modprobe.d/rds.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_rds_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_rds_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'rds' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/rds.conf
    regexp: install\s+rds
    line: install rds /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_rds_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_rds_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SCTP Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Stream Control Transmission Protocol (SCTP) is a
transport layer protocol, designed to support the idea of
message-oriented communication, with several streams of messages
within one connection.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">sctp</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/sctp.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install sctp /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">sctp</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install sctp /bin/true</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-1.4.2</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.1.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling SCTP protects
the system against exploitation of any flaws in its implementation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_sctp_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install sctp" /etc/modprobe.d/sctp.conf ; then
	
	sed -i 's#^install sctp.*#install sctp /bin/false#g' /etc/modprobe.d/sctp.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/sctp.conf
	echo "install sctp /bin/false" &gt;&gt; /etc/modprobe.d/sctp.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_sctp_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_sctp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'sctp' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/sctp.conf
    regexp: install\s+sctp
    line: install sctp /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.10.1
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-1.4.2
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - disable_strategy
  - kernel_module_sctp_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_sctp_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable TIPC Support</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Transparent Inter-Process Communication (TIPC) protocol
is designed to provide communications between nodes in a
cluster.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tipc</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/tipc.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install tipc /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">tipc</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install tipc /bin/true</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This configuration baseline was created to deploy the base operating system for general purpose
workloads. When the operating system is configured for certain purposes, such as
a node in High Performance Computing cluster, it is expected that
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tipc</html:code> kernel module will be loaded.</warning>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">3.1.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling TIPC protects
the system against exploitation of any flaws in its implementation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_tipc_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install tipc" /etc/modprobe.d/tipc.conf ; then
	
	sed -i 's#^install tipc.*#install tipc /bin/false#g' /etc/modprobe.d/tipc.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/tipc.conf
	echo "install tipc /bin/false" &gt;&gt; /etc/modprobe.d/tipc.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_tipc_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_tipc_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'tipc' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/tipc.conf
    regexp: install\s+tipc
    line: install tipc /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_tipc_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_tipc_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_permissions">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">File Permissions and Masks</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i xmlns:html="http://www.w3.org/1999/xhtml">PART</html:i> in turn.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Amazon Linux 2023
installations:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.</description>
      <Group id="xccdf_org.ssgproject.content_group_files">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Important Files and
Directories</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that All World-Writable Directories Have Sticky Bits Set</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When the so-called 'sticky bit' is set on a directory, only the owner of a given file may
remove that file from the directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky bit prevents users from
removing each other's files. In cases where there is no reason for a directory to be
world-writable, a better solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application, consult that application's
documentation instead of blindly changing modes.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To set the sticky bit on a world-writable directory <html:i xmlns:html="http://www.w3.org/1999/xhtml">DIR</html:i>, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod +t <html:i>DIR</html:i>
        </html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of directories present on the system. It is
not a problem in most cases, but especially systems with a large number of directories can
be affected. See <html:code xmlns:html="http://www.w3.org/1999/xhtml">https://access.redhat.com/articles/6999111</html:code>.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Please note that there might be cases where the rule remediation cannot fix directory permissions.
This can happen for example when running on a system with some immutable parts.
These immutable parts cannot be remediated because they are read-only.
Example of such directories can be OStree deployments located at <html:code xmlns:html="http://www.w3.org/1999/xhtml">/sysroot/ostree/deploy</html:code>.
In such case, it is needed to make modifications to the underlying ostree snapshot and this is out of scope of regular rule remediation.</warning>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000138-GPOS-00069</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R54</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.11</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Failing to set the sticky bit on public directories allows unauthorized users to delete files
in the directory structure.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The only authorized public directories are those temporary directories supplied with the
system, or those designed to be temporary file repositories. The setting is normally reserved
for directories used by the system, by users for temporary file storage (such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>),
and for directories requiring global read/write access.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dir_perms_world_writable_sticky_bits" system="urn:xccdf:fix:script:sh">df --local -P | awk '{if (NR!=1) print $6}' \
| xargs -I '$6' find '$6' -xdev -type d \
\( -perm -0002 -a ! -perm -1000 \) 2&gt;/dev/null \
-exec chmod a+t {} +
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="dir_perms_world_writable_sticky_bits" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Verify that All World-Writable Directories Have Sticky Bits Set - Define Excluded
    (Non-Local) File Systems and Paths
  ansible.builtin.set_fact:
    excluded_fstypes:
    - afs
    - autofs
    - ceph
    - cifs
    - smb3
    - smbfs
    - sshfs
    - ncpfs
    - ncp
    - nfs
    - nfs4
    - gfs
    - gfs2
    - glusterfs
    - gpfs
    - pvfs2
    - ocfs2
    - lustre
    - davfs
    - fuse.sshfs
    excluded_paths:
    - dev
    - proc
    - run
    - sys
    search_paths: []
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Find Relevant
    Root Directories Ignoring Pre-Defined Excluded Paths
  ansible.builtin.find:
    paths: /
    file_type: directory
    excludes: '{{ excluded_paths }}'
    hidden: true
    recurse: false
  register: result_relevant_root_dirs
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Include
    Relevant Root Directories in a List of Paths to be Searched
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.path]) }}'
  loop: '{{ result_relevant_root_dirs.files }}'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
    Search Paths List with Local Partitions Mount Points
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.mount]) }}'
  loop: '{{ ansible_mounts }}'
  when:
  - item.fstype not in excluded_fstypes
  - item.mount != '/'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
    Search Paths List with Local NFS File System Targets
  ansible.builtin.set_fact:
    search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
  loop: '{{ ansible_mounts }}'
  when: item.device is search("localhost:")
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Define Rule
    Specific Facts
  ansible.builtin.set_fact:
    world_writable_dirs: []
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Find All
    Uncompliant Directories in Local File Systems
  ansible.builtin.command:
    cmd: find {{ item }} -xdev -type d ( -perm -0002 -a ! -perm -1000 )
  loop: '{{ search_paths }}'
  changed_when: false
  register: result_found_dirs
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Create List
    of World Writable Directories Without Sticky Bit
  ansible.builtin.set_fact:
    world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
      }}'
  loop: '{{ result_found_dirs.results }}'
  when: result_found_dirs is not skipped and item is not skipped
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Verify that All World-Writable Directories Have Sticky Bits Set - Ensure Sticky
    Bit is Set on Local World Writable Directories
  ansible.builtin.file:
    path: '{{ item }}'
    mode: a+t
  loop: '{{ world_writable_dirs }}'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - dir_perms_world_writable_sticky_bits
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure No World-Writable Files Exist</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is generally a good idea to remove global (other) write access to a file when it is
discovered. However, check with documentation for specific applications before making changes.
Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured
application or user account. Finally, this applies to real files and not virtual files that
are a part of pseudo file systems such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysfs</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">procfs</html:code>.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code xmlns:html="http://www.w3.org/1999/xhtml">https://access.redhat.com/articles/6999111</html:code>.</warning>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R54</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.11</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Data in world-writable files can be modified by any user on the system. In almost all
circumstances, files can be configured using a combination of user and group permissions to
support whatever legitimate access is needed without the risk caused by world-writable files.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_unauthorized_world_writable" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
FILTER_NODEV=$(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

# Do not consider /sysroot partition because it contains only the physical
# read-only root on bootable containers.
PARTITIONS=$(findmnt -n -l -k -it $FILTER_NODEV | awk '{ print $1 }' | grep -v "/sysroot")

for PARTITION in $PARTITIONS; do
  find "${PARTITION}" -xdev -type f -perm -002 -exec chmod o-w {} \; 2&gt;/dev/null
done

# Ensure /tmp is also fixed when tmpfs is used.
if grep "^tmpfs /tmp" /proc/mounts; then
  find /tmp -xdev -type f -perm -002 -exec chmod o-w {} \; 2&gt;/dev/null
fi
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_unauthorized_world_writable:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Files Are Owned by a Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any file is not group-owned by a valid defined group, the cause of the lack of
group-ownership must be investigated. Following this, those files should be deleted or
assigned to an appropriate group. The groups need to be defined in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>
or in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/group</html:code> if <html:code xmlns:html="http://www.w3.org/1999/xhtml">nss-altfiles</html:code> are configured to be used
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/nsswitch.conf</html:code>.

Locate the mount points related to local devices by the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)</html:pre>

For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid group using the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find <html:i>MOUNTPOINT</html:i> -xdev -nogroup 2&gt;/dev/null</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule only considers local groups as valid groups.
If you have your groups defined outside <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/group</html:code>, the rule won't consider those.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code xmlns:html="http://www.w3.org/1999/xhtml">https://access.redhat.com/articles/6999111</html:code>.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R53</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.12</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_ungroupowned:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure All Files Are Owned by a User</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If any files are not owned by a user, then the cause of their lack of ownership should be
investigated. Following this, the files should be deleted or assigned to an appropriate user.

Locate the mount points related to local devices by the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)</html:pre>

For all mount points listed by the previous command, it is necessary to search for files which
do not belong to a valid user using the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find <html:i>MOUNTPOINT</html:i> -xdev -nouser 2&gt;/dev/null</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">For this rule to evaluate centralized user accounts, <html:code xmlns:html="http://www.w3.org/1999/xhtml">getent</html:code> must be working properly
so that running the command <html:pre xmlns:html="http://www.w3.org/1999/xhtml">getent passwd</html:pre> returns a list of all users in your organization.
If using the System Security Services Daemon (SSSD), <html:pre xmlns:html="http://www.w3.org/1999/xhtml">enumerate = true</html:pre> must be configured
in your organization's domain to return a complete list of users</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule can take a long time to perform the check and might consume a considerable
amount of resources depending on the number of files present on the system. It is not a
problem in most cases, but especially systems with a large number of files can be affected.
See <html:code xmlns:html="http://www.w3.org/1999/xhtml">https://access.redhat.com/articles/6999111</html:code>.</warning>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R53</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.12</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unowned files do not directly imply a security problem, but they are generally a sign that
something is amiss. They may be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging to a deleted account, or
other similar cases. The files should be repaired so they will not cause problems when
accounts are created in the future, and the cause should be discovered and addressed.</rationale>
          <platform idref="#system_with_kernel"/>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-no_files_unowned_by_user:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Files with Local Account Information and Credentials</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default restrictive permissions for files which act as
important security databases such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code>,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">group</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">passwd</html:code> file in order to function properly, but
read access to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/group-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/group-" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/group-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_backup_etc_group_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupowner_backup_etc_group_newgroup: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/group-
  ansible.builtin.stat:
    path: /etc/group-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/group-
  ansible.builtin.file:
    path: /etc/group-
    follow: false
    group: '{{ file_groupowner_backup_etc_group_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/gshadow-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/gshadow-" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/gshadow-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_backup_etc_gshadow_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupowner_backup_etc_gshadow_newgroup: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_groupowner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/gshadow-
  ansible.builtin.stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_groupowner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/gshadow-
  ansible.builtin.file:
    path: /etc/gshadow-
    follow: false
    group: '{{ file_groupowner_backup_etc_gshadow_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_groupowner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/passwd-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/passwd-" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/passwd-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_backup_etc_passwd_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupowner_backup_etc_passwd_newgroup: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/passwd-
  ansible.builtin.stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/passwd-
  ansible.builtin.file:
    path: /etc/passwd-
    follow: false
    group: '{{ file_groupowner_backup_etc_passwd_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/shadow-</html:pre>
        </description>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/shadow-" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/shadow-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_backup_etc_shadow_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupowner_backup_etc_shadow_newgroup: '0'
  tags:
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/shadow-
  ansible.builtin.stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/shadow-
  ansible.builtin.file:
    path: /etc/shadow-
    follow: false
    group: '{{ file_groupowner_backup_etc_shadow_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSS-Req-8.7
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/group</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/group" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/group
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_group_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_group_newgroup: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/group
  ansible.builtin.stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/group
  ansible.builtin.file:
    path: /etc/group
    follow: false
    group: '{{ file_groupowner_etc_group_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/gshadow</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/gshadow" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/gshadow
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_gshadow_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_gshadow_newgroup: '0'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/gshadow
  ansible.builtin.stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/gshadow
  ansible.builtin.file:
    path: /etc/gshadow
    follow: false
    group: '{{ file_groupowner_etc_gshadow_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/passwd</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/passwd" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/passwd
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_passwd_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_passwd_newgroup: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/passwd
  ansible.builtin.stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/passwd
  ansible.builtin.file:
    path: /etc/passwd
    follow: false
    group: '{{ file_groupowner_etc_passwd_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/shadow</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file stores password hashes. Protection of this file is
critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/shadow" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/shadow
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_groupowner_etc_shadow_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_etc_shadow_newgroup: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/shadow
  ansible.builtin.stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/shadow
  ansible.builtin.file:
    path: /etc/shadow
    follow: false
    group: '{{ file_groupowner_etc_shadow_newgroup }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/group- </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/group-" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/group-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_backup_etc_group_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_backup_etc_group_newown: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/group-
  ansible.builtin.stat:
    path: /etc/group-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/group-
  ansible.builtin.file:
    path: /etc/group-
    follow: false
    owner: '{{ file_owner_backup_etc_group_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/gshadow- </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/gshadow-" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/gshadow-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_backup_etc_gshadow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_backup_etc_gshadow_newown: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_owner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/gshadow-
  ansible.builtin.stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_owner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/gshadow-
  ansible.builtin.file:
    path: /etc/gshadow-
    follow: false
    owner: '{{ file_owner_backup_etc_gshadow_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7
  - configure_strategy
  - file_owner_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/passwd- </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/passwd-" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/passwd-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_backup_etc_passwd_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_backup_etc_passwd_newown: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/passwd-
  ansible.builtin.stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/passwd-
  ansible.builtin.file:
    path: /etc/passwd-
    follow: false
    owner: '{{ file_owner_backup_etc_passwd_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/shadow- </html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/shadow-" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/shadow-
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_backup_etc_shadow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_backup_etc_shadow_newown: '0'
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/shadow-
  ansible.builtin.stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/shadow-
  ansible.builtin.file:
    path: /etc/shadow-
    follow: false
    owner: '{{ file_owner_backup_etc_shadow_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/group </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/group" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/group
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_group_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_group_newown: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/group
  ansible.builtin.stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/group
  ansible.builtin.file:
    path: /etc/group
    follow: false
    owner: '{{ file_owner_etc_group_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/gshadow </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/gshadow" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/gshadow
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_gshadow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_gshadow_newown: '0'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/gshadow
  ansible.builtin.stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/gshadow
  ansible.builtin.file:
    path: /etc/gshadow
    follow: false
    owner: '{{ file_owner_etc_gshadow_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/passwd </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/passwd" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/passwd
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_passwd_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_passwd_newown: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/passwd
  ansible.builtin.stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/passwd
  ansible.builtin.file:
    path: /etc/passwd
    follow: false
    owner: '{{ file_owner_etc_passwd_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/shadow </html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">
newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/shadow" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/shadow
fi

fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Set the file_owner_etc_shadow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_etc_shadow_newown: '0'
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/shadow
  ansible.builtin.stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/shadow
  ansible.builtin.file:
    path: /etc/shadow
    follow: false
    owner: '{{ file_owner_etc_shadow_newown }}'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/group-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.5</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group-
  ansible.builtin.stat:
    path: /etc/group-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group-
  ansible.builtin.file:
    path: /etc/group-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/gshadow-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.9</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow-</html:code> file is a backup of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, and as such,
it contains group password hashes. Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow-
  ansible.builtin.stat:
    path: /etc/gshadow-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - configure_strategy
  - file_permissions_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow-
  ansible.builtin.file:
    path: /etc/gshadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - configure_strategy
  - file_permissions_backup_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/passwd-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd-
  ansible.builtin.stat:
    path: /etc/passwd-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd-
  ansible.builtin.file:
    path: /etc/passwd-
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on Backup shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/shadow-</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6 (1)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.7</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow-</html:code> file is a backup file of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow-
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_backup_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow-
  ansible.builtin.stat:
    path: /etc/shadow-
  register: file_exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow-
  ansible.builtin.file:
    path: /etc/shadow-
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6 (1)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_backup_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on group File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/group</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/group
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  ansible.builtin.stat:
    path: /etc/group
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/group
  ansible.builtin.file:
    path: /etc/group
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on gshadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/gshadow</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.8</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/gshadow</html:code> file contains group password hashes. Protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_gshadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/gshadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/gshadow
  ansible.builtin.stat:
    path: /etc/gshadow
  register: file_exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/gshadow
  ansible.builtin.file:
    path: /etc/gshadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_permissions_etc_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on passwd File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/passwd</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.1</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.2</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/passwd</html:code> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xs,g-xws,o-xwt /etc/passwd
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  ansible.builtin.stat:
    path: /etc/passwd
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwt on /etc/passwd
  ansible.builtin.file:
    path: /etc/passwd
    mode: u-xs,g-xws,o-xwt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on shadow File</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0000 /etc/shadow</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">13</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</reference>
            <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.7.c</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.1.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">



chmod u-xwrs,g-xwrs,o-xwrt /etc/shadow
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  ansible.builtin.stat:
    path: /etc/shadow
  register: file_exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xwrs,g-xwrs,o-xwrt on /etc/shadow
  ansible.builtin.file:
    path: /etc/shadow
    mode: u-xwrs,g-xwrs,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CJIS-5.5.2.2
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-8.7.c
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_etc_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_mounting">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Dynamic Mounting and Unmounting of
Filesystems</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</html:pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d</html:code>.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of cramfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/cramfs.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install cramfs /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install cramfs /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code> filesystem type is a compressed read-only
Linux filesystem embedded in small footprint systems. A
<html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code> image can be used without having to first
decompress the image.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local attack surface
of the server.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_cramfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install cramfs" /etc/modprobe.d/cramfs.conf ; then
	
	sed -i 's#^install cramfs.*#install cramfs /bin/false#g' /etc/modprobe.d/cramfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/cramfs.conf
	echo "install cramfs /bin/false" &gt;&gt; /etc/modprobe.d/cramfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_cramfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_cramfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'cramfs' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/cramfs.conf
    regexp: install\s+cramfs
    line: install cramfs /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_cramfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_cramfs_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of freevxfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">freevxfs</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/freevxfs.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install freevxfs /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">freevxfs</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install freevxfs /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_freevxfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install freevxfs" /etc/modprobe.d/freevxfs.conf ; then
	
	sed -i 's#^install freevxfs.*#install freevxfs /bin/false#g' /etc/modprobe.d/freevxfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/freevxfs.conf
	echo "install freevxfs /bin/false" &gt;&gt; /etc/modprobe.d/freevxfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_freevxfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_freevxfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'freevxfs' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/freevxfs.conf
    regexp: install\s+freevxfs
    line: install freevxfs /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_freevxfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_freevxfs_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of hfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfs</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/hfs.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfs /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfs</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfs /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install hfs" /etc/modprobe.d/hfs.conf ; then
	
	sed -i 's#^install hfs.*#install hfs /bin/false#g' /etc/modprobe.d/hfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfs.conf
	echo "install hfs /bin/false" &gt;&gt; /etc/modprobe.d/hfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_hfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'hfs' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/hfs.conf
    regexp: install\s+hfs
    line: install hfs /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_hfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_hfs_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of hfsplus</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfsplus</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/hfsplus.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfsplus /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">hfsplus</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install hfsplus /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.7</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfsplus_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install hfsplus" /etc/modprobe.d/hfsplus.conf ; then
	
	sed -i 's#^install hfsplus.*#install hfsplus /bin/false#g' /etc/modprobe.d/hfsplus.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/hfsplus.conf
	echo "install hfsplus /bin/false" &gt;&gt; /etc/modprobe.d/hfsplus.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_hfsplus_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_hfsplus_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'hfsplus' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/hfsplus.conf
    regexp: install\s+hfsplus
    line: install hfsplus /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_hfsplus_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_hfsplus_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of jffs2</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">jffs2</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/jffs2.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install jffs2 /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">jffs2</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install jffs2 /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Linux kernel modules which implement filesystems that are not needed by the
local system should be disabled.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_jffs2_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install jffs2" /etc/modprobe.d/jffs2.conf ; then
	
	sed -i 's#^install jffs2.*#install jffs2 /bin/false#g' /etc/modprobe.d/jffs2.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/jffs2.conf
	echo "install jffs2 /bin/false" &gt;&gt; /etc/modprobe.d/jffs2.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_jffs2_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_jffs2_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'jffs2' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/jffs2.conf
    regexp: install\s+jffs2
    line: install jffs2 /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_jffs2_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_jffs2_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of squashfs</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/squashfs.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install squashfs /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install squashfs /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code> filesystem type is a compressed read-only Linux
filesystem embedded in small footprint systems (similar to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">cramfs</html:code>). A <html:code xmlns:html="http://www.w3.org/1999/xhtml">squashfs</html:code> image can be used without having
to first decompress the image.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local attack
surface of the system.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_squashfs_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install squashfs" /etc/modprobe.d/squashfs.conf ; then
	
	sed -i 's#^install squashfs.*#install squashfs /bin/false#g' /etc/modprobe.d/squashfs.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/squashfs.conf
	echo "install squashfs /bin/false" &gt;&gt; /etc/modprobe.d/squashfs.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_squashfs_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_squashfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'squashfs' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/squashfs.conf
    regexp: install\s+squashfs
    line: install squashfs /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_squashfs_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_squashfs_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Mounting of udf</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">udf</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/udf.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install udf /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">udf</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install udf /bin/true</html:pre>

This effectively prevents usage of this uncommon filesystem.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">udf</html:code> filesystem type is the universal disk format
used to implement the ISO/IEC 13346 and ECMA-167 specifications.
This is an open vendor filesystem type for data storage on a broad
range of media. This filesystem type is necessary to support
writing DVDs and newer optical disc formats.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.1.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing support for unneeded filesystem types reduces the local
attack surface of the system.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_udf_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install udf" /etc/modprobe.d/udf.conf ; then
	
	sed -i 's#^install udf.*#install udf /bin/false#g' /etc/modprobe.d/udf.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/udf.conf
	echo "install udf /bin/false" &gt;&gt; /etc/modprobe.d/udf.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_udf_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_udf_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required

- name: Ensure kernel module 'udf' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/udf.conf
    regexp: install\s+udf
    line: install udf /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.4.6
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - kernel_module_udf_disabled
  - low_complexity
  - low_severity
  - medium_disruption
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_udf_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Modprobe Loading of USB Storage Driver</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.

To configure the system to prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">usb-storage</html:code>
kernel module from being loaded, add the following line to the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/modprobe.d/usb-storage.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install usb-storage /bin/false</html:pre>
This entry will cause a non-zero return value during a <html:code xmlns:html="http://www.w3.org/1999/xhtml">usb-storage</html:code> module installation
and additionally convey the meaning of the entry to the user in form of an error message.
If you would like to omit a non-zero return value and an error message, you may want to add a different line instead
(both <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/true</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/bin/false</html:code> are allowed by OVAL and will be accepted by the scan):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">install usb-storage /bin/true</html:pre>

This will prevent the <html:code xmlns:html="http://www.w3.org/1999/xhtml">modprobe</html:code> program from loading the <html:code xmlns:html="http://www.w3.org/1999/xhtml">usb-storage</html:code>
module, but will not prevent an administrator (or another program) from using the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">insmod</html:code> program to load the module manually.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.21</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(iv)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000114-GPOS-00059</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000378-GPOS-00163</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000141-CTR-000315</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">USB storage devices such as thumb drives can be used to introduce
malicious software.</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_usb-storage_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if LC_ALL=C grep -q -m 1 "^install usb-storage" /etc/modprobe.d/usb-storage.conf ; then
	
	sed -i 's#^install usb-storage.*#install usb-storage /bin/false#g' /etc/modprobe.d/usb-storage.conf
else
	echo -e "\n# Disable per security requirements" &gt;&gt; /etc/modprobe.d/usb-storage.conf
	echo "install usb-storage /bin/false" &gt;&gt; /etc/modprobe.d/usb-storage.conf
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="kernel_module_usb-storage_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.21
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - disable_strategy
  - kernel_module_usb-storage_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required

- name: Ensure kernel module 'usb-storage' is disabled
  ansible.builtin.lineinfile:
    create: true
    dest: /etc/modprobe.d/usb-storage.conf
    regexp: install\s+usb-storage
    line: install usb-storage /bin/false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.21
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - PCI-DSSv4-3.4
  - PCI-DSSv4-3.4.2
  - disable_strategy
  - kernel_module_usb-storage_disabled
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-kernel_module_usb-storage_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_partitions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Partition Mount Options</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> configuration file, and can be
used to make certain types of malicious behavior more difficult.</description>
        <platform idref="#not_bootc_and_not_container"/>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent creation of device
files in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>. Legitimate character and block devices should
not exist within temporary directories like <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.8.2</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to /dev/shm
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.8.3</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from world-writable directories
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code> can expose the system to potential compromise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_noexec
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_noexec:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /dev/shm</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent execution
of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.  The SUID and SGID permissions should not
be required in these world-writable directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev/shm</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.8.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ); then

function perform_remediation {
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type="tmpfs"
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo "tmpfs /dev/shm tmpfs defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/dev/shm"; then
        if mountpoint -q "/dev/shm"; then
            mount -o remount --target "/dev/shm"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_dev_shm_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
  command: findmnt  '/dev/shm'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /dev/shm
    - tmpfs
    - tmpfs
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - ("" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to
    /dev/shm options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
  mount:
    path: /dev/shm
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("" |
    length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_dev_shm_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_dev_shm_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /home</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.7.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_home"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/home" &gt; /dev/null || findmnt --fstab "/home" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /home has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/home")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /home in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /home)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /home  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/home"; then
        if mountpoint -q "/home"; then
            mount -o remount --target "/home"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /home --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Check information associated to mountpoint'
  command: findmnt --fstab '/home'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: If /home not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /home
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Make sure nodev option is part of the to /home
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity

- name: 'Add nodev Option to /home: Ensure /home is mounted with nodev option'
  mount:
    path: /home
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - mount_option_home_nodev
  - no_reboot_needed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_home_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_home_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /home</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>. The SUID and SGID permissions
should not be required in these user data directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/home</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.7.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from user home directory partitions.</rationale>
          <platform idref="#mount_home"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/home" &gt; /dev/null || findmnt --fstab "/home" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /home has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/home")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /home in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /home)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /home  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/home"; then
        if mountpoint -q "/home"; then
            mount -o remount --target "/home"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /home --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_home_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /home: Check information associated to mountpoint'
  command: findmnt --fstab '/home'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /home: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /home: If /home not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /home
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /home: Make sure nosuid option is part of the to /home
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /home: Ensure /home is mounted with nosuid option'
  mount:
    path: /home
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/home" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_home_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_home_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_home_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Make sure nodev option is part of the to /tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /tmp: Ensure /tmp is mounted with nodev option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.2.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from world-writable directories
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="#mount_tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="noexec"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Make sure noexec option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /tmp: Ensure /tmp is mounted with noexec option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_noexec
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_noexec:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/tmp</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.3.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.2.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
          <platform idref="#mount_tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/tmp" &gt; /dev/null || findmnt --fstab "/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /tmp  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/tmp"; then
        if mountpoint -q "/tmp"; then
            mount -o remount --target "/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /tmp --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_tmp_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: If /tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Make sure nosuid option is part of the to /tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /tmp: Ensure /tmp is mounted with nosuid option'
  mount:
    path: /tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_tmp_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_tmp_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.6.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_var-log-audit"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Make sure nodev option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nodev option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.6.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from directories containing audit log files
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="#mount_var-log-audit"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="noexec"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Make sure noexec option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log/audit: Ensure /var/log/audit is mounted with
    noexec option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_noexec
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_noexec:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var/log/audit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.6.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files.</rationale>
          <platform idref="#mount_var-log-audit"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log/audit" &gt; /dev/null || findmnt --fstab "/var/log/audit" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log/audit has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log/audit in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log/audit  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log/audit"; then
        if mountpoint -q "/var/log/audit"; then
            mount -o remount --target "/var/log/audit"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log/audit --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_audit_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log/audit'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: If /var/log/audit not mounted, craft
    mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log/audit
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Make sure nosuid option is part of the
    to /var/log/audit options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log/audit: Ensure /var/log/audit is mounted with
    nosuid option'
  mount:
    path: /var/log/audit
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log/audit" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_audit_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_audit_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.5.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_var-log"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: If /var/log not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Make sure nodev option is part of the to /var/log
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/log: Ensure /var/log is mounted with nodev option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.5.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from directories containing log files
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="#mount_var-log"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="noexec"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Make sure noexec option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/log: Ensure /var/log is mounted with noexec option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_noexec
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_noexec:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var/log</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>. The SUID and SGID permissions
should not be required in directories containing log files.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.5.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files.</rationale>
          <platform idref="#mount_var-log"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/log" &gt; /dev/null || findmnt --fstab "/var/log" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/log has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/log")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/log in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/log)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/log  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/log"; then
        if mountpoint -q "/var/log"; then
            mount -o remount --target "/var/log"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/log --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_log_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Check information associated to mountpoint'
  command: findmnt --fstab '/var/log'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: If /var/log not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/log
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Make sure nosuid option is part of the to
    /var/log options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/log: Ensure /var/log is mounted with nosuid option'
  mount:
    path: /var/log
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/log" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_log_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_log_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.
Legitimate character and block devices should exist only in
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory on the root partition or within chroot
jails built for system services.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.</description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MP-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.3.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_var"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var" &gt; /dev/null || findmnt --fstab "/var" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Make sure nodev option is part of the to /var options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var: Ensure /var is mounted with nodev option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - NIST-800-53-AC-6
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-MP-7
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>. The SUID and SGID permissions
should not be required for this directory.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code>.</description>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.3.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled.</rationale>
          <platform idref="#mount_var"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var" &gt; /dev/null || findmnt --fstab "/var" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var"; then
        if mountpoint -q "/var"; then
            mount -o remount --target "/var"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Check information associated to mountpoint'
  command: findmnt --fstab '/var'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: If /var not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Make sure nosuid option is part of the to /var
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var: Ensure /var is mounted with nosuid option'
  mount:
    path: /var
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nodev Option to /var/tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> mount option can be used to prevent device files from
being created in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>. Legitimate character and block devices
should not exist within temporary directories like <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nodev</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.4.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The only legitimate location for device files is the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/dev</html:code> directory
located on the root partition. The only exception to this is chroot jails.</rationale>
          <platform idref="#mount_var-tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nodev" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nodev)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}nodev 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nodev"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nodev|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nodev" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/tmp --mountoptions="nodev"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nodev" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: If /var/tmp not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Make sure nodev option is part of the to /var/tmp
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nodev" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed

- name: 'Add nodev Option to /var/tmp: Ensure /var/tmp is mounted with nodev option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nodev
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_tmp_nodev:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add noexec Option to /var/tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> mount option can be used to prevent binaries
from being executed out of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">noexec</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.4.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Allowing users to execute binaries from world-writable directories
such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code> should never be necessary in normal operation and
can expose the system to potential compromise.</rationale>
          <platform idref="#mount_var-tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_noexec" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|noexec)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}noexec 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "noexec"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,noexec|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_noexec" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/tmp --mountoptions="noexec"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_noexec" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: If /var/tmp not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Make sure noexec option is part of the to
    /var/tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "noexec" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed

- name: 'Add noexec Option to /var/tmp: Ensure /var/tmp is mounted with noexec option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_noexec
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_tmp_noexec:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_tmp_noexec_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Add nosuid Option to /var/tmp</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> mount option can be used to prevent
execution of setuid programs in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>. The SUID and SGID permissions
should not be required in these world-writable directories.
Add the <html:code xmlns:html="http://www.w3.org/1999/xhtml">nosuid</html:code> option to the fourth column of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/fstab</html:code> for the line which controls mounting of
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/tmp</html:code>.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000368-GPOS-00154</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R28</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.1.4.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions.</rationale>
          <platform idref="#mount_var-tmp"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nosuid" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if ( ! ( { rpm --quiet -q kernel ;} &amp;&amp; { rpm --quiet -q rpm-ostree ;} &amp;&amp; { rpm --quiet -q bootc ;} &amp;&amp; { ! rpm --quiet -q openshift-kubelet ;} &amp;&amp; ([ -f /run/ostree-booted ] || [ -L /ostree ]) ) &amp;&amp; ! ( [ -f /.dockerenv ] || [ -f /run/.containerenv ] ) ) &amp;&amp; { findmnt --kernel "/var/tmp" &gt; /dev/null || findmnt --fstab "/var/tmp" &gt; /dev/null; }; then

function perform_remediation {
    
        # the mount point /var/tmp has to be defined in /etc/fstab
        # before this remediation can be executed. In case it is not defined, the
        # remediation aborts and no changes regarding the mount point are done.
        mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"

    grep "$mount_point_match_regexp" -q /etc/fstab \
        || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" &gt;&amp;2;
                echo "Not remediating, because there is no record of /var/tmp in /etc/fstab" &gt;&amp;2; return 1; }
    


    mount_point_match_regexp="$(printf "^[[:space:]]*[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"

    # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
    if ! grep -q "$mount_point_match_regexp" /etc/fstab; then
        # runtime opts without some automatic kernel/userspace-added defaults
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/mtab | head -1 |  awk '{print $4}' \
                    | sed -E "s/(rw|defaults|seclabel|nosuid)(,|$)//g;s/,$//")
        [ "$previous_mount_opts" ] &amp;&amp; previous_mount_opts+=","
        # In iso9660 filesystems mtab could describe a "blocksize" value, this should be reflected in
        # fstab as "block".  The next variable is to satisfy shellcheck SC2050.
        fs_type=""
        if [  "$fs_type" == "iso9660" ] ; then
            previous_mount_opts=$(sed 's/blocksize=/block=/' &lt;&lt;&lt; "$previous_mount_opts")
        fi
        echo " /var/tmp  defaults,${previous_mount_opts}nosuid 0 0" &gt;&gt; /etc/fstab
    # If the mount_opt option is not already in the mount point's /etc/fstab entry, add it
    elif ! grep "$mount_point_match_regexp" /etc/fstab | grep -q "nosuid"; then
        previous_mount_opts=$(grep "$mount_point_match_regexp" /etc/fstab | awk '{print $4}')
        sed -i "s|\(${mount_point_match_regexp}.*${previous_mount_opts}\)|\1,nosuid|" /etc/fstab
    fi


    if mkdir -p "/var/tmp"; then
        if mountpoint -q "/var/tmp"; then
            mount -o remount --target "/var/tmp"
        fi
    fi
}

perform_remediation

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nosuid" system="urn:redhat:anaconda:pre" complexity="low" disruption="high" strategy="enable">
part /var/tmp --mountoptions="nosuid"
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="mount_option_var_tmp_nosuid" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="high" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Check information associated to mountpoint'
  command: findmnt --fstab '/var/tmp'
  register: device_name
  failed_when: device_name.rc &gt; 1
  changed_when: false
  check_mode: false
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length &gt; 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: If /var/tmp not mounted, craft mount_info
    manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /var/tmp
    - ''
    - ''
    - defaults
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Make sure nosuid option is part of the to
    /var/tmp options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid''
      }) }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in mount_info.options
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /var/tmp: Ensure /var/tmp is mounted with nosuid option'
  mount:
    path: /var/tmp
    src: '{{ mount_info.source }}'
    opts: '{{ mount_info.options }}'
    state: mounted
    fstype: '{{ mount_info.fstype }}'
  when:
  - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
    and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
    and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
    ["docker", "lxc", "openvz", "podman", "container"] ) )
  - '"/var/tmp" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_var_tmp_nosuid
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-mount_option_var_tmp_nosuid:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-mount_option_var_tmp_nosuid_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_restrictions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict Programs from Dangerous Execution Patterns</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict usage of ptrace to descendant processes</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.yama.ptrace_scope</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.yama.ptrace_scope=1</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.yama.ptrace_scope = 1</html:pre>
       </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(10)</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000132-GPOS-00067</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R11</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.5.2</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unrestricted usage of ptrace allows compromised binaries to run ptrace
on another processes of the user. Like this, the attacker can steal
sensitive information from the target processes (e.g. SSH sessions, web browser, ...)
without any additional assistance from the user (i.e. without resorting to phishing).
</rationale>
          <platform idref="#system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_yama_ptrace_scope" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of kernel.yama.ptrace_scope from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.yama.ptrace_scope.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.yama.ptrace_scope" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.yama.ptrace_scope
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w kernel.yama.ptrace_scope="1"
fi

#
# If kernel.yama.ptrace_scope present in /etc/sysctl.conf, change value to "1"
#	else, add "kernel.yama.ptrace_scope = 1" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.yama.ptrace_scope")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.yama.ptrace_scope\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.yama.ptrace_scope\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_yama_ptrace_scope" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Restrict usage of ptrace to descendant processes - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Restrict usage of ptrace to descendant processes - Find all files that contain
    kernel.yama.ptrace_scope
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*kernel.yama.ptrace_scope\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Restrict usage of ptrace to descendant processes - Find all files that set
    kernel.yama.ptrace_scope to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*kernel.yama.ptrace_scope\s*=\s*1$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Restrict usage of ptrace to descendant processes - Comment out any occurrences
    of kernel.yama.ptrace_scope from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*kernel.yama.ptrace_scope
    replace: '#kernel.yama.ptrace_scope'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope

- name: Restrict usage of ptrace to descendant processes - Ensure sysctl kernel.yama.ptrace_scope
    is set to 1
  ansible.posix.sysctl:
    name: kernel.yama.ptrace_scope
    value: '1'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-SC-7(10)
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_yama_ptrace_scope
</fix>
          <check system="http://open-scap.org/page/SCE">
            <check-import import-name="stdout">
                </check-import>
            <check-content-ref href="al2023/checks/sce/sysctl_kernel_yama_ptrace_scope.sh"/>
          </check>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Group id="xccdf_org.ssgproject.content_group_coredumps">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Core Dumps</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Once a hard limit is set in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.conf</html:code>, or
to a file within the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/security/limits.d/</html:code> directory, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">limits.conf</html:code> man page for more
information.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The core dumps of setuid programs are further protected. The
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variable <html:code xmlns:html="http://www.w3.org/1999/xhtml">fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</description>
          <platform idref="#system_with_kernel"/>
          <Rule id="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable core dump backtraces</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ProcessSizeMax</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> or in a drop-in file under
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf.d/</html:code> specifies the maximum size in bytes
of a core which will be processed. Core dumps exceeding this size may be
stored, but the backtrace will not be generated.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> file or a drop-in file under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf.d/</html:code>
does not already contain the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section,
the value will not be configured correctly.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-3.2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.5.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.

Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debugging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</rationale>
            <platform idref="#package_systemd"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_backtraces" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q systemd; }; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/systemd/coredump.conf.d/complianceascode_hardening.conf /etc/systemd/coredump.conf.d/*.conf /etc/systemd/coredump.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*ProcessSizeMax" "$f"; then
        if ! grep -qPz "ProcessSizeMax=0" "$f"; then

            sed -i "s/ProcessSizeMax[^(\n)]*/ProcessSizeMax=0/" "$f"

        fi

        found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then

            sed -i "/[[:space:]]*\[Coredump\]/a ProcessSizeMax=0" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/systemd/coredump.conf.d/complianceascode_hardening.conf /etc/systemd/coredump.conf.d/*.conf /etc/systemd/coredump.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[Coredump]\nProcessSizeMax=0" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_backtraces" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable core dump backtraces - Search for a section in files
  ansible.builtin.find:
    paths: '{{item.path}}'
    patterns: '{{item.pattern}}'
    contains: ^\s*\[Coredump\]
    read_whole_file: true
    use_regex: true
  register: systemd_dropin_files_with_section
  loop:
  - path: '{{ ''/etc/systemd/coredump.conf'' | dirname }}'
    pattern: '{{ ''/etc/systemd/coredump.conf'' | basename | regex_escape }}'
  - path: /etc/systemd/coredump.conf.d
    pattern: .*\.conf
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable core dump backtraces - Count number of files which contain the correct
    section
  ansible.builtin.set_fact:
    count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results
      | map(attribute=''matched'') | list | map(''int'') | sum}}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable core dump backtraces - Add missing configuration to correct section
  community.general.ini_file:
    path: '{{item}}'
    section: Coredump
    option: ProcessSizeMax
    value: '0'
    state: present
    no_extra_spaces: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  - count_of_systemd_dropin_files_with_section | int &gt; 0
  loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[])
    | map(attribute=''path'') | list }}'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable core dump backtraces - Add configuration to new remediation file
  community.general.ini_file:
    path: /etc/systemd/coredump.conf.d/complianceascode_hardening.conf
    section: Coredump
    option: ProcessSizeMax
    value: '0'
    state: present
    no_extra_spaces: true
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  - count_of_systemd_dropin_files_with_section | int == 0
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_backtraces
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_backtraces:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
          <Rule id="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable storing core dump</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">Storage</html:code> option in <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> or a drop-in file in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf.d/*.conf</html:code>
can be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">none</html:code> to disable storing core dumps permanently.</description>
            <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf</html:code> file or a drop-in file under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/systemd/coredump.conf.d/</html:code>
does not already contain the <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Coredump]</html:code> section,
the value will not be configured correctly.</warning>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-3.2</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.5.3</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debugging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy.</rationale>
            <platform idref="#package_systemd"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_storage" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q systemd; }; then

found=false

# set value in all files if they contain section or key
for f in $(echo -n "/etc/systemd/coredump.conf.d/complianceascode_hardening.conf /etc/systemd/coredump.conf.d/*.conf /etc/systemd/coredump.conf"); do
    if [ ! -e "$f" ]; then
        continue
    fi

    # find key in section and change value
    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*Storage" "$f"; then
        if ! grep -qPz "Storage=none" "$f"; then

            sed -i "s/Storage[^(\n)]*/Storage=none/" "$f"

        fi

        found=true

    # find section and add key = value to it
    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then

            sed -i "/[[:space:]]*\[Coredump\]/a Storage=none" "$f"

            found=true
    fi
done

# if section not in any file, append section with key = value to FIRST file in files parameter
if ! $found ; then
    file=$(echo "/etc/systemd/coredump.conf.d/complianceascode_hardening.conf /etc/systemd/coredump.conf.d/*.conf /etc/systemd/coredump.conf" | cut -f1 -d ' ')
    mkdir -p "$(dirname "$file")"

    echo -e "[Coredump]\nStorage=none" &gt;&gt; "$file"

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="coredump_disable_storage" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable storing core dump - Search for a section in files
  ansible.builtin.find:
    paths: '{{item.path}}'
    patterns: '{{item.pattern}}'
    contains: ^\s*\[Coredump\]
    read_whole_file: true
    use_regex: true
  register: systemd_dropin_files_with_section
  loop:
  - path: '{{ ''/etc/systemd/coredump.conf'' | dirname }}'
    pattern: '{{ ''/etc/systemd/coredump.conf'' | basename | regex_escape }}'
  - path: /etc/systemd/coredump.conf.d
    pattern: .*\.conf
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable storing core dump - Count number of files which contain the correct
    section
  ansible.builtin.set_fact:
    count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results
      | map(attribute=''matched'') | list | map(''int'') | sum}}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable storing core dump - Add missing configuration to correct section
  community.general.ini_file:
    path: '{{item}}'
    section: Coredump
    option: Storage
    value: none
    state: present
    no_extra_spaces: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  - count_of_systemd_dropin_files_with_section | int &gt; 0
  loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[])
    | map(attribute=''path'') | list }}'
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable storing core dump - Add configuration to new remediation file
  community.general.ini_file:
    path: /etc/systemd/coredump.conf.d/complianceascode_hardening.conf
    section: Coredump
    option: Storage
    value: none
    state: present
    no_extra_spaces: true
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"systemd" in ansible_facts.packages'
  - count_of_systemd_dropin_files_with_section | int == 0
  tags:
  - NIST-800-53-CM-6
  - PCI-DSS-Req-3.2
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - coredump_disable_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-coredump_disable_storage:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
        <Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable ExecShield</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code> variables 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code xmlns:html="http://www.w3.org/1999/xhtml">sysctl</html:code>.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" selected="false" role="full" severity="medium">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Randomized Layout of Virtual Address Space</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To set the runtime status of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space</html:code> kernel parameter, run the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo sysctl -w kernel.randomize_va_space=2</html:pre>
To make sure that the setting is persistent, add the following line to a file in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysctl.d</html:code>: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">kernel.randomize_va_space = 2</html:pre>
        </description>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
            <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-002-5 R1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-002-5 R1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 4.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 4.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-005-6 R1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-005-6 R1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-005-6 R1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R3.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R8.4</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-009-6 R.1.1</reference>
            <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-009-6 R4</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-30(2)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.1</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000433-GPOS-00193</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
            <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000450-CTR-001105</reference>
            <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R9</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.5.1</reference>
            <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3.1</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">3.3</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation. Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_randomize_va_space" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="medium" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# Comment out any occurrences of kernel.randomize_va_space from /etc/sysctl.d/*.conf files

for f in /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf; do


  # skip systemd-sysctl symlink (/etc/sysctl.d/99-sysctl.conf -&gt; /etc/sysctl.conf)
  if [[ "$(readlink -f "$f")" == "/etc/sysctl.conf" ]]; then continue; fi

  matching_list=$(grep -P '^(?!#).*[\s]*kernel.randomize_va_space.*$' $f | uniq )
  if ! test -z "$matching_list"; then
    while IFS= read -r entry; do
      escaped_entry=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$entry")
      # comment out "kernel.randomize_va_space" matches to preserve user data
      sed -i --follow-symlinks "s/^${escaped_entry}$/# &amp;/g" $f
    done &lt;&lt;&lt; "$matching_list"
  fi
done

#
# Set sysctl config file which to save the desired value
#

SYSCONFIG_FILE="/etc/sysctl.conf"


#
# Set runtime for kernel.randomize_va_space
#
if ! { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    /sbin/sysctl -q -n -w kernel.randomize_va_space="2"
fi

#
# If kernel.randomize_va_space present in /etc/sysctl.conf, change value to "2"
#	else, add "kernel.randomize_va_space = 2" to /etc/sysctl.conf
#

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^kernel.randomize_va_space")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "2"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^kernel.randomize_va_space\\&gt;" "${SYSCONFIG_FILE}"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^kernel.randomize_va_space\\&gt;.*/$escaped_formatted_output/gi" "${SYSCONFIG_FILE}"
else
    if [[ -s "${SYSCONFIG_FILE}" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "${SYSCONFIG_FILE}" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "${SYSCONFIG_FILE}"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "${SYSCONFIG_FILE}"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sysctl_kernel_randomize_va_space" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Enable Randomized Layout of Virtual Address Space - Set fact for sysctl paths
  ansible.builtin.set_fact:
    sysctl_paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/
    - /usr/lib/sysctl.d/
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Enable Randomized Layout of Virtual Address Space - Find all files that contain
    kernel.randomize_va_space
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*kernel.randomize_va_space\s*=\s*.*$'
  register: find_all_values
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Enable Randomized Layout of Virtual Address Space - Find all files that set
    kernel.randomize_va_space to correct value
  ansible.builtin.shell:
    cmd: find -L {{ sysctl_paths | join(" ") }} -type f -name '*.conf' | xargs grep
      -HP '^\s*kernel.randomize_va_space\s*=\s*2$'
  register: find_correct_value
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Enable Randomized Layout of Virtual Address Space - Comment out any occurrences
    of kernel.randomize_va_space from config files
  ansible.builtin.replace:
    path: '{{ item | split(":") | first }}'
    regexp: ^[\s]*kernel.randomize_va_space
    replace: '#kernel.randomize_va_space'
  loop: '{{ find_all_values.stdout_lines }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
    | length &gt; find_correct_value.stdout_lines | length
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space

- name: Enable Randomized Layout of Virtual Address Space - Ensure sysctl kernel.randomize_va_space
    is set to 2
  ansible.posix.sysctl:
    name: kernel.randomize_va_space
    value: '2'
    sysctl_file: /etc/sysctl.conf
    state: present
    reload: true
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-30
  - NIST-800-53-SC-30(2)
  - PCI-DSS-Req-2.2.1
  - PCI-DSSv4-3.3
  - PCI-DSSv4-3.3.1
  - PCI-DSSv4-3.3.1.1
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_randomize_va_space
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/sysctl_kernel_randomize_va_space.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-sysctl_kernel_randomize_va_space:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_selinux">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SELinux policy, as configured on Amazon Linux 2023, has been
sufficiently developed and debugged that it should be usable on
almost any system with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Amazon Linux 2023 system, unless that
system has unusual requirements which make a stronger policy
appropriate.</description>
      <platform idref="#system_with_kernel"/>
      <Value id="xccdf_org.ssgproject.content_value_var_selinux_policy_name" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux policy</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Type of policy in use. Possible values are:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>targeted - Only targeted network daemons are protected.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>strict - Full SELinux protection.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>mls - Multiple levels of security</description>
        <value>targeted</value>
        <value selector="mls">mls</value>
        <value selector="targeted">targeted</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_selinux_state" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux state</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">enforcing - SELinux security policy is enforced.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>permissive - SELinux prints warnings instead of enforcing.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>disabled - SELinux is fully disabled.</description>
        <value>enforcing</value>
        <value selector="disabled">disabled</value>
        <value selector="enforcing">enforcing</value>
        <value selector="permissive">permissive</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_package_libselinux_installed" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Install libselinux Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libselinux</html:code> package can be installed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf install libselinux</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">libselinux</html:code> package contains the core library of the Security-enhanced Linux system.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_libselinux

class install_libselinux {
  package { 'libselinux':
    ensure =&gt; 'installed',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "libselinux" ; then
    dnf install -y "libselinux"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "libselinux"
version = "*"
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=libselinux
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_libselinux_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_libselinux_installed

- name: Ensure libselinux is installed
  ansible.builtin.package:
    name: libselinux
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_libselinux_installed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_libselinux_installed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall mcstrans Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">mcstransd</html:code> daemon provides category label information
to client processes requesting information. The label translations are defined
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/targeted/setrans.conf</html:code>.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">mcstrans</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove mcstrans</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.8</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Since this service is not used very often, disable it to reduce the
amount of potentially vulnerable code running on the system.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_mcstrans

class remove_mcstrans {
  package { 'mcstrans':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# CAUTION: This remediation script will remove mcstrans
# from the system, and may remove any packages
# that depend on mcstrans. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "mcstrans" ; then
dnf remove -y --noautoremove "mcstrans"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=mcstrans
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_mcstrans_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_mcstrans_removed

- name: 'Uninstall mcstrans Package: Ensure mcstrans is removed'
  ansible.builtin.package:
    name: mcstrans
    state: absent
  when: '"kernel" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_mcstrans_removed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_mcstrans_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall setroubleshoot Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">setroubleshoot</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove setroubleshoot</html:pre>
      </description>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R49</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.7</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SETroubleshoot service is an unnecessary daemon to
have running on a server, especially if
X Windows is removed or disabled.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_setroubleshoot

class remove_setroubleshoot {
  package { 'setroubleshoot':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# CAUTION: This remediation script will remove setroubleshoot
# from the system, and may remove any packages
# that depend on setroubleshoot. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "setroubleshoot" ; then
dnf remove -y --noautoremove "setroubleshoot"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=setroubleshoot
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_setroubleshoot_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot_removed

- name: 'Uninstall setroubleshoot Package: Ensure setroubleshoot is removed'
  ansible.builtin.package:
    name: setroubleshoot
    state: absent
  when: '"kernel" in ansible_facts.packages'
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_setroubleshoot_removed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_setroubleshoot_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux Not Disabled in /etc/default/grub</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SELinux can be disabled at boot time by an argument in
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/default/grub</html:code>.
Remove any instances of <html:code xmlns:html="http://www.w3.org/1999/xhtml">selinux=0</html:code> from the kernel arguments in that
file to prevent SELinux from being disabled at boot.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disabling a major host protection feature, such as SELinux, at boot time prevents
it from confining system services at boot time.  Further, it increases
the chances that it will remain off during system operation.</rationale>
        <platform idref="#grub2"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_selinux" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q grub2-common; }; then

sed -i --follow-symlinks "s/selinux=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*
sed -i --follow-symlinks "s/enforcing=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/*

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_enable_selinux" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Find /etc/grub.d/ files
  ansible.builtin.find:
    paths:
    - /etc/grub.d/
    follow: true
  register: result_grub_d
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/grub.d/ files
  ansible.builtin.replace:
    dest: '{{ item.path }}'
    regexp: (selinux|enforcing)=0
  with_items:
  - '{{ result_grub_d.files }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Check if /etc/grub2.cfg
    exists
  ansible.builtin.stat:
    path: /etc/grub2.cfg
  register: result_grub2_cfg_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Check if /etc/default/grub
    exists
  ansible.builtin.stat:
    path: /etc/default/grub
  register: result_default_grub_present
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/grub2.cfg
  ansible.builtin.replace:
    dest: /etc/grub2.cfg
    regexp: (selinux|enforcing)=0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - result_grub2_cfg_present.stat.exists
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure SELinux Not Disabled in /etc/default/grub - Ensure SELinux Not Disabled
    in /etc/default/grub
  ansible.builtin.replace:
    dest: /etc/default/grub
    regexp: (selinux|enforcing)=0
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - result_default_grub_present.stat.exists
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - grub2_enable_selinux
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-grub2_enable_selinux:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure No Daemons are Unconfined by SELinux</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the <html:code xmlns:html="http://www.w3.org/1999/xhtml">init</html:code> process, they inherit the <html:code xmlns:html="http://www.w3.org/1999/xhtml">unconfined_service_t</html:code> context.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To check for unconfined daemons, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo ps -eZ | grep "unconfined_service_t"</html:pre>
It should produce no output in a well-configured system.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automatic remediation of this control is not available. Remediation
can be achieved by amending SELinux policy or stopping the unconfined
daemons as outlined above.</warning>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Daemons which run with the <html:code xmlns:html="http://www.w3.org/1999/xhtml">unconfined_service_t</html:code> context may cause AVC denials,
or allow privileges that the daemon does not require.</rationale>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-selinux_confinement_of_daemons:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_not_disabled" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux is Not Disabled</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SELinux state should be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml">enforcing</html:code> or <html:code xmlns:html="http://www.w3.org/1999/xhtml">permissive</html:code> at system boot
time. In the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/config</html:code>, add or correct the following line to configure
the system to boot into enforcing or permissive mode:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">SELINUX=enforcing</html:pre>
OR
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">SELINUX=permissive</html:pre>
Ensure that all files have correct SELinux labels by running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fixfiles onboot</html:pre>
Then reboot the system.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">In case the SELinux is "disabled", the automated remediation will adopt a more
conservative approach and set it to "permissive" in order to avoid any system disruption
and give the administrator the opportunity to assess the impact and necessary efforts
before setting it to "enforcing", which is strongly recommended.</warning>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Running SELinux in disabled mode is strongly discouraged. It prevents enforcing the SELinux
controls without a system reboot. It also avoids labeling any persistent objects such as
files, making it difficult to enable SELinux in the future.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_not_disabled" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=permissive" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_not_disabled" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled - Check current SELinux state
  ansible.builtin.command:
    cmd: getenforce
  register: selinux_state
  check_mode: false
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      line: SELINUX=permissive
      state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled

- name: Ensure SELinux is Not Disabled - Mark system to relabel SELinux on next boot
  ansible.builtin.file:
    path: /.autorelabel
    state: touch
    access_time: preserve
    modification_time: preserve
  when:
  - '"kernel" in ansible_facts.packages'
  - selinux_state.stdout | lower != "permissive"
  tags:
  - high_severity
  - low_complexity
  - low_disruption
  - reboot_required
  - restrict_strategy
  - selinux_not_disabled
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-selinux_not_disabled:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_not_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SELinux Policy</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SELinux <html:code xmlns:html="http://www.w3.org/1999/xhtml">targeted</html:code> policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/config</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">SELINUXTYPE=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
       </html:pre>
Other policies, such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">mls</html:code>, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000233-CTR-000585</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R46</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R64</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">APP.4.4.A4</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A3</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A18</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.3</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the SELinux policy to <html:code xmlns:html="http://www.w3.org/1999/xhtml">targeted</html:code> or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Note: During the development or debugging of SELinux modules, it is common to
temporarily place non-production systems in <html:code xmlns:html="http://www.w3.org/1999/xhtml">permissive</html:code> mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
<html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/></html:code>.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_policytype" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_selinux_policy_name='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>'

if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUXTYPE=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUXTYPE=$var_selinux_policy_name" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_policytype" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - selinux_policytype
- name: XCCDF Value var_selinux_policy_name # promote to variable
  set_fact:
    var_selinux_policy_name: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" use="legacy"/>
  tags:
    - always

- name: Configure SELinux Policy
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUXTYPE=
      line: SELINUXTYPE={{ var_selinux_policy_name }}
      state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - selinux_policytype
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_selinux_policy_name:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_policy_name"/>
          <check-content-ref name="oval:ssg-selinux_policytype:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_policytype_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_selinux_state" selected="false" role="full" severity="high">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SELinux State is Enforcing</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SELinux state should be set to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/></html:code> at
system boot time.  In the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/selinux/config</html:code>, add or correct the
following line to configure the system to boot into enforcing mode:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">SELINUX=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
       </html:pre>
Ensure that all files have correct SELinux labels by running:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">fixfiles onboot</html:pre>
Then reboot the system.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.7.2</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.3.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3(3)(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-7(21)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.AM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000445-GPOS-00199</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000134-GPOS-00068</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R37</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R79</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">APP.4.4.A4</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A3</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A18</reference>
        <reference href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf">SYS.1.6.A21</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">1.6.1.5</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the SELinux state to enforcing ensures SELinux is able to confine
potentially compromised processes to the security policy, which is designed to
prevent them from causing damage to the system or further elevating their
privileges.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_state" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_selinux_state='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>'


if [ -e "/etc/selinux/config" ] ; then
    
    LC_ALL=C sed -i "/^SELINUX=/Id" "/etc/selinux/config"
else
    touch "/etc/selinux/config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/selinux/config"

cp "/etc/selinux/config" "/etc/selinux/config.bak"
# Insert at the end of the file
printf '%s\n' "SELINUX=$var_selinux_state" &gt;&gt; "/etc/selinux/config"
# Clean up after ourselves.
rm "/etc/selinux/config.bak"

fixfiles onboot

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="selinux_state" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state
- name: XCCDF Value var_selinux_state # promote to variable
  set_fact:
    var_selinux_state: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_selinux_state" use="legacy"/>
  tags:
    - always

- name: Ensure SELinux State is Enforcing - Check current SELinux state
  ansible.builtin.command:
    cmd: getenforce
  register: selinux_state
  check_mode: false
  changed_when: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state

- name: Ensure SELinux State is Enforcing
  block:

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    check_mode: true
    changed_when: false
    register: dupes

  - name: Deduplicate values from /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      state: absent
    when: dupes.found is defined and dupes.found &gt; 1

  - name: Insert correct line to /etc/selinux/config
    ansible.builtin.lineinfile:
      path: /etc/selinux/config
      create: true
      regexp: (?i)^SELINUX=
      line: SELINUX={{ var_selinux_state }}
      state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state

- name: Ensure SELinux State is Enforcing - Mark system to relabel SELinux on next
    boot
  ansible.builtin.file:
    path: /.autorelabel
    state: touch
    access_time: preserve
    modification_time: preserve
  when:
  - '"kernel" in ansible_facts.packages'
  - selinux_state.stdout | lower != var_selinux_state
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.7.2
  - NIST-800-53-AC-3
  - NIST-800-53-AC-3(3)(a)
  - NIST-800-53-AU-9
  - NIST-800-53-SC-7(21)
  - PCI-DSSv4-1.2
  - PCI-DSSv4-1.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - selinux_state
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_selinux_state:var:1" value-id="xccdf_org.ssgproject.content_value_var_selinux_state"/>
          <check-content-ref name="oval:ssg-selinux_state:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-selinux_state_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_services">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Services</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The best protection against vulnerable software is running less software. This section describes how to review
the software which Amazon Linux 2023 installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Amazon Linux 2023 system and provides guidance about which
ones can be safely disabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Amazon Linux 2023 provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Amazon Linux 2023 systems, it is highly recommended to select the minimal packages and then build up
the system from there.</description>
    <Group id="xccdf_org.ssgproject.content_group_avahi">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Avahi Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Avahi daemon implements the DNS Service Discovery
and Multicast DNS protocols, which provide service and host
discovery on a network. It allows a system to automatically
identify resources on the network, such as printers or web servers.
This capability is also known as mDNSresponder and is a major part
of Zeroconf networking.</description>
      <Group id="xccdf_org.ssgproject.content_group_disable_avahi_group">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Avahi Server if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Because the Avahi daemon service keeps an open network
port, it is subject to network attacks.
Disabling it can reduce the system's vulnerability to such attacks.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_avahi_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall avahi Server Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to have an Avahi server which implements
the DNS Service Discovery and Multicast DNS protocols,
the avahi-autoipd and avahi packages can be uninstalled.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Automatic discovery of network services is not normally required for
system functionality. It is recommended to remove this package to reduce
the potential attack surface.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_avahi_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_avahi

class remove_avahi {
  package { 'avahi':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_avahi_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove avahi
# from the system, and may remove any packages
# that depend on avahi. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "avahi" ; then
dnf remove -y --noautoremove "avahi"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_avahi_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=avahi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_avahi_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall avahi Server Package: Ensure avahi is removed'
  ansible.builtin.package:
    name: avahi
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_avahi_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_avahi_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_avahi_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_cron_and_at">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Cron and At Daemons</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</description>
      <platform idref="#system_with_kernel"/>
      <Rule id="xccdf_org.ssgproject.content_rule_service_crond_enabled" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable cron Service</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">crond</html:code> service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">crond</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable crond.service</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_crond

class enable_crond {
  service {'crond':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'crond.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'crond.service'
fi
"$SYSTEMCTL_EXEC" enable 'crond.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
enabled = ["crond"]
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_crond_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_crond_enabled

- name: Enable cron Service - Enable service crond
  block:

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto

  - name: Enable cron Service - Enable Service crond
    ansible.builtin.systemd:
      name: crond
      enabled: true
      state: started
      masked: false
    when:
    - '"cronie" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_crond_enabled
  - special_service_block
  when: '"kernel" in ansible_facts.packages'
</fix>
        <check system="http://open-scap.org/page/SCE">
          <check-import import-name="stdout">
              </check-import>
          <check-content-ref href="al2023/checks/sce/service_crond_enabled.sh"/>
        </check>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-service_crond_enabled:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-service_crond_enabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns cron.d</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.d</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.d</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.7</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_d" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/cron.d/ -maxdepth 0 -type d  ! -group 0 -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_d" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_d_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_d_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.d/
  ansible.builtin.file:
    path: /etc/cron.d/
    follow: false
    state: directory
    group: '{{ file_groupowner_cron_d_newgroup }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_cron_d:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_cron_d_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns cron.daily</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.daily</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.daily</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_daily" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/cron.daily/ -maxdepth 0 -type d  ! -group 0 -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_daily" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_daily_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_daily_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.daily/
  ansible.builtin.file:
    path: /etc/cron.daily/
    follow: false
    state: directory
    group: '{{ file_groupowner_cron_daily_newgroup }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_cron_daily:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_cron_daily_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns cron.hourly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.hourly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.hourly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_hourly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/cron.hourly/ -maxdepth 0 -type d  ! -group 0 -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_hourly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_hourly_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_hourly_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.hourly/
  ansible.builtin.file:
    path: /etc/cron.hourly/
    follow: false
    state: directory
    group: '{{ file_groupowner_cron_hourly_newgroup }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_cron_hourly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_cron_hourly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns cron.monthly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.monthly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.monthly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_monthly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/cron.monthly/ -maxdepth 0 -type d  ! -group 0 -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_monthly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_monthly_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_monthly_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.monthly/
  ansible.builtin.file:
    path: /etc/cron.monthly/
    follow: false
    state: directory
    group: '{{ file_groupowner_cron_monthly_newgroup }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_cron_monthly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_cron_monthly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns cron.weekly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.weekly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.weekly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_weekly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/cron.weekly/ -maxdepth 0 -type d  ! -group 0 -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_weekly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_weekly_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_weekly_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.weekly/
  ansible.builtin.file:
    path: /etc/cron.weekly/
    follow: false
    state: directory
    group: '{{ file_groupowner_cron_weekly_newgroup }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_cron_weekly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_cron_weekly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns Crontab</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/crontab</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_crontab" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/crontab" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/crontab
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_crontab" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_crontab_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_crontab_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  ansible.builtin.stat:
    path: /etc/crontab
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/crontab
  ansible.builtin.file:
    path: /etc/crontab
    follow: false
    group: '{{ file_groupowner_crontab_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_crontab:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_crontab_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_d" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on cron.d</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.d</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.d </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.7</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_d" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
find -P /etc/cron.d/ -maxdepth 0 -type d  ! -user 0 -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_d" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_d_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_d_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.d/
  ansible.builtin.file:
    path: /etc/cron.d/
    follow: false
    state: directory
    owner: '{{ file_owner_cron_d_newown }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_cron_d:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_cron_d_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on cron.daily</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.daily</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.daily </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_daily" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
find -P /etc/cron.daily/ -maxdepth 0 -type d  ! -user 0 -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_daily" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_daily_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_daily_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.daily/
  ansible.builtin.file:
    path: /etc/cron.daily/
    follow: false
    state: directory
    owner: '{{ file_owner_cron_daily_newown }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_cron_daily:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_cron_daily_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on cron.hourly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.hourly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.hourly </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_hourly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
find -P /etc/cron.hourly/ -maxdepth 0 -type d  ! -user 0 -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_hourly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_hourly_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_hourly_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.hourly/
  ansible.builtin.file:
    path: /etc/cron.hourly/
    follow: false
    state: directory
    owner: '{{ file_owner_cron_hourly_newown }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_cron_hourly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_cron_hourly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on cron.monthly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.monthly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.monthly </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_monthly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
find -P /etc/cron.monthly/ -maxdepth 0 -type d  ! -user 0 -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_monthly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_monthly_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_monthly_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.monthly/
  ansible.builtin.file:
    path: /etc/cron.monthly/
    follow: false
    state: directory
    owner: '{{ file_owner_cron_monthly_newown }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_cron_monthly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_cron_monthly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on cron.weekly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.weekly</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.weekly </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_weekly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
find -P /etc/cron.weekly/ -maxdepth 0 -type d  ! -user 0 -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_weekly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_weekly_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_weekly_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on directory /etc/cron.weekly/
  ansible.builtin.file:
    path: /etc/cron.weekly/
    follow: false
    state: directory
    owner: '{{ file_owner_cron_weekly_newown }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_cron_weekly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_cron_weekly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_crontab" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on crontab</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/crontab </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_crontab" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/crontab" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/crontab
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_crontab" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_crontab_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_crontab_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  ansible.builtin.stat:
    path: /etc/crontab
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/crontab
  ansible.builtin.file:
    path: /etc/crontab
    follow: false
    owner: '{{ file_owner_crontab_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_crontab:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_crontab_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on cron.d</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.d</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /etc/cron.d</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.7</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_d" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/cron.d/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_d" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.d/ file(s)
  ansible.builtin.command: 'find -P /etc/cron.d/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.d/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_d
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_cron_d:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_cron_d_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on cron.daily</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.daily</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /etc/cron.daily</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_daily" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/cron.daily/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_daily" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.daily/ file(s)
  ansible.builtin.command: 'find -P /etc/cron.daily/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.daily/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_daily
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_cron_daily:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_cron_daily_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on cron.hourly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.hourly</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /etc/cron.hourly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_hourly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/cron.hourly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_hourly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.hourly/ file(s)
  ansible.builtin.command: 'find -P /etc/cron.hourly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.hourly/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_hourly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_cron_hourly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_cron_hourly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on cron.monthly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.monthly</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /etc/cron.monthly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_monthly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/cron.monthly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_monthly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.monthly/ file(s)
  ansible.builtin.command: 'find -P /etc/cron.monthly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.monthly/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_monthly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_cron_monthly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_cron_monthly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on cron.weekly</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.weekly</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /etc/cron.weekly</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_weekly" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -H /etc/cron.weekly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt -type d -exec chmod u-s,g-xwrs,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_weekly" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/cron.weekly/ file(s)
  ansible.builtin.command: 'find -P /etc/cron.weekly/ -maxdepth 0 -perm /u+s,g+xwrs,o+xwrt  -type
    d '
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/cron.weekly/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-s,g-xwrs,o-xwrt
    state: directory
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_weekly
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_cron_weekly:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_cron_weekly_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_crontab" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on crontab</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/crontab</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 /etc/crontab</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should have the
correct access rights to prevent unauthorized changes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_crontab" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

chmod u-xs,g-xwrs,o-xwrt /etc/crontab

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_crontab" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/crontab
  ansible.builtin.stat:
    path: /etc/crontab
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/crontab
  ansible.builtin.file:
    path: /etc/crontab
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_crontab
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_crontab:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_crontab_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_restrict_at_cron_users">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Restrict at and cron to Authorized Users if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> files contain lists of
users who are allowed to use <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> and at to delay execution of
processes. If these files exist and if the corresponding files
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.deny</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.deny</html:code> do not exist, then only users
listed in the relevant allow files can run the crontab and <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> commands
to submit jobs to be run at scheduled intervals. On many systems, only the
system administrator needs the ability to schedule jobs. Note that even if a
given user is not listed in <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron.allow</html:code>, cron jobs can still be run as
that user. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron.allow</html:code> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To restrict <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> to only authorized users:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Remove the <html:code>cron.deny</html:code> file:<html:pre>$ sudo rm /etc/cron.deny</html:pre>
        </html:li><html:li>Edit <html:code>/etc/cron.allow</html:code>, adding one line for each user allowed to use
the crontab command to create cron jobs.</html:li><html:li>Remove the <html:code>at.deny</html:code> file:<html:pre>$ sudo rm /etc/at.deny</html:pre>
        </html:li><html:li>Edit <html:code>/etc/at.allow</html:code>, adding one line for each user allowed to use
the at command to create at jobs.</html:li></html:ul>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that /etc/at.deny does not exist</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.deny</html:code> should not exist.
Use <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> instead.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Access to <html:code xmlns:html="http://www.w3.org/1999/xhtml">at</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_at_deny_not_exist" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [[ -f  /etc/at.deny ]]; then
        rm /etc/at.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_at_deny_not_exist" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_at_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure that /etc/at.deny does not exist - Remove /etc/at.deny
  ansible.builtin.file:
    path: /etc/at.deny
    state: absent
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_at_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_at_deny_not_exist:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_at_deny_not_exist_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_cron_allow_exists" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that /etc/cron.allow exists</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> should exist and should be used instead
of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.deny</html:code>.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Access to <html:code xmlns:html="http://www.w3.org/1999/xhtml">crontab</html:code> should be restricted.
It is easier to manage an allow list than a deny list.
Therefore, <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> needs to be created and used instead of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.deny</html:code>.
Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_cron_allow_exists" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

touch /etc/cron.allow
    chown 0 /etc/cron.allow
    chmod 0600 /etc/cron.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_cron_allow_exists" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - file_cron_allow_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure that /etc/cron.allow exists - Add empty /etc/cron.allow
  ansible.builtin.file:
    path: /etc/cron.allow
    state: touch
    owner: '0'
    mode: '0600'
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - disable_strategy
  - file_cron_allow_exists
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_cron_allow_exists:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_cron_allow_exists_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that /etc/cron.deny does not exist</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.deny</html:code> should not exist.
Use <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> instead.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Access to <html:code xmlns:html="http://www.w3.org/1999/xhtml">cron</html:code> should be restricted.
It is easier to manage an allow list than a deny list.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_cron_deny_not_exist" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if [[ -f  /etc/cron.deny ]]; then
        rm /etc/cron.deny
    fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_cron_deny_not_exist" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_cron_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure that /etc/cron.deny does not exist - Remove /etc/cron.deny
  ansible.builtin.file:
    path: /etc/cron.deny
    state: absent
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - disable_strategy
  - file_cron_deny_not_exist
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_cron_deny_not_exist:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_cron_deny_not_exist_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_at_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns /etc/at.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> exists, it must be group-owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/at.allow</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_at_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/at.allow" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/at.allow
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_at_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_at_allow_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_at_allow_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/at.allow
  ansible.builtin.stat:
    path: /etc/at.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/at.allow
  ansible.builtin.file:
    path: /etc/at.allow
    follow: false
    group: '{{ file_groupowner_at_allow_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_at_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_at_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns /etc/cron.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> exists, it must be group-owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/cron.allow</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/cron.allow" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/cron.allow
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_cron_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_cron_allow_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_cron_allow_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  ansible.builtin.stat:
    path: /etc/cron.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/cron.allow
  ansible.builtin.file:
    path: /etc/cron.allow
    follow: false
    group: '{{ file_groupowner_cron_allow_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_groupowner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_groupowner_cron_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_groupowner_cron_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_at_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns /etc/at.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> exists, it must be owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/at.allow </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_at_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/at.allow" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/at.allow
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_at_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_at_allow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_at_allow_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/at.allow
  ansible.builtin.stat:
    path: /etc/at.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/at.allow
  ansible.builtin.file:
    path: /etc/at.allow
    follow: false
    owner: '{{ file_owner_at_allow_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_at_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_at_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify User Who Owns /etc/cron.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> exists, it must be owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/cron.allow </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/cron.allow" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/cron.allow
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_cron_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_cron_allow_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_cron_allow_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  ansible.builtin.stat:
    path: /etc/cron.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/cron.allow
  ansible.builtin.file:
    path: /etc/cron.allow
    follow: false
    owner: '{{ file_owner_cron_allow_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_owner_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_owner_cron_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_owner_cron_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_at_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on /etc/at.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code> exists, it must have permissions <html:code xmlns:html="http://www.w3.org/1999/xhtml">0640</html:code>
or more restrictive.


To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/at.allow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 /etc/at.allow</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the permissions of the at.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_at_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

chmod u-xs,g-xws,o-xwrt /etc/at.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_at_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/at.allow
  ansible.builtin.stat:
    path: /etc/at.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/at.allow
  ansible.builtin.file:
    path: /etc/at.allow
    mode: u-xs,g-xws,o-xwrt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_at_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_at_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_at_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_cron_allow" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on /etc/cron.allow file</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code> exists, it must have permissions <html:code xmlns:html="http://www.w3.org/1999/xhtml">0640</html:code>
or more restrictive.


To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/cron.allow</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 /etc/cron.allow</html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.1.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the permissions of the cron.allow file are not set to 0640 or more restrictive,
the possibility exists for an unauthorized user to view or edit sensitive information.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_allow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

chmod u-xs,g-xws,o-xwrt /etc/cron.allow

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_cron_allow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/cron.allow
  ansible.builtin.stat:
    path: /etc/cron.allow
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /etc/cron.allow
  ansible.builtin.file:
    path: /etc/cron.allow
    mode: u-xs,g-xws,o-xwrt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_cron_allow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-file_permissions_cron_allow:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_dhcp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DHCP</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
This guide recommends configuring networking on clients by manually editing
the appropriate files under <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig</html:code>.  Use of DHCP can make client 
systems vulnerable to compromise by rogue DHCP servers, and should be avoided 
unless necessary.  If using DHCP is necessary, however, there are best practices 
that should be followed to minimize security risk.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DHCP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The DHCP server <html:code xmlns:html="http://www.w3.org/1999/xhtml">dhcpd</html:code> is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_dhcp_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall DHCP Server Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to act as a DHCP server,
the dhcp package can be uninstalled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dhcp</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove dhcp</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing the DHCP server ensures that it cannot be easily or
accidentally reactivated and disrupt network operation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dhcp_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_dhcp

class remove_dhcp {
  package { 'dhcp':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dhcp_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove dhcp
# from the system, and may remove any packages
# that depend on dhcp. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "dhcp" ; then
dnf remove -y --noautoremove "dhcp"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dhcp_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=dhcp
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dhcp_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall DHCP Server Package: Ensure dhcp is removed'
  ansible.builtin.package:
    name: dhcp
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_dhcp_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_dhcp_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_dhcp_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_dns">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DNS Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Most organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_dnsmasq_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall dnsmasq Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and
DHCP (Dynamic Host Configuration Protocol) services.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dnsmasq</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove dnsmasq</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.14</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless a system is specifically designated to act as a DNS
caching, DNS forwarding and/or DHCP server, it is recommended that the
package be removed to reduce the potential attack surface.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnsmasq_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_dnsmasq

class remove_dnsmasq {
  package { 'dnsmasq':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnsmasq_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove dnsmasq
# from the system, and may remove any packages
# that depend on dnsmasq. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "dnsmasq" ; then
dnf remove -y --noautoremove "dnsmasq"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnsmasq_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=dnsmasq
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dnsmasq_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall dnsmasq Package: Ensure dnsmasq is removed'
  ansible.builtin.package:
    name: dnsmasq
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_dnsmasq_removed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_dnsmasq_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_dnsmasq_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dns_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable DNS Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">DNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Amazon Linux 2023 by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_bind_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall bind Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">named</html:code> service is provided by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">bind</html:code> package.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">bind</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove bind</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.5</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make DNS server software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_bind

class remove_bind {
  package { 'bind':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove bind
# from the system, and may remove any packages
# that depend on bind. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "bind" ; then
dnf remove -y --noautoremove "bind"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=bind
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_bind_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall bind Package: Ensure bind is removed'
  ansible.builtin.package:
    name: bind
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_bind_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_bind_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_bind_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ftp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_ftp_removed" selected="false" role="full" severity="low">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove ftp Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP (File Transfer Protocol) is a traditional and widely used standard tool for
transferring files between a server and clients over a network, especially where no
authentication is necessary (permits anonymous users to connect to a server).
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ftp</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove ftp</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.3.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">FTP does not protect the confidentiality of data or authentication credentials. It
is recommended SFTP be used if file transfer is required. Unless there is a need
to run the system as a FTP server (for example, to allow anonymous downloads), it is
recommended that the package be removed to reduce the potential attack surface.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ftp_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_ftp

class remove_ftp {
  package { 'ftp':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ftp_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove ftp
# from the system, and may remove any packages
# that depend on ftp. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "ftp" ; then
dnf remove -y --noautoremove "ftp"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ftp_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=ftp
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_ftp_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Remove ftp Package: Ensure ftp is removed'
  ansible.builtin.package:
    name: ftp
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_ftp_removed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_ftp_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_ftp_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_disabling_vsftpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable vsftpd if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To minimize attack surface, disable vsftpd if at all
possible.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall vsftpd Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package can be removed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf remove vsftpd</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1).1(v)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7.1(ii)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000074-GPOS-00042</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">vsftpd</html:code> package decreases the risk of its
accidental activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_vsftpd

class remove_vsftpd {
  package { 'vsftpd':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove vsftpd
# from the system, and may remove any packages
# that depend on vsftpd. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "vsftpd" ; then
dnf remove -y --noautoremove "vsftpd"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=vsftpd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_vsftpd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall vsftpd Package: Ensure vsftpd is removed'
  ansible.builtin.package:
    name: vsftpd
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-CM-7.1(ii)
  - NIST-800-53-IA-5(1)(c)
  - NIST-800-53-IA-5(1).1(v)
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_vsftpd_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_vsftpd_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_http">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Web Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>The HTTP port is commonly probed by malicious sources</html:li><html:li>Web server software is very complex, and includes a long
history of vulnerabilities</html:li><html:li>The HTTP protocol is unencrypted and vulnerable to passive
monitoring</html:li></html:ul>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The system's default web server software is Apache 2 and is
provided in the RPM package <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code>.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_httpd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Apache if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_httpd_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall httpd Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">httpd</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove httpd</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the web server software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_httpd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_httpd

class remove_httpd {
  package { 'httpd':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_httpd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove httpd
# from the system, and may remove any packages
# that depend on httpd. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "httpd" ; then
dnf remove -y --noautoremove "httpd"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_httpd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=httpd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_httpd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall httpd Package: Ensure httpd is removed'
  ansible.builtin.package:
    name: httpd
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_httpd_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_httpd_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_httpd_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_nginx">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable NGINX if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If NGINX was installed and activated, but the system does not need to act as a web server,
then it should be removed from the system.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_nginx_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall nginx Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nginx</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove nginx</html:pre>
       </description>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.8</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the web server software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nginx_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_nginx

class remove_nginx {
  package { 'nginx':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nginx_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove nginx
# from the system, and may remove any packages
# that depend on nginx. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "nginx" ; then
dnf remove -y --noautoremove "nginx"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nginx_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=nginx
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_nginx_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall nginx Package: Ensure nginx is removed'
  ansible.builtin.package:
    name: nginx
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_nginx_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_nginx_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_nginx_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_imap">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">IMAP and POP3 Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.dovecot.org">http://www.dovecot.org</html:a>
contains more detailed information about Dovecot
configuration.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_cyrus-imapd">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Cyrus IMAP</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to operate as an IMAP or
POP3 server, the Cyrus IMAP software should be removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall cyrus-imapd Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cyrus-imapd</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove cyrus-imapd</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the cyrus-imapd software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cyrus-imapd_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_cyrus-imapd

class remove_cyrus-imapd {
  package { 'cyrus-imapd':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cyrus-imapd_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove cyrus-imapd
# from the system, and may remove any packages
# that depend on cyrus-imapd. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "cyrus-imapd" ; then
dnf remove -y --noautoremove "cyrus-imapd"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cyrus-imapd_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=cyrus-imapd
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cyrus-imapd_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall cyrus-imapd Package: Ensure cyrus-imapd is removed'
  ansible.builtin.package:
    name: cyrus-imapd
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_cyrus-imapd_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_cyrus-imapd_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_cyrus-imapd_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_disabling_dovecot">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Dovecot</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_dovecot_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall dovecot Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">dovecot</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove dovecot</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.9</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dovecot_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_dovecot

class remove_dovecot {
  package { 'dovecot':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dovecot_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove dovecot
# from the system, and may remove any packages
# that depend on dovecot. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "dovecot" ; then
dnf remove -y --noautoremove "dovecot"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dovecot_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=dovecot
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_dovecot_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall dovecot Package: Ensure dovecot is removed'
  ansible.builtin.package:
    name: dovecot
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_dovecot_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_dovecot_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_dovecot_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ldap">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">LDAP</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Amazon Linux 2023 includes software that enables a system to act as both
an LDAP client and server.</description>
      <Group id="xccdf_org.ssgproject.content_group_openldap_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenLDAP Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files.  Amazon Linux 2023 provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
<html:code xmlns:html="http://www.w3.org/1999/xhtml">system-config-authentication</html:code>. However, these tools do not provide as
much control over configuration as manual editing of configuration files. The
authconfig tools do not allow you to specify locations of SSL certificate
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on Amazon Linux 2023 is available at</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</warning>
        <Rule id="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure LDAP client is not installed</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Lightweight Directory Access Protocol (LDAP) is a service that provides
a method for looking up information from a central database.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">openldap-clients</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove openldap-clients</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.3.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_openldap-clients

class remove_openldap-clients {
  package { 'openldap-clients':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove openldap-clients
# from the system, and may remove any packages
# that depend on openldap-clients. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "openldap-clients" ; then
dnf remove -y --noautoremove "openldap-clients"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=openldap-clients
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_openldap-clients_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Ensure LDAP client is not installed: Ensure openldap-clients is removed'
  ansible.builtin.package:
    name: openldap-clients
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_openldap-clients_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_openldap-clients_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_openldap-clients_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_mail">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mail Server Software</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">alternatives</html:code> program in Amazon Linux 2023 permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.postfix.org">http://www.postfix.org</html:a>.</description>
      <platform idref="#system_with_kernel"/>
      <Rule id="xccdf_org.ssgproject.content_rule_has_nonlocal_mta" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure Mail Transfer Agent is not Listening on any non-loopback Address</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to
listen for incoming mail and transfer the messages to the appropriate
user or mail server. If the system is not intended to be a mail server,
it is recommended that the MTA be configured to only process local mail.</description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.15</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The software for all Mail Transfer Agents is complex and most have a
long history of security issues. While it is important to ensure that
the system can process local mail messages, it is not necessary to have
the MTA's daemon listening on a port unless the server is intended to
be a mail server that receives and processes mail from other systems.</rationale>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-has_nonlocal_mta:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-has_nonlocal_mta_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_postfix_client">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure SMTP For Mail Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses settings for Postfix in a submission-only
e-mail configuration.</description>
        <Value id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" type="string">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Postfix Network Interfaces</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for inet_interfaces in /etc/postfix/main.cf</description>
          <value selector="loopback-only">loopback-only</value>
          <value>loopback-only</value>
          <value selector="localhost">localhost</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Postfix Network Listening</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/postfix/main.cf</html:code> to ensure that only the following
<html:code xmlns:html="http://www.w3.org/1999/xhtml">inet_interfaces</html:code> line appears:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">inet_interfaces = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R74</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.15</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4.2</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">1.4</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This ensures <html:code xmlns:html="http://www.w3.org/1999/xhtml">postfix</html:code> accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack.</rationale>
          <platform idref="#package_postfix"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="postfix_network_listening_disabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q postfix; }; then

var_postfix_inet_interfaces='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>'


if [ -e "/etc/postfix/main.cf" ] ; then
    
    LC_ALL=C sed -i "/^\s*inet_interfaces\s\+=\s\+/Id" "/etc/postfix/main.cf"
else
    touch "/etc/postfix/main.cf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/postfix/main.cf"

cp "/etc/postfix/main.cf" "/etc/postfix/main.cf.bak"
# Insert at the end of the file
printf '%s\n' "inet_interfaces=$var_postfix_inet_interfaces" &gt;&gt; "/etc/postfix/main.cf"
# Clean up after ourselves.
rm "/etc/postfix/main.cf.bak"

systemctl restart postfix

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="postfix_network_listening_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_network_listening_disabled
  - restrict_strategy
- name: XCCDF Value var_postfix_inet_interfaces # promote to variable
  set_fact:
    var_postfix_inet_interfaces: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" use="legacy"/>
  tags:
    - always

- name: Gather list of packages
  ansible.builtin.package_facts:
    manager: auto
  when:
  - '"kernel" in ansible_facts.packages'
  - '"postfix" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_network_listening_disabled
  - restrict_strategy

- name: Make changes to Postfix configuration file
  ansible.builtin.lineinfile:
    path: /etc/postfix/main.cf
    create: false
    regexp: (?i)^inet_interfaces\s*=\s.*
    line: inet_interfaces = {{ var_postfix_inet_interfaces }}
    state: present
    insertafter: ^inet_interfaces\s*=\s.*
  when:
  - '"kernel" in ansible_facts.packages'
  - '"postfix" in ansible_facts.packages'
  - '"postfix" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-1.4
  - PCI-DSSv4-1.4.2
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - postfix_network_listening_disabled
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_postfix_inet_interfaces:var:1" value-id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces"/>
            <check-content-ref name="oval:ssg-postfix_network_listening_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-postfix_network_listening_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_nfs_and_rpc">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">NFS and RPC</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network File System is a popular distributed filesystem for
the Unix environment, and is very widely deployed.  This section discusses the
circumstances under which it is possible to disable NFS and its dependencies,
and then details steps which should be taken to secure
NFS's configuration. This section is relevant to systems operating as NFS
clients, as well as to those operating as NFS servers.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_nfs">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable All NFS Services if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is not a reason for the system to operate as either an
NFS client or an NFS server, follow all instructions in this section to disable
subsystems required by NFS.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">The steps in this section will prevent a system
from operating as either an NFS client or an NFS server. Only perform these
steps on systems which do not need NFS at all.</warning>
        <platform idref="#system_with_kernel"/>
        <Group id="xccdf_org.ssgproject.content_group_disabling_nfs_services">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Services Used Only by NFS</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
All of these daemons run with elevated privileges, and many listen for network
connections. If they are not needed, they should be disabled to improve system
security posture.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_rpcbind_disabled" selected="false" role="full" severity="low">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable rpcbind Service</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rpcbind utility maps RPC services to the ports on which they listen.
RPC processes notify rpcbind when they start, registering the ports they
are listening on and the RPC program numbers they expect to serve. The
rpcbind service redirects the client to the proper port number so it can
communicate with the requested service. If the system does not require RPC
(such as for NFS servers) then this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcbind</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now rpcbind.service</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.17</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
            <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not require rpc based services, it is recommended that
rpcbind be disabled to reduce the attack surface.</rationale>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcbind_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_rpcbind

class disable_rpcbind {
  service {'rpcbind':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcbind_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'rpcbind.service'
fi
"$SYSTEMCTL_EXEC" disable 'rpcbind.service'
"$SYSTEMCTL_EXEC" mask 'rpcbind.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files rpcbind.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'rpcbind.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'rpcbind.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'rpcbind.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcbind_disabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
masked = ["rpcbind"]
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_rpcbind_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_rpcbind_disabled

- name: Disable rpcbind Service - Disable service rpcbind
  block:

  - name: Disable rpcbind Service - Collect systemd Services Present in the System
    ansible.builtin.command: systemctl -q list-unit-files --type service
    register: service_exists
    changed_when: false
    failed_when: service_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable rpcbind Service - Ensure rpcbind.service is Masked
    ansible.builtin.systemd:
      name: rpcbind.service
      state: stopped
      enabled: false
      masked: true
    when: service_exists.stdout_lines is search("rpcbind.service", multiline=True)

  - name: Unit Socket Exists - rpcbind.socket
    ansible.builtin.command: systemctl -q list-unit-files rpcbind.socket
    register: socket_file_exists
    changed_when: false
    failed_when: socket_file_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable rpcbind Service - Disable Socket rpcbind
    ansible.builtin.systemd:
      name: rpcbind.socket
      enabled: false
      state: stopped
      masked: true
    when: socket_file_exists.stdout_lines is search("rpcbind.socket", multiline=True)
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_rpcbind_disabled
  - special_service_block
  when: '"kernel" in ansible_facts.packages'
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/service_rpcbind_disabled.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_rpcbind_disabled:def:1" href="ssg-al2023-oval.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_nfs_configuring_clients">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure NFS Clients</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The steps in this section are appropriate for systems which operate as NFS clients.</description>
        <Group id="xccdf_org.ssgproject.content_group_disabling_nfsd">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable NFS Server Daemons</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">There is no need to run the NFS server daemons <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">rpcsvcgssd</html:code> except on a small number of properly secured systems
designated as NFS servers. Ensure that these daemons are turned off on
clients.</description>
          <Rule id="xccdf_org.ssgproject.content_rule_service_nfs_disabled" selected="false" role="full" severity="unknown">
            <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Network File System (nfs)</title>
            <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">nfs-server</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now nfs-server.service</html:pre>
        </description>
            <reference href="https://www.cisecurity.org/controls/">11</reference>
            <reference href="https://www.cisecurity.org/controls/">12</reference>
            <reference href="https://www.cisecurity.org/controls/">14</reference>
            <reference href="https://www.cisecurity.org/controls/">15</reference>
            <reference href="https://www.cisecurity.org/controls/">16</reference>
            <reference href="https://www.cisecurity.org/controls/">18</reference>
            <reference href="https://www.cisecurity.org/controls/">3</reference>
            <reference href="https://www.cisecurity.org/controls/">5</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
            <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
            <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
            <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
            <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
            <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
            <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
            <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.16</reference>
            <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary services should be disabled to decrease the attack surface of the system.</rationale>
            <platform idref="#system_with_kernel"/>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_nfs-server

class disable_nfs-server {
  service {'nfs-server':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'nfs-server.service'
fi
"$SYSTEMCTL_EXEC" disable 'nfs-server.service'
"$SYSTEMCTL_EXEC" mask 'nfs-server.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files nfs-server.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'nfs-server.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'nfs-server.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'nfs-server.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
masked = ["nfs-server"]
</fix>
            <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_nfs_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_nfs_disabled
  - unknown_severity

- name: Disable Network File System (nfs) - Disable service nfs-server
  block:

  - name: Disable Network File System (nfs) - Collect systemd Services Present in
      the System
    ansible.builtin.command: systemctl -q list-unit-files --type service
    register: service_exists
    changed_when: false
    failed_when: service_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable Network File System (nfs) - Ensure nfs-server.service is Masked
    ansible.builtin.systemd:
      name: nfs-server.service
      state: stopped
      enabled: false
      masked: true
    when: service_exists.stdout_lines is search("nfs-server.service", multiline=True)

  - name: Unit Socket Exists - nfs-server.socket
    ansible.builtin.command: systemctl -q list-unit-files nfs-server.socket
    register: socket_file_exists
    changed_when: false
    failed_when: socket_file_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable Network File System (nfs) - Disable Socket nfs-server
    ansible.builtin.systemd:
      name: nfs-server.socket
      enabled: false
      state: stopped
      masked: true
    when: socket_file_exists.stdout_lines is search("nfs-server.socket", multiline=True)
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_nfs_disabled
  - special_service_block
  - unknown_severity
  when: '"kernel" in ansible_facts.packages'
</fix>
            <check system="http://open-scap.org/page/SCE">
              <check-import import-name="stdout">
                  </check-import>
              <check-content-ref href="al2023/checks/sce/service_nfs_disabled.sh"/>
            </check>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-service_nfs_disabled:def:1" href="ssg-al2023-oval.xml"/>
            </check>
            <check system="http://scap.nist.gov/schema/ocil/2">
              <check-content-ref name="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
            </check>
          </Rule>
        </Group>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ntp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Network Time Protocol</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
There is a choice between the daemons <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code>, which
are available from the repositories in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntp</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code>
packages respectively.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> daemon can work well when external time references
are only intermittently accessible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. <html:code xmlns:html="http://www.w3.org/1999/xhtml">Chronyd</html:code> should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (<html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">Autokey</html:code> protocol, should consider using <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Refer to

    
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html">https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html</html:a>

for more detailed comparison of features of <html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code>
and <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The upstream manual pages at 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://chrony-project.org/documentation.html">https://chrony-project.org/documentation.html</html:a> for
<html:code xmlns:html="http://www.w3.org/1999/xhtml">chronyd</html:code> and 
    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.ntp.org">http://www.ntp.org</html:a> for <html:code xmlns:html="http://www.w3.org/1999/xhtml">ntpd</html:code> provide additional
information on the capabilities and configuration of each of the NTP daemons.</description>
      <platform idref="#system_with_kernel"/>
      <Value id="xccdf_org.ssgproject.content_value_var_multiple_time_servers" type="string" interactive="true">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Vendor Approved Time Servers</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The list of vendor-approved time servers</description>
        <value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</value>
        <value selector="generic">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</value>
        <value selector="stig">0.us.pool.ntp.mil</value>
        <value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</value>
        <value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</value>
        <value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</value>
        <value selector="suse">0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org</value>
        <value selector="alinux">0.ntp.cloud.aliyuncs.com,1.ntp.aliyun.com,2.ntp1.aliyun.com,3.ntp1.cloud.aliyuncs.com</value>
        <value selector="amazon">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</value>
        <value selector="ubuntu">0.ubuntu.pool.ntp.org,1.ubuntu.pool.ntp.org,2.ubuntu.pool.ntp.org,3.ubuntu.pool.ntp.org</value>
        <value selector="almalinux">0.almalinux.pool.ntp.org,1.almalinux.pool.ntp.org,2.almalinux.pool.ntp.org,3.almalinux.pool.ntp.org</value>
        <value selector="debian">0.debian.pool.ntp.org,1.debian.pool.ntp.org,2.debian.pool.ntp.org,3.debian.pool.ntp.org</value>
        <value selector="nist">time.nist.gov,time-a-g.nist.gov,time-b-g.nist.gov,time-c-g.nist.gov</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A remote time server for Chrony is configured</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"><html:code xmlns:html="http://www.w3.org/1999/xhtml">Chrony</html:code> is a daemon which implements the Network Time Protocol (NTP). It is designed
to synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code> can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
<html:code xmlns:html="http://www.w3.org/1999/xhtml">Chrony</html:code> can be configured to be a client and/or a server.
Add or edit server or pool lines to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/chrony.conf</html:code> as appropriate:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">server &lt;remote-server&gt;</html:pre>
Multiple servers may be configured.</description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.3</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000355-GPOS-00143</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R71</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.1.2</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0988</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1405</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If <html:code xmlns:html="http://www.w3.org/1999/xhtml">chrony</html:code> is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.</rationale>
        <platform idref="#package_chrony"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_specify_remote_server" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q chrony; }; then

var_multiple_time_servers='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>'


config_file="/etc/chrony.conf"

if ! grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
  if [[ -s "$config_file" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$config_file" || true)" ]]; then
      LC_ALL=C sed -i --follow-symlinks '$a'\\ "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_specify_remote_server" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony is already configured with pools or servers
  ansible.builtin.find:
    path: /etc
    patterns: chrony.conf
    contains: ^[\s]*(?:server|pool)[\s]+[\w]+
  register: chrony_servers
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure remote time servers
  ansible.builtin.lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  - chrony_servers.matched == 0
  tags:
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.3
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.2
  - chronyd_specify_remote_server
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_specify_remote_server:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that chronyd is running under chrony user account</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://chrony-project.org/">https://chrony-project.org/</html:a>.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account,
add or edit the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS</html:code> variable in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/sysconfig/chronyd</html:code> to include <html:code xmlns:html="http://www.w3.org/1999/xhtml">-u chrony</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">OPTIONS="-u chrony"</html:pre>

This recommendation only applies if chrony is in use on the system.</description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.1.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly.</rationale>
        <platform idref="#package_chrony"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_run_as_chrony_user" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q chrony; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s*\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u chrony\2/' /etc/sysconfig/chronyd
else
	echo 'OPTIONS="-u chrony"' &gt;&gt; /etc/sysconfig/chronyd
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="chronyd_run_as_chrony_user" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Detect if file /etc/sysconfig/chronyd is not empty or missing
  ansible.builtin.find:
    path: /etc/sysconfig/
    patterns: chronyd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: chronyd_file
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Remove any previous configuration of user used to run chronyd process
  ansible.builtin.replace:
    path: /etc/sysconfig/chronyd
    regexp: \s*-u\s*\w+\s*
    replace: ' '
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Correct existing line in /etc/sysconfig/chronyd to run chronyd as chrony user
  ansible.builtin.lineinfile:
    path: /etc/sysconfig/chronyd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u chrony\2
    state: present
    backrefs: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  - chronyd_file is defined and chronyd_file.matched &gt; 0
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Insert correct line into /etc/sysconfig/chronyd ensuring chronyd runs as chrony
    user
  ansible.builtin.lineinfile:
    path: /etc/sysconfig/chronyd
    line: OPTIONS="-u chrony"
    state: present
    create: true
  when:
  - '"kernel" in ansible_facts.packages'
  - '"chrony" in ansible_facts.packages'
  - chronyd_file is defined and chronyd_file.matched == 0
  tags:
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-chronyd_run_as_chrony_user:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_obsolete">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Obsolete Services</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Amazon Linux 2023
by default.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host

firewall software such as <html:code xmlns:html="http://www.w3.org/1999/xhtml">iptables</html:code> to restrict access to the

vulnerable service to only those remote hosts which have a known
need to use it.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_rsync_removed" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall rsync Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyncd service can be used to synchronize files between systems over network links.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">rsync</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove rsync</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.18</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The rsyncd service presents a security risk as it uses unencrypted protocols for
communication.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsync_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_rsync

class remove_rsync {
  package { 'rsync':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsync_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove rsync
# from the system, and may remove any packages
# that depend on rsync. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "rsync" ; then
dnf remove -y --noautoremove "rsync"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsync_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=rsync
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_rsync_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall rsync Package: Ensure rsync is removed'
  ansible.builtin.package:
    name: rsync
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_rsync_removed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_rsync_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_rsync_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_r_services">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Rlogin, Rsh, and Rexec</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove Rsh Trust Files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The files <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/hosts.equiv</html:code> and <html:code xmlns:html="http://www.w3.org/1999/xhtml">~/.rhosts</html:code> (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo rm /etc/hosts.equiv</html:pre>
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ rm ~/.rhosts</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">6.2.11</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This action is only meaningful if <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system.</rationale>
          <platform idref="#package_rsh-server"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_rsh_trust_files" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q rsh-server; then

find /root -xdev -type f -name ".rhosts" -exec rm -f {} \;
find /home -maxdepth 2 -xdev -type f -name ".rhosts" -exec rm -f {} \;
rm -f /etc/hosts.equiv

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="no_rsh_trust_files" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Detect .rhosts files in users home directories
  ansible.builtin.find:
    paths:
    - /root
    - /home
    recurse: true
    patterns: .rhosts
    hidden: true
    file_type: file
  check_mode: false
  register: rhosts_locations
  when: '"rsh-server" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Remove .rhosts files
  ansible.builtin.file:
    path: '{{ item }}'
    state: absent
  with_items: '{{ rhosts_locations.files | map(attribute=''path'') | list }}'
  when:
  - '"rsh-server" in ansible_facts.packages'
  - rhosts_locations is success
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy

- name: Remove /etc/hosts.equiv file
  ansible.builtin.file:
    path: /etc/hosts.equiv
    state: absent
  when: '"rsh-server" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - no_rsh_trust_files
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-no_rsh_trust_files:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_telnet">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Telnet</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall telnet-server Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet-server</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove telnet-server</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.2</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000095-GPOS-00049</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.13</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">It is detrimental for operating systems to provide, or install by default,
functionality exceeding requirements or mission objectives. These
unnecessary capabilities are often overlooked and therefore may remain
insecure. They increase the risk to the platform by providing additional
attack vectors.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The telnet service provides an unencrypted remote access service which does
not provide for the confidentiality and integrity of user passwords or the
remote session. If a privileged user were to login using this service, the
privileged user password could be compromised.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet-server</html:code> package decreases the risk of the
telnet service's accidental (or intentional) activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet-server_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_telnet-server

class remove_telnet-server {
  package { 'telnet-server':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet-server_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove telnet-server
# from the system, and may remove any packages
# that depend on telnet-server. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "telnet-server" ; then
dnf remove -y --noautoremove "telnet-server"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet-server_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=telnet-server
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet-server_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall telnet-server Package: Ensure telnet-server is removed'
  ansible.builtin.package:
    name: telnet-server
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.2
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_telnet-server_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_telnet-server_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_telnet-server_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_package_telnet_removed" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove telnet Clients</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The telnet client allows users to start connections to other systems via
the telnet protocol.</description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.3.1</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">telnet</html:code> protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The <html:code xmlns:html="http://www.w3.org/1999/xhtml">ssh</html:code> package provides an
encrypted session and stronger security and is included in Amazon Linux 2023.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_telnet

class remove_telnet {
  package { 'telnet':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove telnet
# from the system, and may remove any packages
# that depend on telnet. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "telnet" ; then
dnf remove -y --noautoremove "telnet"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=telnet
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_telnet_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Remove telnet Clients: Ensure telnet is removed'
  ansible.builtin.package:
    name: telnet
    state: absent
  tags:
  - NIST-800-171-3.1.13
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - package_telnet_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_telnet_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_telnet_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_tftp">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TFTP Server</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall tftp-server Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">tftp-server</html:code> package can be removed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf remove tftp-server</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R62</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Removing the <html:code xmlns:html="http://www.w3.org/1999/xhtml">tftp-server</html:code> package decreases the risk of the accidental
(or intentional) activation of tftp services.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If TFTP is required for operational support (such as transmission of router
configurations), its use must be documented with the Information Systems
Security Manager (ISSM), restricted to only authorized personnel, and have
access control rules established.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tftp-server_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_tftp-server

class remove_tftp-server {
  package { 'tftp-server':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tftp-server_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove tftp-server
# from the system, and may remove any packages
# that depend on tftp-server. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "tftp-server" ; then
dnf remove -y --noautoremove "tftp-server"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tftp-server_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=tftp-server
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_tftp-server_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall tftp-server Package: Ensure tftp-server is removed'
  ansible.builtin.package:
    name: tftp-server
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_tftp-server_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_tftp-server_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_tftp-server_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_printing">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Print Support</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Common Unix Printing System (CUPS) service provides both local
and network printing support. A system running the CUPS service can accept
print jobs from other systems, process them, and send them to the appropriate
printer. It also provides an interface for remote administration through a web
browser. The CUPS service is installed and activated by default. The project
homepage and more detailed documentation are available at

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="http://www.cups.org">http://www.cups.org</html:a>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     </description>
      <Rule id="xccdf_org.ssgproject.content_rule_package_cups_removed" selected="false" role="full" severity="unknown">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall CUPS Package</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">cups</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove cups</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system does not need to print jobs or accept print jobs from other systems, it is
recommended that CUPS be removed to reduce the potential attack surface.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cups_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_cups

class remove_cups {
  package { 'cups':
    ensure =&gt; 'purged',
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cups_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove cups
# from the system, and may remove any packages
# that depend on cups. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "cups" ; then
dnf remove -y --noautoremove "cups"
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cups_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=cups
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_cups_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall CUPS Package: Ensure cups is removed'
  ansible.builtin.package:
    name: cups
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_cups_removed
  - unknown_severity
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-package_cups_removed:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-package_cups_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_proxy">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Proxy Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_squid">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Squid if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_squid_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall squid Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">squid</html:code> package can be removed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf remove squid</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.11</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_squid_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_squid

class remove_squid {
  package { 'squid':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_squid_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove squid
# from the system, and may remove any packages
# that depend on squid. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "squid" ; then
dnf remove -y --noautoremove "squid"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_squid_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=squid
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_squid_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall squid Package: Ensure squid is removed'
  ansible.builtin.package:
    name: squid
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_squid_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_squid_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_squid_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_smb">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Samba(SMB) Microsoft Windows File Sharing Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When properly configured, the Samba service allows
Linux systems to provide file and print sharing to Microsoft
Windows systems. There are two software packages that provide
Samba support. The first, <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba-client</html:code>, provides a series of
command line tools that enable a client system to access Samba
shares. The second, simply labeled <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba</html:code>, provides the Samba
service. It is this second package that allows a Linux system to
act as an Active Directory server, a domain controller, or as a
domain member. Only the <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba-client</html:code> package is installed by
default.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_samba">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Samba if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Even after the Samba server package has been installed, it
will remain disabled. Do not enable this service unless it is
absolutely necessary to provide Microsoft Windows file and print
sharing functionality.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_samba_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall Samba Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba</html:code> package can be removed with the following command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml"> $ sudo dnf remove samba</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.10</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to make the Samba software available,
removing it provides a safeguard against its activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_samba_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_samba

class remove_samba {
  package { 'samba':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_samba_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove samba
# from the system, and may remove any packages
# that depend on samba. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "samba" ; then
dnf remove -y --noautoremove "samba"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_samba_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=samba
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_samba_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall Samba Package: Ensure samba is removed'
  ansible.builtin.package:
    name: samba
    state: absent
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_samba_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_samba_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_samba_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_snmp">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SNMP Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_snmp_service">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SNMP Server if Possible</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Uninstall net-snmp Package</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">net-snmp</html:code> package provides the snmpd service.
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">net-snmp</html:code> package can be removed with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
$ sudo dnf remove net-snmp</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.12</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_net-snmp

class remove_net-snmp {
  package { 'net-snmp':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove net-snmp
# from the system, and may remove any packages
# that depend on net-snmp. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "net-snmp" ; then
dnf remove -y --noautoremove "net-snmp"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=net-snmp
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_net-snmp_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Uninstall net-snmp Package: Ensure net-snmp is removed'
  ansible.builtin.package:
    name: net-snmp
    state: absent
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.4
  - disable_strategy
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_net-snmp_removed
  - unknown_severity
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_net-snmp_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" selected="false" role="full" severity="low">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable snmpd Service</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
The <html:code xmlns:html="http://www.w3.org/1999/xhtml">snmpd</html:code> service can be disabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl mask --now snmpd.service</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.12</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1311</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Running SNMP software provides a network-based avenue of attack, and
should be disabled if not needed.</rationale>
          <platform idref="#package_snmpd_and_system_with_kernel"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_snmpd_disabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include disable_snmpd

class disable_snmpd {
  service {'snmpd':
    enable =&gt; false,
    ensure =&gt; 'stopped',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_snmpd_disabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable"># Remediation is applicable only in certain platforms
if ( rpm --quiet -q net-snmp &amp;&amp; rpm --quiet -q kernel ); then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" stop 'snmpd.service'
fi
"$SYSTEMCTL_EXEC" disable 'snmpd.service'
"$SYSTEMCTL_EXEC" mask 'snmpd.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL_EXEC" -q list-unit-files snmpd.socket; then
    if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
      "$SYSTEMCTL_EXEC" stop 'snmpd.socket'
    fi
    "$SYSTEMCTL_EXEC" mask 'snmpd.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL_EXEC" reset-failed 'snmpd.service' || true

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_snmpd_disabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
masked = ["snmpd"]
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_snmpd_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled

- name: Disable snmpd Service - Disable service snmpd
  block:

  - name: Disable snmpd Service - Collect systemd Services Present in the System
    ansible.builtin.command: systemctl -q list-unit-files --type service
    register: service_exists
    changed_when: false
    failed_when: service_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable snmpd Service - Ensure snmpd.service is Masked
    ansible.builtin.systemd:
      name: snmpd.service
      state: stopped
      enabled: false
      masked: true
    when: service_exists.stdout_lines is search("snmpd.service", multiline=True)

  - name: Unit Socket Exists - snmpd.socket
    ansible.builtin.command: systemctl -q list-unit-files snmpd.socket
    register: socket_file_exists
    changed_when: false
    failed_when: socket_file_exists.rc not in [0, 1]
    check_mode: false

  - name: Disable snmpd Service - Disable Socket snmpd
    ansible.builtin.systemd:
      name: snmpd.socket
      enabled: false
      state: stopped
      masked: true
    when: socket_file_exists.stdout_lines is search("snmpd.socket", multiline=True)
  tags:
  - disable_strategy
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed
  - service_snmpd_disabled
  - special_service_block
  when: ( "net-snmp" in ansible_facts.packages and "kernel" in ansible_facts.packages
    )
</fix>
          <check system="http://open-scap.org/page/SCE">
            <check-import import-name="stdout">
                </check-import>
            <check-content-ref href="al2023/checks/sce/service_snmpd_disabled.sh"/>
          </check>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-service_snmpd_disabled:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-service_snmpd_disabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_ssh">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Server</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,

    <html:a xmlns:html="http://www.w3.org/1999/xhtml" href="https://www.openssh.com">https://www.openssh.com</html:a>.
Its server program is called <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd</html:code> and provided by the RPM package
<html:code xmlns:html="http://www.w3.org/1999/xhtml">openssh-server</html:code>.</description>
      <Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH session Idle time</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify duration of allowed idle time.</description>
        <value selector="10_minutes">600</value>
        <value selector="120_minutes">7200</value>
        <value selector="14_minutes">840</value>
        <value selector="15_minutes">900</value>
        <value selector="30_minutes">1800</value>
        <value selector="5_minutes">300</value>
        <value selector="60_minutes">3600</value>
        <value>300</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max authentication attempts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of authentication attempts per connection.</description>
        <value selector="10">10</value>
        <value selector="3">3</value>
        <value selector="4">4</value>
        <value selector="5">5</value>
        <value>4</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_sshd_required" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH is required to be installed</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify if the Policy requires SSH to be installed. Used by SSH Rules
to determine if SSH should be uninstalled or configured.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 1 indicates that OpenSSH server package is not required by the policy;<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
A value of 2 indicates that OpenSSH server package is required by the policy.<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      </description>
        <value>0</value>
        <value selector="no">1</value>
        <value selector="yes">2</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max Sessions Count</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of open sessions permitted.</description>
        <value selector="10">10</value>
        <value selector="4">4</value>
        <value selector="3">3</value>
        <value selector="2">2</value>
        <value selector="1">1</value>
        <value selector="0">0</value>
        <value>10</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH Max Keep Alive Count</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specify the maximum number of idle message counts before session is terminated.</description>
        <value selector="10">10</value>
        <value selector="3">3</value>
        <value selector="5">5</value>
        <value selector="0">0</value>
        <value selector="1">1</value>
        <value>0</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Who Owns SSH Server config file</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /etc/ssh/sshd_config</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_sshd_config" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/ssh/sshd_config" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /etc/ssh/sshd_config
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupowner_sshd_config" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupowner_sshd_config_newgroup variable if represented by gid
  ansible.builtin.set_fact:
    file_groupowner_sshd_config_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  ansible.builtin.stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ssh/sshd_config
  ansible.builtin.file:
    path: /etc/ssh/sshd_config
    follow: false
    group: '{{ file_groupowner_sshd_config_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_groupowner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupowner_sshd_config:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupowner_sshd_config_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership on SSH Server Private *_key Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH server private keys, files that match the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*_key</html:code> glob, must be
group-owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">ssh_keys</html:code> group.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an unauthorized user obtains the private SSH host key file, the host could be impersonated.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_sshd_private_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "ssh_keys" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="ssh_keys"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "ssh_keys is not a defined group on the system"
else
find -P /etc/ssh/ -maxdepth 1 -type f  ! -group ssh_keys -regextype posix-extended -regex '^.*_key$' -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_sshd_private_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Check that the ssh_keys group is defined
  ansible.builtin.getent:
    database: group
    key: ssh_keys
  ignore_errors: true
  when:
  - '"kernel" in ansible_facts.packages'
  - file_groupownership_sshd_private_key_newgroup is undefined
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupownership_sshd_private_key_newgroup variable if ssh_keys
    found
  ansible.builtin.set_fact:
    file_groupownership_sshd_private_key_newgroup: ssh_keys
  when:
  - '"kernel" in ansible_facts.packages'
  - ansible_facts.getent_group["ssh_keys"] is defined
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*_key$
  ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -type f  ! -group ssh_keys
    -regextype posix-extended -regex "^.*_key$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ssh/ file(s) matching ^.*_key$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    group: '{{ file_groupownership_sshd_private_key_newgroup }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupownership_sshd_private_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupownership_sshd_private_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Group Ownership on SSH Server Public *.pub Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH server public keys, files that match the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*.pub</html:code> glob, must be
group-owned by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_sshd_pub_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/ssh/ -maxdepth 1 -type f  ! -group 0 -regextype posix-extended -regex '^.*\.pub$' -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_sshd_pub_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupownership_sshd_pub_key_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupownership_sshd_pub_key_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*\.pub$
  ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -type f  ! -group 0 -regextype
    posix-extended -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/ssh/ file(s) matching ^.*\.pub$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    group: '{{ file_groupownership_sshd_pub_key_newgroup }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupownership_sshd_pub_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupownership_sshd_pub_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Owner on SSH Server config file</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/ssh/sshd_config </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_sshd_config" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/ssh/sshd_config" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /etc/ssh/sshd_config
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_owner_sshd_config" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_owner_sshd_config_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_owner_sshd_config_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  ansible.builtin.stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/ssh/sshd_config
  ansible.builtin.file:
    path: /etc/ssh/sshd_config
    follow: false
    owner: '{{ file_owner_sshd_config_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - configure_strategy
  - file_owner_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_owner_sshd_config:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_owner_sshd_config_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Ownership on SSH Server Private *_key Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH server private keys, files that match the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*_key</html:code> glob, must be owned
by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an unauthorized user obtains the private SSH host key file, the host could be impersonated.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_sshd_private_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else

find -P /etc/ssh/ -maxdepth 1 -type f  ! -user 0 -regextype posix-extended -regex '^.*_key$' -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_sshd_private_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_ownership_sshd_private_key_newown variable if represented by
    uid
  ansible.builtin.set_fact:
    file_ownership_sshd_private_key_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*_key$
  ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -type f  ! -user 0 -regextype
    posix-extended -regex "^.*_key$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/ssh/ file(s) matching ^.*_key$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    owner: '{{ file_ownership_sshd_private_key_newown }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_ownership_sshd_private_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_ownership_sshd_private_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Ownership on SSH Server Public *.pub Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH server public keys, files that match the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*.pub</html:code> glob, must be owned
by <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_sshd_pub_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else

find -P /etc/ssh/ -maxdepth 1 -type f  ! -user 0 -regextype posix-extended -regex '^.*\.pub$' -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_sshd_pub_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_ownership_sshd_pub_key_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_ownership_sshd_pub_key_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s) matching ^.*\.pub$
  ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -type f  ! -user 0 -regextype
    posix-extended -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/ssh/ file(s) matching ^.*\.pub$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    owner: '{{ file_ownership_sshd_pub_key_newown }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_ownership_sshd_pub_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_ownership_sshd_pub_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on SSH Server config file</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>, run the command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 /etc/ssh/sshd_config</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_config" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

chmod u-xs,g-xwrs,o-xwrt /etc/ssh/sshd_config

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_config" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /etc/ssh/sshd_config
  ansible.builtin.stat:
    path: /etc/ssh/sshd_config
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/ssh/sshd_config
  ansible.builtin.file:
    path: /etc/ssh/sshd_config
    mode: u-xs,g-xwrs,o-xwrt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_config
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_sshd_config:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_sshd_config_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on SSH Server Private *_key Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH server private keys - files that match the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*_key</html:code> glob, have to have restricted permissions.
If those files are owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user and the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group, they have to have the <html:code xmlns:html="http://www.w3.org/1999/xhtml">0600</html:code> permission or stricter.
If they are owned by the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> user, but by a dedicated group <html:code xmlns:html="http://www.w3.org/1999/xhtml">ssh_keys</html:code>, they can have the <html:code xmlns:html="http://www.w3.org/1999/xhtml">0640</html:code> permission or stricter.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.2</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1449</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If an unauthorized user obtains the private SSH host key file, the host could be
impersonated.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:puppet">include ssh_private_key_perms

class ssh_private_key_perms {
  exec { 'sshd_priv_key':
    command =&gt; "chmod 0640 /etc/ssh/*_key",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

for keyfile in /etc/ssh/*_key; do
    test -f "$keyfile" || continue
    if test root:root = "$(stat -c "%U:%G" "$keyfile")"; then
    
	chmod u-xs,g-xwrs,o-xwrt "$keyfile"
    
    elif test root:ssh_keys = "$(stat -c "%U:%G" "$keyfile")"; then
	chmod u-xs,g-xws,o-xwrt "$keyfile"
    else
        echo "Key-like file '$keyfile' is owned by an unexpected user:group combination"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_private_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find root:root-owned keys
  ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
    -type f -group root -perm /u+xs,g+xwrs,o+xwrt
  register: root_owned_keys
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for root:root-owned keys
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xwrs,o-xwrt
    state: file
  with_items:
  - '{{ root_owned_keys.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find root:ssh_keys-owned keys
  ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
    -type f -group ssh_keys -perm /u+xs,g+xws,o+xwrt
  register: dedicated_group_owned_keys
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for root:ssh_keys-owned keys
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ dedicated_group_owned_keys.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_private_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_sshd_private_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify Permissions on SSH Server Public *.pub Key Files</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US"> To properly set the permissions of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/*.pub</html:code>, run the command: <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0644 /etc/ssh/*.pub</html:pre>
      </description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Remediation is not possible at bootable container build time because SSH host
keys are generated post-deployment.</warning>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.13</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R50</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If a public host key file is modified by an unauthorized user, the SSH service
may be compromised.</rationale>
        <platform idref="#system_with_kernel"/>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:puppet">include ssh_public_key_perms

class ssh_public_key_perms {
  exec { 'sshd_pub_key':
    command =&gt; "chmod 0644 /etc/ssh/*.pub",
    path    =&gt; '/bin:/usr/bin'
  }
}
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

find -P /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt  -type f -regextype posix-extended -regex '^.*\.pub$' -exec chmod u-xs,g-xws,o-xwt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_sshd_pub_key" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/ssh/ file(s)
  ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt  -type
    f -regextype posix-extended -regex "^.*\.pub$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/ssh/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.13
  - NIST-800-171-3.13.10
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - configure_strategy
  - file_permissions_sshd_pub_key
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_sshd_pub_key:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_ssh_server">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure OpenSSH Server if Necessary</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code xmlns:html="http://www.w3.org/1999/xhtml">sshd_config(5)</html:code> man page for more
detailed information.</description>
        <platform idref="#system_with_kernel"/>
        <Value id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" type="number" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH LoginGraceTime setting</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure parameters for how long the servers stays connected before the user has successfully logged in</description>
          <value>60</value>
          <value selector="60">60</value>
        </Value>
        <Value id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" type="string" interactive="true">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH MaxStartups setting</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon.</description>
          <value>10:30:100</value>
          <value selector="10:30:60">10:30:60</value>
        </Value>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Client Alive Count Max</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The SSH server sends at most <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> configures timeout after
each <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered unresponsive
and terminated.
For SSH earlier than v8.2, a <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveCountMax</html:code> value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>
causes a timeout precisely when the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code> is set.
Starting with v8.2, a value of <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code> disables the timeout functionality
completely. If the option is set to a number greater than <html:code xmlns:html="http://www.w3.org/1999/xhtml">0</html:code>, then
the session will be disconnected after
<html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval * ClientAliveCountMax</html:code> seconds without receiving
a keep alive message.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.20</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">This ensures a user login will be terminated as soon as the <html:code xmlns:html="http://www.w3.org/1999/xhtml">ClientAliveInterval</html:code>
is reached.</rationale>
          <requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_sshd_set_keepalive='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_keepalive" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive
- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>
  tags:
    - always

- name: Set SSH Client Alive Count Max - Check if the parameter ClientAliveCountMax
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive

- name: Set SSH Client Alive Count Max - Check if the parameter ClientAliveCountMax
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+{{ var_sshd_set_keepalive
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive

- name: Set SSH Client Alive Count Max
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter ClientAliveCountMax is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
      line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive

- name: Set SSH Client Alive Count Max - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_keepalive
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_keepalive:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Client Alive Interval</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH allows administrators to set a network responsiveness timeout interval.
After this interval has passed, the unresponsive client will be automatically logged out.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To set this timeout interval, edit the following line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as
follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">ClientAliveInterval <html:b><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/></html:b>
        </html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The timeout <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> is given in seconds. For example, have a timeout
of 10 minutes, set <html:b xmlns:html="http://www.w3.org/1999/xhtml">interval</html:b> to 600.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code>. Keep in mind that
some processes may stop SSH from correctly detecting that the user is idle.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="dependency">SSH disconnecting unresponsive clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration.</warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Following conditions may prevent the SSH session to time out:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.</html:li><html:li>Any <html:code>scp</html:code> or <html:code>sftp</html:code> activity by the same user to the host resets the timeout.</html:li></html:ul>
       </warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-8.1.8</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000395-GPOS-00175</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.20</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2.8</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended.</rationale>
          <requires idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

sshd_idle_timeout_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout
- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set SSH Client Alive Interval - Check if the parameter ClientAliveInterval
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout

- name: Set SSH Client Alive Interval - Check if the parameter ClientAliveInterval
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+{{ sshd_idle_timeout_value
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout

- name: Set SSH Client Alive Interval
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter ClientAliveInterval is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
      line: ClientAliveInterval {{ sshd_idle_timeout_value }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout

- name: Set SSH Client Alive Interval - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.11
  - NIST-800-53-AC-12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-2(5)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-10
  - PCI-DSS-Req-8.1.8
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_idle_timeout
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
            <check-content-ref name="oval:ssg-sshd_set_idle_timeout:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable Host-Based Authentication</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH's cryptographic host-based authentication is
more secure than <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SSH configuration disables host-based authentication. The appropriate
configuration is used if no value is set for <html:code xmlns:html="http://www.w3.org/1999/xhtml">HostbasedAuthentication</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To explicitly disable host-based authentication, add or correct the
following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">HostbasedAuthentication no</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.8</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0484</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">8.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_host_auth" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
chmod 0600 /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*HostbasedAuthentication\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "HostbasedAuthentication no" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
cat "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="disable_host_auth" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable Host-Based Authentication - Check if the parameter HostbasedAuthentication
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable Host-Based Authentication - Check if the parameter HostbasedAuthentication
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable Host-Based Authentication
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter HostbasedAuthentication is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
      line: HostbasedAuthentication no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Disable Host-Based Authentication - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3
  - PCI-DSSv4-8.3.1
  - disable_host_auth
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-disable_host_auth:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-disable_host_auth_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="false" role="full" severity="high">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Access via Empty Passwords</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disallow SSH login with empty passwords.
The default SSH configuration disables logins with empty passwords. The appropriate
configuration is used if no value is set for <html:code xmlns:html="http://www.w3.org/1999/xhtml">PermitEmptyPasswords</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To explicitly disallow SSH login from accounts with empty passwords,
add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitEmptyPasswords no</html:pre>
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.</description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.9</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_empty_passwords" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
chmod 0600 /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitEmptyPasswords\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitEmptyPasswords no" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
cat "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_empty_passwords" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Disable SSH Access via Empty Passwords - Check if the parameter PermitEmptyPasswords
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Disable SSH Access via Empty Passwords - Check if the parameter PermitEmptyPasswords
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Disable SSH Access via Empty Passwords
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter PermitEmptyPasswords is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
      line: PermitEmptyPasswords no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords

- name: Disable SSH Access via Empty Passwords - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_empty_passwords
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_empty_passwords:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Support for .rhosts Files</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code> files.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SSH configuration disables support for <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rhosts</html:code>. The appropriate
configuration is used if no value is set for <html:code xmlns:html="http://www.w3.org/1999/xhtml">IgnoreRhosts</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To explicitly disable support for .rhosts files, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">IgnoreRhosts yes</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.11</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
chmod 0600 /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*IgnoreRhosts\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "IgnoreRhosts yes" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
cat "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_rhosts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Disable SSH Support for .rhosts Files - Check if the parameter IgnoreRhosts
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Disable SSH Support for .rhosts Files - Check if the parameter IgnoreRhosts
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+yes$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Disable SSH Support for .rhosts Files
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter IgnoreRhosts is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
      line: IgnoreRhosts yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts

- name: Disable SSH Support for .rhosts Files - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_rhosts
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_rhosts:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH Root Login</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The root user should never be allowed to login to a
system directly over a network.
To disable root login via SSH, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitRootLogin no</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(2)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(5)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000148-CTR-000335</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000190-CTR-000500</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Even though the communications channel may be encrypted, an additional layer of
security is gained by extending the policy of not logging directly on as root.
In addition, logging in with a user-specific account provides individual
accountability of actions performed on the system and also helps to minimize
direct attack attempts on root's password.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_login" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitRootLogin\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitRootLogin no" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_root_login" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Disable SSH Root Login - Check if the parameter PermitRootLogin is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Disable SSH Root Login - Check if the parameter PermitRootLogin is configured
    correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Disable SSH Root Login
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter PermitRootLogin is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
      line: PermitRootLogin no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login

- name: Disable SSH Root Login - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.1
  - NIST-800-171-3.1.5
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-6(2)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(5)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_root_login
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_root_login:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable SSH TCP Forwarding</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">AllowTcpForwarding</html:code> parameter specifies whether TCP forwarding is permitted.
To disable TCP forwarding, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">AllowTcpForwarding no</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.13</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Leaving port forwarding enabled can expose the organization to security risks and back-doors.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_tcp_forwarding" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*AllowTcpForwarding\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "AllowTcpForwarding no" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_tcp_forwarding" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Disable SSH TCP Forwarding - Check if the parameter AllowTcpForwarding is
    configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Disable SSH TCP Forwarding - Check if the parameter AllowTcpForwarding is
    configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Disable SSH TCP Forwarding
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter AllowTcpForwarding is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "AllowTcpForwarding"| regex_escape }}\s+
      line: AllowTcpForwarding no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding

- name: Disable SSH TCP Forwarding - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_tcp_forwarding
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_tcp_forwarding:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X11 Forwarding</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The X11Forwarding parameter provides the ability to tunnel X11 traffic
through the connection to enable remote graphic connections.
SSH has the capability to encrypt remote X11 connections when SSH's
<html:code xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding</html:code> option is enabled.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SSH configuration disables X11Forwarding. The appropriate
configuration is used if no value is set for <html:code xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To explicitly disable X11 Forwarding, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">X11Forwarding no</html:pre>
       </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(b)</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.12</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0484</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X11 forwarding unless there is an operational requirement to use X11
applications directly. There is a small risk that the remote X11 servers of
users who are logged in via SSH with X11 forwarding could be compromised by
other users on the X11 server. Note that even if X11 forwarding is disabled,
users can always install their own forwarders.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_x11_forwarding" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
chmod 0600 /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*X11Forwarding\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "X11Forwarding no" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
cat "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_disable_x11_forwarding" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Disable X11 Forwarding - Check if the parameter X11Forwarding is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Disable X11 Forwarding - Check if the parameter X11Forwarding is configured
    correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Disable X11 Forwarding
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter X11Forwarding is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "X11Forwarding"| regex_escape }}\s+
      line: X11Forwarding no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding

- name: Disable X11 Forwarding - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(b)
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_disable_x11_forwarding
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_disable_x11_forwarding:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Do Not Allow SSH Environment Options</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure that users are not able to override environment variables of the SSH daemon.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The default SSH configuration disables environment processing. The appropriate
configuration is used if no value is set for <html:code xmlns:html="http://www.w3.org/1999/xhtml">PermitUserEnvironment</html:code>.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
To explicitly disable Environment options, add or correct the following


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">PermitUserEnvironment no</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI10.05</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.3.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.5.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.4</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00229</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.10</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH environment options potentially allow users to bypass
access restriction in some configurations.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_do_not_permit_user_env" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
chmod 0600 /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf

LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*PermitUserEnvironment\s\+/Id" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
else
    touch "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"

cp "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf" "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "PermitUserEnvironment no" &gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
cat "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_do_not_permit_user_env" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Do Not Allow SSH Environment Options - Check if the parameter PermitUserEnvironment
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Do Not Allow SSH Environment Options - Check if the parameter PermitUserEnvironment
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+no$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Do Not Allow SSH Environment Options
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter PermitUserEnvironment is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
      line: PermitUserEnvironment no
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env

- name: Do Not Allow SSH Environment Options - set file mode for /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.12
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_do_not_permit_user_env
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_do_not_permit_user_env:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_pam" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable PAM</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
enable PAM authentication using ChallengeResponseAuthentication and
PasswordAuthentication in addition to PAM account and session module processing for all
authentication types.

To enable PAM authentication, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">UsePAM yes</html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000125-GPOS-00065</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">When UsePAM is set to yes, PAM runs through account and session types properly. This is
important if you want to restrict access to services based off of IP, time or other factors of
the account. Additionally, you can make sure users inherit certain environment variables
on login or disallow access to the server.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_pam" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*UsePAM\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "UsePAM yes" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_pam" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Enable PAM - Check if the parameter UsePAM is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "UsePAM"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Enable PAM - Check if the parameter UsePAM is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "UsePAM"| regex_escape }}\s+yes$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Enable PAM
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "UsePAM"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter UsePAM is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "UsePAM"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "UsePAM"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "UsePAM"| regex_escape }}\s+
      line: UsePAM yes
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam

- name: Enable PAM - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_pam
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_pam:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable SSH Warning Banner</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To enable the warning banner and ensure it is consistent
across the system, add or correct the following line in

<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">Banner /etc/issue.net</html:pre>
Another section contains information on how to create an
appropriate system-wide warning banner.</description>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.10</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.10</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.9</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.18.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-8(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000023-GPOS-00006</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000228-GPOS-00088</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.15</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The warning message reinforces policy awareness during the logon process and
facilitates possible legal action against attackers. Alternatively, systems
whose ownership should not be obvious should ensure usage of a banner that does
not provide easy attribution.</rationale>
          <conflicts idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_warning_banner_net" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*Banner\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "Banner /etc/issue.net" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_enable_warning_banner_net" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Enable SSH Warning Banner - Check if the parameter Banner is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "Banner"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Enable SSH Warning Banner - Check if the parameter Banner is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "Banner"| regex_escape }}\s+/etc/issue.net$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Enable SSH Warning Banner
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter Banner is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "Banner"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
      line: Banner /etc/issue.net
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net

- name: Enable SSH Warning Banner - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.5.6
  - NIST-800-171-3.1.9
  - NIST-800-53-AC-17(a)
  - NIST-800-53-AC-8(a)
  - NIST-800-53-AC-8(c)
  - NIST-800-53-CM-6(a)
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_enable_warning_banner_net
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_enable_warning_banner_net:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_enable_warning_banner_net_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" selected="false" role="full" severity="unknown">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Limit Users' SSH Access</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By default, the SSH configuration allows any user with an account
to access the system. There are several options available to limit
which users and group can access the system via SSH. It is
recommended that at least one of the following options be leveraged:
- AllowUsers variable gives the system administrator the option of
  allowing specific users to ssh into the system. The list consists of
  space separated user names. Numeric user IDs are not recognized with
  this variable. If a system administrator wants to restrict user
  access further by specifically allowing a user's access only from a
  particular host, the entry can be specified in the form of user@host.
- AllowGroups variable gives the system administrator the option of
  allowing specific groups of users to ssh into the system. The list
  consists of space separated group names. Numeric group IDs are not
  recognized with this variable.
- DenyUsers variable gives the system administrator the option of
  denying specific users to ssh into the system. The list consists of
  space separated user names. Numeric user IDs are not recognized with
  this variable. If a system administrator wants to restrict user
  access further by specifically denying a user's access from a
  particular host, the entry can be specified in the form of user@host.
- DenyGroups variable gives the system administrator the option of
  denying specific groups of users to ssh into the system. The list
  consists of space separated group names. Numeric group IDs are not
  recognized with this variable.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Automated remediation is not available for this configuration check
because each system has unique user names and group names.</warning>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">18</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS06.06</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.12</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.4</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-3</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Specifying which accounts are allowed SSH access into the system reduces the
possibility of unauthorized access to the system.</rationale>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-sshd_limit_user_access:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SSH LoginGraceTime is configured</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">LoginGraceTime</html:code> parameter to the SSH server specifies the time allowed for successful authentication to
the SSH server. The longer the Grace period is the more open unauthenticated connections
can exist. Like other session controls in this session the Grace Period should be limited to
appropriate limits to ensure the service is available for needed access.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.19</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the <html:code xmlns:html="http://www.w3.org/1999/xhtml">LoginGraceTime</html:code> parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. It will also limit the number of concurrent
unauthenticated connections.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_login_grace_time" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_sshd_set_login_grace_time='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*LoginGraceTime\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "LoginGraceTime $var_sshd_set_login_grace_time" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_login_grace_time" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time
- name: XCCDF Value var_sshd_set_login_grace_time # promote to variable
  set_fact:
    var_sshd_set_login_grace_time: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time" use="legacy"/>
  tags:
    - always

- name: Ensure SSH LoginGraceTime is configured - Check if the parameter LoginGraceTime
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time

- name: Ensure SSH LoginGraceTime is configured - Check if the parameter LoginGraceTime
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+{{ var_sshd_set_login_grace_time
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time

- name: Ensure SSH LoginGraceTime is configured
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter LoginGraceTime is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
      line: LoginGraceTime {{ var_sshd_set_login_grace_time }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time

- name: Ensure SSH LoginGraceTime is configured - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_login_grace_time
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_set_login_grace_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_login_grace_time:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_login_grace_time_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH Daemon LogLevel to VERBOSE</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">VERBOSE</html:code> parameter configures the SSH daemon to record login and logout activity.
To specify the log level in
SSH, add or correct the following line in


<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">LogLevel VERBOSE</html:pre>
       </description>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R7.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-2.2.4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000032-GPOS-00013</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.5</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">SSH provides several logging levels with varying amounts of verbosity. <html:code xmlns:html="http://www.w3.org/1999/xhtml">DEBUG</html:code> is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. <html:code xmlns:html="http://www.w3.org/1999/xhtml">INFO</html:code> or
<html:code xmlns:html="http://www.w3.org/1999/xhtml">VERBOSE</html:code> level is the basic level that only records login activity of SSH users. In many
situations, such as Incident Response, it is important to determine when a particular user was active
on a system. The logout record can eliminate those users who disconnected, which helps narrow the
field.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_verbose" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*LogLevel\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "LogLevel VERBOSE" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_loglevel_verbose" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Set SSH Daemon LogLevel to VERBOSE - Check if the parameter LogLevel is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "LogLevel"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Set SSH Daemon LogLevel to VERBOSE - Check if the parameter LogLevel is configured
    correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "LogLevel"| regex_escape }}\s+VERBOSE$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Set SSH Daemon LogLevel to VERBOSE
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter LogLevel is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "LogLevel"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
      line: LogLevel VERBOSE
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose

- name: Set SSH Daemon LogLevel to VERBOSE - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-2.2.4
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_loglevel_verbose
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_loglevel_verbose:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH authentication attempt limit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">MaxAuthTries</html:code> parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">MaxAuthTries <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.16</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0421</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0422</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0974</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1173</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1401</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1504</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1505</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1546</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1557</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1558</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1559</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1560</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1561</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_auth_tries" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

sshd_max_auth_tries_value='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxAuthTries\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxAuthTries $sshd_max_auth_tries_value" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_auth_tries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries
- name: XCCDF Value sshd_max_auth_tries_value # promote to variable
  set_fact:
    sshd_max_auth_tries_value: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" use="legacy"/>
  tags:
    - always

- name: Set SSH authentication attempt limit - Check if the parameter MaxAuthTries
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries

- name: Set SSH authentication attempt limit - Check if the parameter MaxAuthTries
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+{{ sshd_max_auth_tries_value
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries

- name: Set SSH authentication attempt limit
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter MaxAuthTries is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
      line: MaxAuthTries {{ sshd_max_auth_tries_value }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries

- name: Set SSH authentication attempt limit - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_auth_tries
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-export export-name="oval:ssg-sshd_max_auth_tries_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value"/>
            <check-content-ref name="oval:ssg-sshd_set_max_auth_tries:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Set SSH MaxSessions limit</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">MaxSessions</html:code> parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> as follows: <html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">MaxSessions <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.18</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_sessions" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_sshd_max_sessions='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxSessions\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxSessions $var_sshd_max_sessions" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_max_sessions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions
- name: XCCDF Value var_sshd_max_sessions # promote to variable
  set_fact:
    var_sshd_max_sessions: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" use="legacy"/>
  tags:
    - always

- name: Set SSH MaxSessions limit - Check if the parameter MaxSessions is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions

- name: Set SSH MaxSessions limit - Check if the parameter MaxSessions is configured
    correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxSessions"| regex_escape }}\s+{{ var_sshd_max_sessions
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions

- name: Set SSH MaxSessions limit
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter MaxSessions is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
      line: MaxSessions {{ var_sshd_max_sessions }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions

- name: Set SSH MaxSessions limit - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_max_sessions
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_max_sessions:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_max_sessions:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure SSH MaxStartups is configured</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The MaxStartups parameter specifies the maximum number of concurrent unauthenticated
connections to the SSH daemon. Additional connections will be dropped until authentication
succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should
add or edit the following line in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/ssh/sshd_config</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">MaxStartups <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>
        </html:pre>
       </description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">4.2.17</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2.6</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">2.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To protect a system from denial of service due to a large number of pending authentication
connection attempts, use the rate limiting function of MaxStartups to protect availability of
sshd logins and prevent overwhelming the daemon.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_maxstartups" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

var_sshd_set_maxstartups='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>'


mkdir -p /etc/ssh/sshd_config.d
touch /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
chmod 0600 /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf

LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config"
LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config.d"/*.conf
if [ -e "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*MaxStartups\s\+/Id" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
else
    touch "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"

cp "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf" "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"
# Insert at the beginning of the file
printf '%s\n' "MaxStartups $var_sshd_set_maxstartups" &gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
cat "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak" &gt;&gt; "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf"
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="sshd_set_maxstartups" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups
- name: XCCDF Value var_sshd_set_maxstartups # promote to variable
  set_fact:
    var_sshd_set_maxstartups: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" use="legacy"/>
  tags:
    - always

- name: Ensure SSH MaxStartups is configured - Check if the parameter MaxStartups
    is configured
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
  register: _sshd_config_has_parameter
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups

- name: Ensure SSH MaxStartups is configured - Check if the parameter MaxStartups
    is configured correctly
  ansible.builtin.find:
    paths:
    - /etc/ssh/sshd_config
    - /etc/ssh/sshd_config.d
    contains: (?i)^\s*{{ "MaxStartups"| regex_escape }}\s+{{ var_sshd_set_maxstartups
      }}$
  register: _sshd_config_correctly
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups

- name: Ensure SSH MaxStartups is configured
  block:

  - name: Deduplicate values from /etc/ssh/sshd_config
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
      state: absent

  - name: Check if /etc/ssh/sshd_config.d exists
    ansible.builtin.stat:
      path: /etc/ssh/sshd_config.d
    register: _etc_ssh_sshd_config_d_exists

  - name: Check if the parameter MaxStartups is present in /etc/ssh/sshd_config.d
    ansible.builtin.find:
      paths: /etc/ssh/sshd_config.d
      recurse: 'yes'
      follow: 'no'
      contains: (?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
    register: _etc_ssh_sshd_config_d_has_parameter
    when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/ssh/sshd_config.d
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
      state: absent
    with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
    when: _etc_ssh_sshd_config_d_has_parameter.matched

  - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    ansible.builtin.lineinfile:
      path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
      create: true
      regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
      line: MaxStartups {{ var_sshd_set_maxstartups }}
      state: present
      insertbefore: BOF
      validate: /usr/sbin/sshd -t -f %s
  when:
  - '"kernel" in ansible_facts.packages'
  - _sshd_config_correctly.matched == 0 or _sshd_config_has_parameter.matched != 1
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups

- name: Ensure SSH MaxStartups is configured - set file mode for /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
  ansible.builtin.file:
    path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
    mode: '0600'
    state: touch
    modification_time: preserve
    access_time: preserve
  when: '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSSv4-2.2
  - PCI-DSSv4-2.2.6
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
  - sshd_set_maxstartups
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_sshd_set_maxstartups:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups"/>
            <check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
            <check-content-ref name="oval:ssg-sshd_set_maxstartups:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_xwindows">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">X Window System</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The X Window System implementation included with the
system is called X.org.</description>
      <Group id="xccdf_org.ssgproject.content_group_disabling_xwindows">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Disable X Windows</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Remove the X Windows Package Group</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">By removing the xorg-x11-server-common package, the system no longer has X Windows
installed. If X Windows is not installed then the system cannot boot into graphical user mode.
This prevents the system from being accidentally or maliciously booted into a <html:code xmlns:html="http://www.w3.org/1999/xhtml">graphical.target</html:code>
mode. To do so, run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo dnf groupremove "X Window System"</html:pre>
        <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo dnf remove xorg-x11-server-common</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="functionality">The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
overall security posture. Removing the package xorg-x11-server-common package will remove the graphical target
which might bring your system to an inconsistent state requiring additional configuration to access the system
again. If a GUI is an operational requirement, a tailored profile that removes this rule should used before
continuing installation.</warning>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-7(b)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">2.2.1</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
vulnerabilities and should not be installed unless approved and documented.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="disable">
include remove_xorg-x11-server-common

class remove_xorg-x11-server-common {
  package { 'xorg-x11-server-common':
    ensure =&gt; 'purged',
  }
}
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="disable">
# CAUTION: This remediation script will remove xorg-x11-server-common
# from the system, and may remove any packages
# that depend on xorg-x11-server-common. Execute this
# remediation AFTER testing on a non-production
# system!


if rpm -q --quiet "xorg-x11-server-common" ; then
dnf remove -y --noautoremove "xorg-x11-server-common"
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="disable">

package --remove=xorg-x11-server-common
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_xorg-x11-server-common_removed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="disable">- name: 'Remove the X Windows Package Group: Ensure xorg-x11-server-common is removed'
  ansible.builtin.package:
    name: xorg-x11-server-common
    state: absent
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_xorg-x11-server-common_removed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-package_xorg-x11-server-common_removed:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
  </Group>
  <Group id="xccdf_org.ssgproject.content_group_auditing">
    <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Accounting with auditd</title>
    <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> has modest disk space
requirements, and should not noticeably impact system performance.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
NOTE: The Linux Audit daemon <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to use
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules files (<html:code xmlns:html="http://www.w3.org/1999/xhtml">*.rules</html:code>)
located in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> location and compile them to create
the resulting form of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> configuration file
during the daemon startup (default configuration). Alternatively, the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>
daemon can use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility to read audit rules from the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <html:code xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost</html:code> directive setting in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
To instruct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program
to read audit rules (default configuration), use the following setting:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost=-/sbin/augenrules --load</html:pre>
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
In order to instruct the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules, use the following setting:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     <html:pre xmlns:html="http://www.w3.org/1999/xhtml">ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</html:pre>
in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code> configuration file.
Refer to <html:code xmlns:html="http://www.w3.org/1999/xhtml">[Service]</html:code> section of the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/lib/systemd/system/auditd.service</html:code>
configuration file for further details.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
     <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Government networks often have substantial auditing
requirements and <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Red Hat Enterprise Linux 7 Documentation available at
<html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</html:a></html:code>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/www/html/file1</html:code> file (labeled with
the <html:code xmlns:html="http://www.w3.org/1999/xhtml">samba_share_t</html:code> type):
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</html:pre>
     <html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>msg=audit(1226874073.147:96)</html:code><html:ul><html:li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<html:code>date</html:code> command.
</html:li></html:ul></html:li><html:li><html:code>{ getattr }</html:code><html:ul><html:li>The item in braces indicates the permission that was denied. <html:code>getattr</html:code>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <html:code>getattr</html:code>,
<html:code>read</html:code>, and <html:code>write</html:code>.</html:li></html:ul></html:li><html:li><html:code>comm="httpd"</html:code><html:ul><html:li>The executable that launched the process. The full path of the executable is
found in the <html:code>exe=</html:code> section of the system call (<html:code>SYSCALL</html:code>) message,
which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul></html:li><html:li><html:code>path="/var/www/html/file1"</html:code><html:ul><html:li>The path to the object (target) the process attempted to access.
</html:li></html:ul></html:li><html:li><html:code>scontext="unconfined_u:system_r:httpd_t:s0"</html:code><html:ul><html:li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <html:code>httpd_t</html:code> domain.
</html:li></html:ul></html:li><html:li><html:code>tcontext="unconfined_u:object_r:samba_share_t:s0"</html:code><html:ul><html:li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <html:code>file1</html:code>. Note: the <html:code>samba_share_t</html:code>
type is not accessible to processes running in the <html:code>httpd_t</html:code> domain.</html:li></html:ul></html:li><html:li> From the system call (<html:code>SYSCALL</html:code>) message, two items are of interest:
<html:ul><html:li><html:code>success=no</html:code>: indicates whether the denial (AVC) was enforced or not.
<html:code>success=no</html:code> indicates the system call was not successful (SELinux denied
access). <html:code>success=yes</html:code> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <html:code>initrc_t</html:code>
and <html:code>kernel_t</html:code>.
</html:li><html:li><html:code>exe="/usr/sbin/httpd"</html:code>: the full path to the executable that launched
the process, which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul>
      </html:li></html:ul>
    </description>
    <platform idref="#system_with_kernel"/>
    <Value id="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" type="string" interactive="true">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit backlog limit</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Value of the audit_backlog_limit argument in GRUB 2 configuration.
The audit_backlog_limit parameter determines how auditd records can
be held in the auditd backlog.</description>
      <value>8192</value>
      <value selector="8192">8192</value>
    </Value>
    <Rule id="xccdf_org.ssgproject.content_rule_package_audit_installed" selected="false" role="full" severity="medium">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure the audit Subsystem is Installed</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit package should be installed.</description>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
      <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
      <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(1)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-7(2)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(2)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(a)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
      <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
      <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.1</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</reference>
      <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</reference>
      <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
      <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.1.1</reference>
      <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
      <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
      <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.</rationale>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_audit

class install_audit {
  package { 'audit':
    ensure =&gt; 'installed',
  }
}
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

if ! rpm -q --quiet "audit" ; then
    dnf install -y "audit"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "audit"
version = "*"
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=audit
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="package_audit_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AU-12(2)
  - NIST-800-53-AU-14
  - NIST-800-53-AU-2(a)
  - NIST-800-53-AU-7(1)
  - NIST-800-53-AU-7(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audit_installed

- name: Ensure audit is installed
  ansible.builtin.package:
    name: audit
    state: present
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-7(a)
  - NIST-800-53-AU-12(2)
  - NIST-800-53-AU-14
  - NIST-800-53-AU-2(a)
  - NIST-800-53-AU-7(1)
  - NIST-800-53-AU-7(2)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_audit_installed
</fix>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_audit_installed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
      <check system="http://scap.nist.gov/schema/ocil/2">
        <check-content-ref name="ocil:ssg-package_audit_installed_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
      </check>
    </Rule>
    <Rule id="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="false" role="full" severity="medium">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable auditd Service</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service is an essential userspace component of
the Linux Auditing System, as it is responsible for writing audit records to
disk.

The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be enabled with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo systemctl enable auditd.service</html:pre>
     </description>
      <reference href="https://www.cisecurity.org/controls/">1</reference>
      <reference href="https://www.cisecurity.org/controls/">11</reference>
      <reference href="https://www.cisecurity.org/controls/">12</reference>
      <reference href="https://www.cisecurity.org/controls/">13</reference>
      <reference href="https://www.cisecurity.org/controls/">14</reference>
      <reference href="https://www.cisecurity.org/controls/">15</reference>
      <reference href="https://www.cisecurity.org/controls/">16</reference>
      <reference href="https://www.cisecurity.org/controls/">19</reference>
      <reference href="https://www.cisecurity.org/controls/">2</reference>
      <reference href="https://www.cisecurity.org/controls/">3</reference>
      <reference href="https://www.cisecurity.org/controls/">4</reference>
      <reference href="https://www.cisecurity.org/controls/">5</reference>
      <reference href="https://www.cisecurity.org/controls/">6</reference>
      <reference href="https://www.cisecurity.org/controls/">7</reference>
      <reference href="https://www.cisecurity.org/controls/">8</reference>
      <reference href="https://www.cisecurity.org/controls/">9</reference>
      <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.2</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.6</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
      <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
      <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(g)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-4(23)</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
      <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
      <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.1</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000038-GPOS-00016</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000039-GPOS-00017</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000040-GPOS-00018</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000041-GPOS-00019</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00021</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000051-GPOS-00024</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000054-GPOS-00025</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000122-GPOS-00063</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000255-GPOS-00096</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000337-GPOS-00129</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000348-GPOS-00136</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000349-GPOS-00137</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000350-GPOS-00138</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000351-GPOS-00139</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000352-GPOS-00140</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000353-GPOS-00141</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000354-GPOS-00142</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000358-GPOS-00145</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000365-GPOS-00152</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000475-GPOS-00220</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000095-CTR-000170</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000409-CTR-000990</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000508-CTR-001300</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000510-CTR-001310</reference>
      <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R33</reference>
      <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
      <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.1.4</reference>
      <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">1409</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
      <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without establishing what type of events occurred, it would be difficult
to establish, correlate, and investigate the events leading up to an outage or attack.
Ensuring the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service is active ensures audit records
generated by the kernel are appropriately recorded.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Additionally, a properly configured audit subsystem ensures that actions of
individual system users can be uniquely traced to those users so they
can be held accountable for their actions.</rationale>
      <platform idref="#package_audit"/>
      <requires idref="xccdf_org.ssgproject.content_rule_package_audit_installed"/>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_auditd

class enable_auditd {
  service {'auditd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: auditd.service
        enabled: true
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q audit; }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'auditd.service'
if [[ $("$SYSTEMCTL_EXEC" is-system-running) != "offline" ]]; then
  "$SYSTEMCTL_EXEC" start 'auditd.service'
fi
"$SYSTEMCTL_EXEC" enable 'auditd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:redhat:osbuild:blueprint">
[customizations.services]
enabled = ["auditd"]
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="service_auditd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.2
  - NIST-800-171-3.3.6
  - NIST-800-53-AC-2(g)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-14(1)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(23)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_auditd_enabled

- name: Enable auditd Service - Enable service auditd
  block:

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto

  - name: Enable auditd Service - Enable Service auditd
    ansible.builtin.systemd:
      name: auditd
      enabled: true
      state: started
      masked: false
    when:
    - '"audit" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.3.2
  - NIST-800-171-3.3.6
  - NIST-800-53-AC-2(g)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-14(1)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-AU-3
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SI-4(23)
  - PCI-DSS-Req-10.1
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_auditd_enabled
  - special_service_block
  when:
  - '"kernel" in ansible_facts.packages'
  - '"audit" in ansible_facts.packages'
</fix>
      <check system="http://open-scap.org/page/SCE">
        <check-import import-name="stdout">
            </check-import>
        <check-content-ref href="al2023/checks/sce/service_auditd_enabled.sh"/>
      </check>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-service_auditd_enabled:def:1" href="ssg-al2023-oval.xml"/>
      </check>
      <check system="http://scap.nist.gov/schema/ocil/2">
        <check-content-ref name="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
      </check>
    </Rule>
    <Rule id="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="false" role="full" severity="low">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml">audit=1</html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain audit=1 as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml"># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</html:pre>
     </description>
      <reference href="https://www.cisecurity.org/controls/">1</reference>
      <reference href="https://www.cisecurity.org/controls/">11</reference>
      <reference href="https://www.cisecurity.org/controls/">12</reference>
      <reference href="https://www.cisecurity.org/controls/">13</reference>
      <reference href="https://www.cisecurity.org/controls/">14</reference>
      <reference href="https://www.cisecurity.org/controls/">15</reference>
      <reference href="https://www.cisecurity.org/controls/">16</reference>
      <reference href="https://www.cisecurity.org/controls/">19</reference>
      <reference href="https://www.cisecurity.org/controls/">3</reference>
      <reference href="https://www.cisecurity.org/controls/">4</reference>
      <reference href="https://www.cisecurity.org/controls/">5</reference>
      <reference href="https://www.cisecurity.org/controls/">6</reference>
      <reference href="https://www.cisecurity.org/controls/">7</reference>
      <reference href="https://www.cisecurity.org/controls/">8</reference>
      <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
      <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
      <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
      <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
      <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
      <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
      <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5(1)</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
      <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
      <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1</reference>
      <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.3</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
      <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.1.2</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7.2</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7</reference>
      <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.</rationale>
      <platform idref="#grub2"/>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q grub2-common; }; then

if { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "audit" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"audit=[^\"]*\"(.*]\s*)/\1\"audit=1\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"audit=1\"]" &gt;&gt; "$KARGS_DIR/10-audit.toml"
    fi
else

    grubby --update-kernel=ALL --args=audit=1

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_argument" system="urn:redhat:osbuild:blueprint">[customizations.kernel]
append = "audit=1"
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Check if audit argument is already present in /etc/default/grub
  ansible.builtin.slurp:
    src: /etc/default/grub
  register: etc_default_grub
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Check if audit argument is already present
  ansible.builtin.command: /sbin/grubby --info=ALL
  register: grubby_info
  check_mode: false
  changed_when: false
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args="audit=1"
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - (grubby_info.stdout is not search('audit=1')) or ((etc_default_grub['content']
    | b64decode) is not search('audit=1'))
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-17(1)
  - NIST-800-53-AU-10
  - NIST-800-53-AU-14(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IR-5(1)
  - PCI-DSS-Req-10.3
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</fix>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-grub2_audit_argument:def:1" href="ssg-al2023-oval.xml"/>
      </check>
      <check system="http://scap.nist.gov/schema/ocil/2">
        <check-content-ref name="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
      </check>
    </Rule>
    <Rule id="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="false" role="full" severity="low">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Extend Audit Backlog Limit for the Audit Daemon</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To improve the kernel capacity to queue all log events, even those which occurred
prior to the audit daemon, add the argument <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">audit_backlog_limit=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/>
      </html:code> to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain audit_backlog_limit=<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/> as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit_backlog_limit=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/>"</html:pre>
     </description>
      <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
      <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.1</reference>
      <reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_STG.3</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000341-GPOS-00132</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
      <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
      <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.1.3</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7.2</reference>
      <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.7</reference>
      <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">audit_backlog_limit sets the queue length for audit events awaiting transfer
to the audit daemon. Until the audit daemon is up and running, all log messages
are stored in this queue.  If the queue is overrun during boot process, the action
defined by audit failure flag is taken.</rationale>
      <platform idref="#grub2"/>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_backlog_limit_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel &amp;&amp; { rpm --quiet -q grub2-common; }; then

var_audit_backlog_limit='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/>'



if { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
    KARGS_DIR="/usr/lib/bootc/kargs.d/"
    if grep -q -E "audit_backlog_limit" "$KARGS_DIR/*.toml" ; then
        sed -i -E "s/^(\s*kargs\s*=\s*\[.*)\"audit_backlog_limit=[^\"]*\"(.*]\s*)/\1\"audit_backlog_limit=$var_audit_backlog_limit\"\2/" "$KARGS_DIR/*.toml"
    else
        echo "kargs = [\"audit_backlog_limit=$var_audit_backlog_limit\"]" &gt;&gt; "$KARGS_DIR/10-audit_backlog_limit.toml"
    fi
else

    grubby --update-kernel=ALL --args=audit_backlog_limit=$var_audit_backlog_limit

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_backlog_limit_argument" system="urn:redhat:osbuild:blueprint">[customizations.kernel]
append = "audit_backlog_limit=<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/>"
</fix>
      <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="grub2_audit_backlog_limit_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
- name: XCCDF Value var_audit_backlog_limit # promote to variable
  set_fact:
    var_audit_backlog_limit: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit" use="legacy"/>
  tags:
    - always

- name: Check if audit_backlog_limit argument is already present in /etc/default/grub
  ansible.builtin.slurp:
    src: /etc/default/grub
  register: etc_default_grub
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Check if audit_backlog_limit argument is already present
  ansible.builtin.command: /sbin/grubby --info=ALL
  register: grubby_info
  check_mode: false
  changed_when: false
  failed_when: false
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit={{
    var_audit_backlog_limit }}"
  when:
  - '"kernel" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - (grubby_info.stdout is not search('audit_backlog_limit=' ~ var_audit_backlog_limit))
    or ((etc_default_grub['content'] | b64decode) is not search('audit_backlog_limit='
    ~ var_audit_backlog_limit))
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSSv4-10.7
  - PCI-DSSv4-10.7.2
  - grub2_audit_backlog_limit_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy
</fix>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_audit_backlog_limit:var:1" value-id="xccdf_org.ssgproject.content_value_var_audit_backlog_limit"/>
        <check-content-ref name="oval:ssg-grub2_audit_backlog_limit_argument:def:1" href="ssg-al2023-oval.xml"/>
      </check>
      <check system="http://scap.nist.gov/schema/ocil/2">
        <check-content-ref name="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
      </check>
    </Rule>
    <Group id="xccdf_org.ssgproject.content_group_auditd_configure_rules">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Rules for Comprehensive Auditing</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <html:i xmlns:html="http://www.w3.org/1999/xhtml">linux-audit@redhat.com</html:i> exists
to facilitate community discussion of the auditing system.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
The audit subsystem supports extensive collection of events, including:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</html:li><html:li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</html:li><html:li>Monitoring of specific files for modifications to the file's
contents or metadata.</html:li></html:ul>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Auditing rules at startup are controlled by the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> represents a series of arguments
that can be passed to <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> and can be individually tested
during runtime. See documentation in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/audit-<html:i>VERSION</html:i>
      </html:code> and
in the related man pages for more details.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If copying any example audit rulesets from <html:code xmlns:html="http://www.w3.org/1999/xhtml">/usr/share/doc/audit-VERSION</html:code>,
be sure to comment out the
lines containing <html:code xmlns:html="http://www.w3.org/1999/xhtml">arch=</html:code> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo service auditd restart</html:pre>
     </description>
      <platform idref="#package_audit"/>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Make the auditd Configuration Immutable</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to make the auditd configuration
immutable:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-e 2</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to make the auditd configuration
immutable:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-e 2</html:pre>
With this setting, a reboot will be required to change any audit rules.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.3</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.2</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000119-CTR-000245</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000120-CTR-000250</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.20</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_immutable" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' &gt;&gt; $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' &gt;&gt; $AUDIT_FILE
	echo '-e 2' &gt;&gt; $AUDIT_FILE
	chmod o-rwx $AUDIT_FILE
	chmod g-rwx $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_immutable" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Collect all files from /etc/audit/rules.d
    with .rules extension
  ansible.builtin.find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Check if target files exist and
    get their content
  ansible.builtin.stat:
    path: '{{ item }}'
  register: audit_files_stat
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Read content of existing audit files
  ansible.builtin.slurp:
    src: '{{ item.item }}'
  register: audit_files_content
  loop: '{{ audit_files_stat.results }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - item.stat.exists
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Check if -e 2 is already correctly
    set in target files
  ansible.builtin.set_fact:
    immutable_correctly_set: |-
      {{
        audit_files_content.results
        | selectattr('content', 'defined')
        | map(attribute='content')
        | map('b64decode')
        | select('search', '^-e 2$', multiline=True)
        | list
        | length == 2
      }}
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Remove any existing -e option from
    all Audit config files
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    regexp: ^\s*-e\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Ensure target directories exist
  ansible.builtin.file:
    path: '{{ item | dirname }}'
    state: directory
    mode: '0750'
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Add Audit -e 2 option to make rules
    immutable
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    regexp: ^\s*-e\s+.*$
    mode: g-rwx,o-rwx
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_immutable:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_immutable_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Mandatory Access Controls</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/selinux/ -p wa -k MAC-policy</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/selinux/ -p wa -k MAC-policy</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.14</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's mandatory access policy (SELinux or Apparmor) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/selinux/" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Check if
    watch rule for /etc/selinux/ already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Search
    /etc/audit/rules.d for other rules with specified key MAC-policy
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Use /etc/audit/rules.d/MAC-policy.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/MAC-policy.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Add watch
    rule for /etc/selinux/ in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Check if
    watch rule for /etc/selinux/ already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls - Add watch
    rule for /etc/selinux/ in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_mac_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_mac_modification:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification_usr_share" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Mandatory Access Controls in usr/share</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /usr/share/selinux/ -p wa -k MAC-policy</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /usr/share/selinux/ -p wa -k MAC-policy</html:pre>
      </description>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.14</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification_usr_share" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/usr/share/selinux/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/usr/share/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/usr/share/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /usr/share/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/usr/share/selinux/" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/usr/share/selinux/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/usr/share/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/usr/share/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /usr/share/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_mac_modification_usr_share" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Check if watch rule for /usr/share/selinux/ already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/usr/share/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Search /etc/audit/rules.d for other rules with specified key MAC-policy
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/MAC-policy.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Use matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Add watch rule for /usr/share/selinux/ in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /usr/share/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Check if watch rule for /usr/share/selinux/ already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/usr/share/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Mandatory Access Controls in usr/share
    - Add watch rule for /usr/share/selinux/ in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /usr/share/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - NIST-800-171-3.1.8
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - audit_rules_mac_modification_usr_share
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_mac_modification_usr_share:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_mac_modification_usr_share_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Exporting to Media (successful)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect media exportation
events for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for
32-bit system, or having two lines for both b32 and b64 in case your
system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for
32-bit system, or having two lines for both b32 and b64 in case your
system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.10</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_media_export" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="mount"
	KEY="export"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_media_export" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit mount tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for mount for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/export.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=export
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=export
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for mount for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/export.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=export
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - mount
      syscall_grouping: []

  - name: Check existence of mount in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=export
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_media_export
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_media_export:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Network Environment</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for
32-bit system, or having two lines for both b32 and b64 in case your system
is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification

-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for
32-bit system, or having two lines for both b32 and b64 in case your system
is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.5</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="sethostname setdomainname"
	KEY="audit_rules_networkconfig_modification"
	SYSCALL_GROUPING="sethostname setdomainname"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue.net" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/hosts" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sysconfig/network" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Remediate audit rules for network configuration for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Remediate audit rules for network configuration for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - sethostname
      - setdomainname
      syscall_grouping:
      - sethostname
      - setdomainname

  - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/issue already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_networkconfig_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use matched file
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/issue in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/issue already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/issue in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/issue.net already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_networkconfig_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use matched file
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/issue.net in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/issue.net already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/issue.net in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/hosts already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_networkconfig_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use matched file
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/hosts in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/hosts already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/hosts in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/sysconfig/network already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_networkconfig_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Use matched file
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/sysconfig/network in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Check if watch
    rule for /etc/sysconfig/network already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - Add watch rule
    for /etc/sysconfig/network in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_networkconfig_modification
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_networkconfig_modification:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification_network_scripts" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network-scripts" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network-scripts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network-scripts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification_network_scripts.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sysconfig/network-scripts" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification_network_scripts.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification_network_scripts.rules"
    # If the audit_rules_networkconfig_modification_network_scripts.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sysconfig/network-scripts" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network-scripts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network-scripts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_networkconfig_modification_network_scripts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Check if watch rule for /etc/sysconfig/network-scripts already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network-scripts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification_network_scripts
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification_network_scripts$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Use /etc/audit/rules.d/audit_rules_networkconfig_modification_network_scripts.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_networkconfig_modification_network_scripts.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Use matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Add watch rule for /etc/sysconfig/network-scripts in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Check if watch rule for /etc/sysconfig/network-scripts already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network-scripts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify the System's Network Environment - /etc/sysconfig/network-scripts
    - Add watch rule for /etc/sysconfig/network-scripts in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - audit_rules_networkconfig_modification_network_scripts
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_networkconfig_modification_network_scripts:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_networkconfig_modification_network_scripts_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Process and Session Initiation Information</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects process information for all
users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000505-CTR-001285</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.11</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_session_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/utmp" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/btmp" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/wtmp" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_session_events" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Search
    /etc/audit/rules.d for other rules with specified key session
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    /etc/audit/rules.d/session.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/run/utmp in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/run/utmp in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Search
    /etc/audit/rules.d for other rules with specified key session
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    /etc/audit/rules.d/session.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/log/btmp in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/log/btmp in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Search
    /etc/audit/rules.d for other rules with specified key session
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    /etc/audit/rules.d/session.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/session.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Use
    matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/log/wtmp in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Check
    if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Record Attempts to Alter Process and Session Initiation Information - Add
    watch rule for /var/log/wtmp in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - audit_rules_session_events
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_session_events:def:1" href="ssg-al2023-oval.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events When Executables Are Run As Another User</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify the system generates an audit record when actions are run as another user.
sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user.

If audit is using the "auditctl" tool to load the rules, run the following command:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo grep execve /etc/audit/audit.rules</html:pre>

If audit is using the "augenrules" tool to load the rules, run the following command:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo grep -r execve /etc/audit/rules.d</html:pre>
       <html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S execve -C euid!=uid -F auid!=unset -k user_emulation</html:pre>
       <html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64  S execve -C euid!=uid -F auid!=unset -k user_emulation</html:pre>

If both the "b32" and "b64" audit rules for "SUID" files are not defined, this is a finding.</description>
        <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.</warning>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Creating an audit log of users with temporary elevated privileges and the
operation(s) they performed is essential to reporting. Administrators will
want to correlate the events written to the audit trail with the records
written to sudo's logfile to verify if unauthorized commands have
been executed.
Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have
compromised information system accounts, is a serious and ongoing concern
and can have significant adverse impacts on organizations. Auditing the use
of privileged functions is one way to detect such misuse and identify the
risk from insider threats and the advanced persistent threat.</rationale>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_suid_auid_privilege_function:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_suid_auid_privilege_function_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects System Administrator Actions</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers -p wa -k actions</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers -p wa -k actions</html:pre>






If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers.d/ -p wa -k actions</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/sudoers.d/ -p wa -k actions</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(7)(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5.b</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000026-CTR-000070</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000027-CTR-000075</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000028-CTR-000080</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000291-CTR-000675</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000292-CTR-000680</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000293-CTR-000685</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000294-CTR-000690</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000319-CTR-000745</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000320-CTR-000750</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000509-CTR-001305</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.1</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers.d/" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Check if watch rule
    for /etc/sudoers already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Add watch rule for /etc/sudoers
    in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/sudoers -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Check if watch rule
    for /etc/sudoers already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Search /etc/audit/rules.d
    for other rules with specified key actions
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Use /etc/audit/rules.d/actions.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Use matched file as
    the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Add watch rule for /etc/sudoers
    in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Check if watch rule
    for /etc/sudoers.d/ already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Add watch rule for /etc/sudoers.d/
    in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/sudoers.d/ -p wa -k actions
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Check if watch rule
    for /etc/sudoers.d/ already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Search /etc/audit/rules.d
    for other rules with specified key actions
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)actions$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Use /etc/audit/rules.d/actions.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/actions.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Use matched file as
    the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects System Administrator Actions - Add watch rule for /etc/sudoers.d/
    in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(7)(b)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_sysadmin_actions
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_sysadmin_actions:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/group</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.8</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/group" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/group" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Check if watch
    rule for /etc/group already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_usergroup_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Add watch
    rule for /etc/group in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Check if watch
    rule for /etc/group already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/group - Add watch
    rule for /etc/group in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_group
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_group:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/gshadow</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.8</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/gshadow" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Check if
    watch rule for /etc/gshadow already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_usergroup_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
    rule for /etc/gshadow in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Check if
    watch rule for /etc/gshadow already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
    rule for /etc/gshadow in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_gshadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/security/opasswd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.8</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/security/opasswd" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Check if watch rule for /etc/security/opasswd already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
    for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Use matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Add watch rule for /etc/security/opasswd in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Check if watch rule for /etc/security/opasswd already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/security/opasswd -
    Add watch rule for /etc/security/opasswd in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_opasswd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/passwd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000276-GPOS-00106</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000277-GPOS-00107</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.8</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules"
    # If the audit_rules_usergroup_modification_passwd.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Check if
    watch rule for /etc/passwd already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_usergroup_modification_passwd
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification_passwd$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Use /etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification_passwd.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
    rule for /etc/passwd in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Check if
    watch rule for /etc/passwd already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
    rule for /etc/passwd in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification_passwd
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_passwd
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify User/Group Information - /etc/shadow</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.cisecurity.org/controls/">9</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.4</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.7</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.6</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.8</reference>
        <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.5</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/shadow" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Check if
    watch rule for /etc/shadow already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Search /etc/audit/rules.d
    for other rules with specified key audit_rules_usergroup_modification
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
    rule for /etc/shadow in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Check if
    watch rule for /etc/shadow already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
    rule for /etc/shadow in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.5
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.5
  - audit_rules_usergroup_modification_shadow
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_audit_sudo_log_events" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to perform maintenance activities</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Amazon Linux 2023 operating system must generate audit records for
privileged activities, nonlocal maintenance, diagnostic sessions and
other system-level access.

Verify the operating system audits activities performed during nonlocal
maintenance and diagnostic sessions. Run the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo auditctl -l | grep sudo.log
-w /var/log/sudo.log -p wa -k maintenance</html:pre>





If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/sudo.log -p wa -k maintenance</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/sudo.log -p wa -k maintenance</html:pre>
      </description>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.5.b</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
        <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If events associated with nonlocal administrative access or diagnostic
sessions are not logged, a major tool for assessing and investigating
attacks would not be available.
This requirement addresses auditing-related issues associated with
maintenance tools used specifically for diagnostic and repair actions
on organizational information systems.
Nonlocal maintenance and diagnostic activities are those activities
conducted by individuals communicating through a network, either an
external network (e.g., the internet) or an internal network. Local
maintenance and diagnostic activities are those activities carried
out by individuals physically present at the information system or
information system component and not communicating across a network
connection.
This requirement applies to hardware/software diagnostic test
equipment or tools. This requirement does not cover hardware/software
components that may support information system maintenance, yet are a
part of the system, for example, the software implementing "ping,"
"ls," "ipconfig," or the hardware and software implementing the
monitoring port of an Ethernet switch.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_sudo_log_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/sudo.log" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/sudo.log $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/sudo.log$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/sudo.log -p wa -k maintenance" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/maintenance.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/sudo.log" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/maintenance.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/maintenance.rules"
    # If the maintenance.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/sudo.log" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/sudo.log $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/sudo.log$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/sudo.log -p wa -k maintenance" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_sudo_log_events" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Check if watch rule for
    /var/log/sudo.log already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/sudo.log\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Search /etc/audit/rules.d
    for other rules with specified key maintenance
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)maintenance$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Use /etc/audit/rules.d/maintenance.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/maintenance.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Use matched file as the
    recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Add watch rule for /var/log/sudo.log
    in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/sudo.log -p wa -k maintenance
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Check if watch rule for
    /var/log/sudo.log already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/sudo.log\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to perform maintenance activities - Add watch rule for /var/log/sudo.log
    in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /var/log/sudo.log -p wa -k maintenance
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - PCI-DSS-Req-10.2.2
  - PCI-DSS-Req-10.2.5.b
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_sudo_log_events
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-audit_sudo_log_events:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-audit_sudo_log_events_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Have Mode 0750 or Less Permissive</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
If <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_group</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0750 /var/log/audit</html:pre>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0700 /var/log/audit</html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.4</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If users can write to audit logs, audit trails can be modified or destroyed.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="directory_permissions_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
  DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
else
  DIR="/var/log/audit"
fi


if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0750 $DIR
  else
    chmod 0700 $DIR
  fi
else
  chmod 0700 $DIR
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-directory_permissions_var_log_audit:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_group_ownership_var_log_audit" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Be Group Owned By Root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit logs must be group owned by root user. The path for audit log can
be configured via <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_file</html:code> parameter in <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:pre>
or, by default, the path for audit log is <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/</html:pre>.

To properly set the group owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/*</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chgrp root /var/log/audit/*</html:pre>
  


If <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_group</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> is set to a group other
than the <html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code> group account, change the group ownership of the audit logs
to this specific group.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.2</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_group_ownership_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
  FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
  FILE="/var/log/audit/audit.log"
fi


if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
    if ! [ "${GROUP}" == 'root' ]; then
      chgrp ${GROUP} $FILE*
    else
      chgrp root $FILE*
    fi
else
  chgrp root $FILE*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_group_ownership_var_log_audit:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_group_ownership_var_log_audit_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit Configuration Files Must Be Owned By Group root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit configuration files must be owned by group root.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</html:pre>
      </description>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.7</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_audit_configuration" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
find -P /etc/audit/ -maxdepth 1 -type f  ! -group 0 -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chgrp --no-dereference "$newgroup" {} \;
find -P /etc/audit/rules.d/ -maxdepth 1 -type f  ! -group 0 -regextype posix-extended -regex '^.*\.rules$' -exec chgrp --no-dereference "$newgroup" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_audit_configuration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupownership_audit_configuration_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupownership_audit_configuration_newgroup: '0'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -type f  ! -group 0 -regextype
    posix-extended -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    group: '{{ file_groupownership_audit_configuration_newgroup }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -type f  ! -group
    0 -regextype posix-extended -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    group: '{{ file_groupownership_audit_configuration_newgroup }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupownership_audit_configuration:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit Configuration Files Must Be Owned By Root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit configuration files must be owned by root user.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/audit/ </html:pre>
  


To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d/</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /etc/audit/rules.d/ </html:pre>
      </description>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.6</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_audit_configuration" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else

find -P /etc/audit/ -maxdepth 1 -type f  ! -user 0 -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chown --no-dereference "$newown" {} \;

find -P /etc/audit/rules.d/ -maxdepth 1 -type f  ! -user 0 -regextype posix-extended -regex '^.*\.rules$' -exec chown --no-dereference "$newown" {} \;

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_audit_configuration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_ownership_audit_configuration_newown variable if represented
    by uid
  ansible.builtin.set_fact:
    file_ownership_audit_configuration_newown: '0'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -type f  ! -user 0 -regextype
    posix-extended -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/audit/ file(s) matching ^.*audit(\.rules|d\.conf)$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    owner: '{{ file_ownership_audit_configuration_newown }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -type f  ! -user
    0 -regextype posix-extended -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /etc/audit/rules.d/ file(s) matching ^.*\.rules$
  ansible.builtin.file:
    path: '{{ item }}'
    follow: false
    owner: '{{ file_ownership_audit_configuration_newown }}'
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_ownership_audit_configuration:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_ownership_audit_configuration_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit_stig" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Be Owned By Root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit logs must be owned by root user. The path for audit log can be
configured via <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_file</html:code> parameter in <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:pre>
or by default, the path for audit log is <html:pre xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/</html:pre>.

To properly set the owner of <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/*</html:code>, run the command:

  <html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chown root /var/log/audit/* </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.1</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_var_log_audit_stig" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
    chown root $FILE*
else
    chown root /var/log/audit/audit.log*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_ownership_var_log_audit_stig:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_ownership_var_log_audit_stig_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Audit Configuration Files Permissions are 640 or More Restrictive</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">All audit configuration files permissions must be 640 or more restrictive.
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">chmod 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*</html:pre>
      </description>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12 b</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000063-GPOS-00032</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without the capability to restrict which roles and individuals can
select which events are audited, unauthorized personnel may be able
to prevent the auditing of critical events.
Misconfigured audits may degrade the system's performance by
overwhelming the audit log. Misconfigured audits may also make it more
difficult to establish, correlate, and investigate the events relating
to an incident or identify those responsible for one.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_audit_configuration" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chmod u-xs,g-xws,o-xwrt {} \;

find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regextype posix-extended -regex '^.*\.rules$' -exec chmod u-xs,g-xws,o-xwrt {} \;

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_audit_configuration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/ file(s)
  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type
    f -regextype posix-extended -regex "^.*audit(\.rules|d\.conf)$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/audit/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Find /etc/audit/rules.d/ file(s)
  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type
    f -regextype posix-extended -regex "^.*\.rules$"
  register: files_found
  changed_when: false
  failed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set permissions for /etc/audit/rules.d/ file(s)
  ansible.builtin.file:
    path: '{{ item }}'
    mode: u-xs,g-xws,o-xwrt
    state: file
  with_items:
  - '{{ files_found.stdout_lines }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-12 b
  - configure_strategy
  - file_permissions_audit_configuration
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_audit_configuration:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_audit_configuration_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Audit Logs Must Have Mode 0640 or Less Permissive</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
If <html:code xmlns:html="http://www.w3.org/1999/xhtml">log_group</html:code> in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> is set to a group other than the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0640 <html:i>audit_file</html:i>
       </html:pre>
       <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo chmod 0600 <html:i>audit_file</html:i>
       </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">18</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO01.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS06.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.7.3</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.10.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.7.3.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.8.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.1.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.2.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.9.4.5</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000118-CTR-000240</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If users can write to audit logs, audit trails can be modified or destroyed.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
else
    FILE="/var/log/audit/audit.log"
fi


if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0640 $FILE
    chmod 0440 $FILE.*
  else
    chmod 0600 $FILE
    chmod 0400 $FILE.*
  fi
else
  chmod 0600 $FILE
  chmod 0400 $FILE.*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_var_log_audit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get audit log files
  ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
  failed_when: false
  changed_when: false
  check_mode: false
  register: log_file_exists
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Parse log file line
  ansible.builtin.command: awk -F '=' '/^log_file/ {print $2}' /etc/audit/auditd.conf
  register: log_file_line
  changed_when: false
  check_mode: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - log_file_exists is not skipped and (log_file_exists.stdout | length &gt; 0)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set default log_file if not set
  ansible.builtin.set_fact:
    log_file: /var/log/audit/audit.log
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - (log_file_exists is skipped) or (log_file_exists is undefined) or (log_file_exists.stdout
    | length == 0)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set log_file from log_file_line if not set already
  ansible.builtin.set_fact:
    log_file: '{{ log_file_line.stdout | trim }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - (log_file_exists is not skipped) and (log_file_line.stdout is defined) and (log_file_line.stdout
    | length &gt; 0)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Get log files group
  ansible.builtin.command: grep -m 1 ^log_group /etc/audit/auditd.conf
  failed_when: false
  changed_when: false
  check_mode: false
  register: log_group_line
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Parse log group line
  ansible.builtin.command: awk -F '=' '/log_group/ {print $2}' /etc/audit/auditd.conf
  changed_when: false
  check_mode: false
  register: log_group
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - (log_group_line is not skipped) and (log_group_line.stdout | length &gt; 0)
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Apply mode to log file when group root
  ansible.builtin.file:
    path: '{{ log_file }}'
    mode: (( log_group is defined ) and ( ( log_group.stdout | trim ) == 'root' ))
      | ternary( '0600', '0640')
  failed_when: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - log_group is not skipped
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: List all log file backups
  ansible.builtin.find:
    path: '{{ log_file | dirname }}'
    patterns: '{{ log_file | basename }}.*'
  register: backup_files
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Apply mode to log file when group not root
  ansible.builtin.file:
    path: '{{ item }}'
    mode: (( log_group is defined ) and ( ( log_group.stdout | trim ) == 'root' ))  |
      ternary( '0400', '0440')
  loop: '{{ backup_files.files| map(attribute=''path'') | list }}'
  failed_when: false
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - backup_files is not skipped
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-AU-9(4)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.1
  - file_permissions_var_log_audit
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_var_log_audit:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Group id="xccdf_org.ssgproject.content_group_audit_dac_actions">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod

    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod

    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chmod</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit chmod tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chmod for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chmod for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of chmod in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_chmod:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chown</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit chown tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chown for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for chown for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - chown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of chown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_chown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_chown:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchmod tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmod
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmod in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmod
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmod:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to
use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in
the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmodat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchmodat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchmodat
      syscall_grouping:
      - chmod
      - fchmod
      - fchmodat

  - name: Check existence of fchmodat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchmodat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchown</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchown tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchown for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchown for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchown:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchownat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fchownat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fchownat
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of fchownat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fchownat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fchownat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fremovexattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fremovexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit fsetxattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - fsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of fsetxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_fsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lchown</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lchown tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lchown for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lchown for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lchown
      syscall_grouping:
      - chown
      - fchown
      - fchownat
      - lchown

  - name: Check existence of lchown in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lchown
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_lchown:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lremovexattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lremovexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lremovexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lremovexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit lsetxattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - lsetxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of lsetxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_lsetxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit removexattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - removexattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of removexattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_removexattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_removexattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.5.5</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000091-CTR-000160</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000492-CTR-001220</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000493-CTR-001225</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000494-CTR-001230</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000500-CTR-001260</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000507-CTR-001295</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.9</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3.4</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.3</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit setxattr tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - setxattr
      syscall_grouping:
      - fremovexattr
      - lremovexattr
      - removexattr
      - fsetxattr
      - lsetxattr
      - setxattr

  - name: Check existence of setxattr in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=perm_mod
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.5
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.4
  - audit_rules_dac_modification_setxattr
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_dac_modification_setxattr:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_execution_acl_commands">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Execution Attempts to Run ACL Privileged Commands</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
ACL privileged commands for all users and root.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run chacl</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


At a minimum, the audit system should collect the execution of privileged
commands for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add
a line of the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code>
in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the
following form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.17</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter).</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chacl" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
OTHER_FILTERS="-F path=/usr/bin/chacl"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""


ACTION_ARCH_FILTERS="-a always,exit"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chacl" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_execution_chacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Any Attempts to Run chacl - Perform remediation of Audit rules for
    /usr/bin/chacl
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chacl -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - audit_rules_execution_chacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_execution_chacl:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_execution_chacl_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run setfacl</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


At a minimum, the audit system should collect the execution of privileged
commands for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add
a line of the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code>
in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the
following form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.16</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter).</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_setfacl" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
OTHER_FILTERS="-F path=/usr/bin/setfacl"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""


ACTION_ARCH_FILTERS="-a always,exit"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_setfacl" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_execution_setfacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Any Attempts to Run setfacl - Perform remediation of Audit rules for
    /usr/bin/setfacl
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/setfacl -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - audit_rules_execution_setfacl
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_execution_setfacl:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_execution_setfacl_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Execution Attempts to Run SELinux Privileged Commands</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
SELinux privileged commands for all users and root.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Any Attempts to Run chcon</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


At a minimum, the audit system should collect the execution of privileged
commands for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add
a line of the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code>
in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the
following form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000465-GPOS-00209</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000496-CTR-001240</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000497-CTR-001245</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000498-CTR-001250</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.15</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chcon" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
OTHER_FILTERS="-F path=/usr/bin/chcon"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""


ACTION_ARCH_FILTERS="-a always,exit"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_execution_chcon" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_chcon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Any Attempts to Run chcon - Perform remediation of Audit rules for
    /usr/bin/chcon
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - audit_rules_execution_chcon
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_execution_chcon:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_file_deletion_events">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record File Deletion Events by User</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat,renameat2 -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat,renameat2 -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - rename</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.13</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rename"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat renameat2 rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit rename tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rename for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of rename in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of rename in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for rename for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of rename in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - rename
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of rename in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_rename
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rename:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - renameat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.13</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="renameat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat renameat2 rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit renameat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for renameat for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of renameat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of renameat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for renameat for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of renameat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - renameat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of renameat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_renameat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlink</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.13</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlink"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat renameat2 rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit unlink tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlink for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlink in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlink in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlink for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlink in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlink
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlink in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlink
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlinkat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000501-CTR-001265</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000502-CTR-001270</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.13</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.7</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlinkat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat renameat2 rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit unlinkat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/delete.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - unlinkat
      syscall_grouping:
      - unlink
      - unlinkat
      - rename
      - renameat
      - renameat2
      - rmdir

  - name: Check existence of unlinkat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
        -F auid!=unset -F key=delete
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.7
  - audit_rules_file_deletion_events_unlinkat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_file_modification">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unauthorized Access Attempts Events to Files (unsuccessful)</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - creat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="creat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit creat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - creat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of creat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_creat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - ftruncate</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="ftruncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit ftruncate tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - ftruncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of ftruncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_ftruncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - open</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit open tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - open
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of open in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_open
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - openat</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="openat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit openat tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - openat
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of openat in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_openat
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Unsuccessful Access Attempts to Files - truncate</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
       </description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.1</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.7</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="truncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Set architecture for audit truncate tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/access.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - truncate
      syscall_grouping:
      - creat
      - ftruncate
      - truncate
      - open
      - openat
      - open_by_handle_at

  - name: Check existence of truncate in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
        (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
        -F auid&gt;=1000 -F auid!=unset -F key=access
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.1
  - PCI-DSS-Req-10.2.4
  - audit_rules_unsuccessful_file_modification_truncate
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_kernel_module_loading">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Information on Kernel Modules Loading and Unloading</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,delete_module -F key=modules
</html:pre>

Place to add the lines depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the lines to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_create" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Unloading - create_module</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To capture kernel module loading and unloading events, use the following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S create_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_create" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="create_module"
	KEY="modules"
	SYSCALL_GROUPING="create_module delete_module finit_module init_module query_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_create" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_kernel_module_loading_create
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - create_module
    - Set architecture for audit ['create_module'] tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - audit_rules_kernel_module_loading_create
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - create_module
    - Perform remediation of Audit rules for ['create_module'] for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - create_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of create_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - create_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of create_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - audit_rules_kernel_module_loading_create
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - create_module
    - Perform remediation of Audit rules for ['create_module'] for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - create_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of create_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - create_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of create_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - audit_rules_kernel_module_loading_create
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_create:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_create_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To capture kernel module loading and unloading events, use the following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S delete_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000504-CTR-001280</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="delete_module"
	KEY="modules"
	SYSCALL_GROUPING="create_module delete_module finit_module init_module query_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
    - Set architecture for audit ['delete_module'] tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
    - Perform remediation of Audit rules for ['delete_module'] for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - delete_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of delete_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - delete_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of delete_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
    - Perform remediation of Audit rules for ['delete_module'] for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - delete_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of delete_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - delete_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of delete_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_delete
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To capture kernel module loading and unloading events, use the following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000504-CTR-001280</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="finit_module"
	KEY="modules"
	SYSCALL_GROUPING="create_module delete_module finit_module init_module query_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - finit_module - Set architecture for audit ['finit_module'] tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - finit_module - Perform remediation of Audit rules for ['finit_module'] for 32bit
    platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of finit_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of finit_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - finit_module - Perform remediation of Audit rules for ['finit_module'] for 64bit
    platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of finit_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - finit_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of finit_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_finit
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading - init_module</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To capture kernel module loading and unloading events, use the following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.7</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000504-CTR-001280</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="init_module"
	KEY="modules"
	SYSCALL_GROUPING="create_module delete_module finit_module init_module query_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading - init_module
    - Set architecture for audit ['init_module'] tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading - init_module
    - Perform remediation of Audit rules for ['init_module'] for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of init_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of init_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading - init_module
    - Perform remediation of Audit rules for ['init_module'] for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of init_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - init_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of init_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.7
  - audit_rules_kernel_module_loading_init
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_init:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_query" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">
To capture kernel module loading and unloading events, use the following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=<html:i>ARCH</html:i> -S query_module -F key=modules</html:pre>


Place to add the line depends on a way <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured. If it is configured
to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program (the default), add the line to a file with suffix
<html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility,
add the line to file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>.</description>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</rationale>
          <platform idref="#not_aarch64_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_query" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ); }; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	
	AUID_FILTERS=""
	
	SYSCALL="query_module"
	KEY="modules"
	SYSCALL_GROUPING="create_module delete_module finit_module init_module query_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_kernel_module_loading_query" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_kernel_module_loading_query
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - query_module - Set architecture for audit ['query_module'] tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - audit_rules_kernel_module_loading_query
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - query_module - Perform remediation of Audit rules for ['query_module'] for 32bit
    platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - query_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of query_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - query_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of query_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  tags:
  - audit_rules_kernel_module_loading_query
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
    - query_module - Perform remediation of Audit rules for ['query_module'] for 64bit
    platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - query_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of query_module in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/modules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - query_module
      syscall_grouping:
      - create_module
      - delete_module
      - finit_module
      - init_module
      - query_module

  - name: Check existence of query_module in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=modules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - not ( ansible_architecture == "aarch64" )
  - audit_arch == "b64"
  tags:
  - audit_rules_kernel_module_loading_query
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_query:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_query_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_login_events">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>


If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">-w /var/log/tallylog -p wa -k logins
-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
      </description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events - faillock</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root.




If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">-w <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/> -p wa -k logins</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000506-CTR-001290</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.12</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_faillock" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'


var_accounts_passwords_pam_faillock_dir='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>'





# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+${var_accounts_passwords_pam_faillock_dir}" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir} $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+${var_accounts_passwords_pam_faillock_dir}$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w ${var_accounts_passwords_pam_faillock_dir} -p wa -k logins" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_faillock" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_dir # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_dir: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir" use="legacy"/>
  tags:
    - always

- name: Record Attempts to Alter Logon and Logout Events - faillock - Check if watch
    rule for {{ var_accounts_passwords_pam_faillock_dir }} already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Search /etc/audit/rules.d
    for other rules with specified key logins
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Use matched
    file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Add watch rule
    for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Check if watch
    rule for {{ var_accounts_passwords_pam_faillock_dir }} already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - faillock - Add watch rule
    for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_faillock
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_dir:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir"/>
            <check-content-ref name="oval:ssg-audit_rules_login_events_faillock:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Logon and Logout Events - lastlog</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system already collects login information for all users
and root.




If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/lastlog -p wa -k logins</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /var/log/lastlog -p wa -k logins</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.3</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000503-CTR-001275</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000506-CTR-001290</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.12</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2.1</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.2</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_lastlog" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_login_events_lastlog" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Check if watch
    rule for /var/log/lastlog already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Search /etc/audit/rules.d
    for other rules with specified key logins
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)logins$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Use /etc/audit/rules.d/logins.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/logins.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Use matched file
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Add watch rule
    for /var/log/lastlog in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/lastlog -p wa -k logins
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Check if watch
    rule for /var/log/lastlog already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter Logon and Logout Events - lastlog - Add watch rule
    for /var/log/lastlog in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /var/log/lastlog -p wa -k logins
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.3
  - PCI-DSSv4-10.2
  - PCI-DSSv4-10.2.1
  - PCI-DSSv4-10.2.1.3
  - audit_rules_login_events_lastlog
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_login_events_lastlog:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_privileged_commands">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Information on the Use of Privileged Commands</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system should collect information about usage of privileged commands for all users.
These are commands with suid or sgid bits on and they are specially risky in local block
device partitions not mounted with noexec and nosuid options. Therefore, these partitions
should be first identified by the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv "noexec|nosuid"</html:pre>

For all partitions listed by the previous command, it is necessary to search for
setuid / setgid programs using the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ sudo find <html:i>PARTITION</html:i> -xdev -perm /6000 -type f 2&gt;/dev/null</html:pre>

For each setuid / setgid program identified by the previous command, an audit rule must be
present in the appropriate place using the following line structure, setting ARCH to either b32 for 32-bit
system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=ARCH -F path=<html:i>PROG_PATH</html:i> -F perm=x -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read
audit rules during daemon startup, add the line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> directory, replacing the <html:i xmlns:html="http://www.w3.org/1999/xhtml">PROG_PATH</html:i> part with the full path
of that setuid / setgid identified program.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility instead, add
the line to the <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file, also replacing the <html:i xmlns:html="http://www.w3.org/1999/xhtml">PROG_PATH</html:i> part
with the full path of that setuid / setgid identified program.</description>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">This rule checks for multiple syscalls related to privileged commands. If needed to check
specific privileged commands, other more specific rules should be considered. For example:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>audit_rules_privileged_commands_su</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_umount</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_passwd</html:code></html:li></html:ul>
       </warning>
          <warning xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" category="general">Note that OVAL check and Bash / Ansible remediation of this rule
explicitly excludes file systems mounted at <html:code xmlns:html="http://www.w3.org/1999/xhtml">/proc</html:code> directory
and its subdirectories. It is a virtual file system and it doesn't
contain executable applications. At the same time, interacting with this
file system during check or remediation caused undesirable errors.</warning>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO08.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.5</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.2</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R.1.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.3</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.1</reference>
          <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2.3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-2</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.2.2</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.6</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0846</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by authorized users,
or by unauthorized external entities that have compromised system accounts, is a serious and
ongoing concern that can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify the
risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert
their normal role of providing some necessary but limited capability. As such, motivation
exists to monitor these programs for unusual activity.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

ACTION_ARCH_FILTERS="-a always,exit"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""

function add_audit_rule()
{
    local PRIV_CMD="$1"
    local OTHER_FILTERS="-F path=$PRIV_CMD -F perm=x"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
}

if { rpm --quiet -q kernel rpm-ostree bootc &amp;&amp; ! rpm --quiet -q openshift-kubelet &amp;&amp; { [ -f "/run/.containerenv" ] || [ -f "/.containerenv" ]; }; } ; then
  PRIV_CMDS=$(find / -perm /6000 -type f -not -path "/sysroot/*" 2&gt;/dev/null)
  for PRIV_CMD in $PRIV_CMDS; do
    add_audit_rule $PRIV_CMD
  done
else
  FILTER_NODEV=$(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)
  PARTITIONS=$(findmnt -n -l -k -it "$FILTER_NODEV" | grep -Pv "noexec|nosuid|/proc($|/.*$)" | awk '{ print $1 }')
  for PARTITION in $PARTITIONS; do
    PRIV_CMDS=$(find "${PARTITION}" -xdev -perm /6000 -type f 2&gt;/dev/null)
    for PRIV_CMD in $PRIV_CMDS; do
      add_audit_rule $PRIV_CMD
    done
  done
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Set
    List of Mount Points Which Permits Execution of Privileged Commands
  ansible.builtin.set_fact:
    privileged_mount_points: '{{ (ansible_facts.mounts | rejectattr(''options'', ''search'',
      ''noexec|nosuid'') | rejectattr(''mount'', ''match'', ''/proc($|/.*$)'') | map(attribute=''mount'')
      | list ) }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Search
    for Privileged Commands in Eligible Mount Points
  ansible.builtin.shell:
    cmd: find {{ item }} -xdev -perm /6000 -type f 2&gt;/dev/null
  register: result_privileged_commands_search
  changed_when: false
  failed_when: false
  with_items: '{{ privileged_mount_points }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Set
    List of Privileged Commands Found in Eligible Mount Points
  ansible.builtin.set_fact:
    privileged_commands: '{{ privileged_commands | default([]) + item.stdout_lines
      }}'
  loop: '{{ result_privileged_commands_search.results }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - item is not skipped
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure auditd Collects Information on the Use of Privileged Commands - Privileged
    Commands are Present in the System
  block:

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for All Privileged Commands in augenrules Format
    ansible.builtin.lineinfile:
      path: /etc/audit/rules.d/privileged.rules
      line: -a always,exit -F path={{ item }} -F perm=x -F auid&gt;=1000 -F auid!=unset
        -F key=privileged
      regexp: ^.*path={{ item | regex_escape() }} .*$
      create: true
    with_items:
    - '{{ privileged_commands }}'

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for All Privileged Commands in auditctl Format
    ansible.builtin.lineinfile:
      path: /etc/audit/audit.rules
      line: -a always,exit -F path={{ item }} -F perm=x -F auid&gt;=1000 -F auid!=unset
        -F key=privileged
      regexp: ^.*path={{ item | regex_escape() }} .*$
      create: true
    with_items:
    - '{{ privileged_commands }}'

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Search
      for Duplicated Rules in Other Files
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      recurse: false
      contains: ^-a always,exit -F path={{ item }} .*$
      patterns: '*.rules'
    with_items:
    - '{{ privileged_commands }}'
    register: result_augenrules_files

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - Ensure
      Rules for Privileged Commands are Defined Only in One File
    ansible.builtin.lineinfile:
      path: '{{ item.1.path }}'
      regexp: ^-a always,exit -F path={{ item.0.item }} .*$
      state: absent
    with_subelements:
    - '{{ result_augenrules_files.results }}'
    - files
    when:
    - item.1.path != '/etc/audit/rules.d/privileged.rules'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - privileged_commands is defined
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-2(4)
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.2.2
  - audit_rules_privileged_commands
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_privileged_commands:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - kmod</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


At a minimum, the audit system should collect the execution of privileged
commands for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add
a line of the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code>
in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the
following form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </description>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-3.1</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(a)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(ii)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12.1(iv)AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(1)(a)</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000504-CTR-001280</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.19</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.

Audit records can be generated from various components within the
information system (e.g., module or policy filter).</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_kmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
OTHER_FILTERS="-F path=/usr/bin/kmod"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""


ACTION_ARCH_FILTERS="-a always,exit"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_kmod" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)AU-12(c)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_kmod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
    - Perform remediation of Audit rules for /usr/bin/kmod
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/kmod -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset (?:-k |-F
        key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F auid&gt;=1000
        -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-12(a)
  - NIST-800-53-AU-12.1(ii)
  - NIST-800-53-AU-12.1(iv)AU-12(c)
  - NIST-800-53-AU-3
  - NIST-800-53-AU-3.1
  - NIST-800-53-MA-4(1)(a)
  - audit_rules_privileged_commands_kmod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_privileged_commands_kmod:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_kmod_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands - usermod</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">


At a minimum, the audit system should collect the execution of privileged
commands for all users and root.

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add
a line of the following form to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code>
in the directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the
following form to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
       </description>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000495-CTR-001235</reference>
          <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security">SRG-APP-000499-CTR-001255</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.18</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
        <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_usermod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
OTHER_FILTERS="-F path=/usr/sbin/usermod"
AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING=""


ACTION_ARCH_FILTERS="-a always,exit"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_privileged_commands_usermod" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_privileged_commands_usermod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
    - Perform remediation of Audit rules for /usr/sbin/usermod
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/privileged.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usermod -F auid&gt;=1000
        -F auid!=unset (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
        auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls: []
      syscall_grouping: []

  - name: Check existence of  in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)* -F
        path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:(
        -S |,)\w+)+)( -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset (?:-k
        |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
        auid&gt;=1000 -F auid!=unset -F key=privileged
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - audit_rules_privileged_commands_usermod
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_privileged_commands_usermod:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_privileged_commands_usermod_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
      <Group id="xccdf_org.ssgproject.content_group_audit_time_rules">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Records Events that Modify Date and Time Information</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</description>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record attempts to alter time through adjtimex</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday

  - name: Check existence of adjtimex in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - adjtimex
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of adjtimex in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_adjtimex
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_time_adjtimex:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Time Through clock_settime</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a0=0x0"
	AUID_FILTERS=""
	SYSCALL="clock_settime"
	KEY="time-change"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0600 "$file_to_inspect"
    fi
fi

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	unset syscall_a
unset syscall_grouping
unset syscall_string
unset syscall
unset file_to_edit
unset rule_to_edit
unset rule_syscalls_to_edit
unset other_string
unset auid_string
unset full_rule

# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                   # A syscall was not found in the candidate rule
                   all_syscalls_found=1
                   }
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [ "${#candidate_rules[@]}" -gt 0 ]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [ "${#syscall_a[@]}" -gt 0 ]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod 0600 ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
               # A syscall was not found in the candidate rule
               new_grouped_syscalls+="${delimiter}${syscall}"
               }
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  ansible.builtin.set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - clock_settime
      syscall_grouping: []

  - name: Check existence of clock_settime in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
        key=time-change
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_clock_settime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_time_clock_settime:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record attempts to alter time through settimeofday</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b64
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for 32bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for 64bit platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - settimeofday
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of settimeofday in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - audit_arch == "b64"
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_settimeofday
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_time_settimeofday:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter Time Through stime</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code> for both 32 bit and 64 bit systems:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code> utility to
read audit rules during daemon startup, add the following line to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code> file for both 32 bit and 64 bit systems:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
          <platform idref="#not_aarch64_arch_and_not_s390x_arch"/>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_stime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel &amp;&amp; { ( ! ( ( grep -sqE "^.*\.aarch64$" /proc/sys/kernel/osrelease || grep -sqE "^aarch64$" /proc/sys/kernel/arch; ) ) &amp;&amp; ! ( ( grep -sqE "^.*\.s390x$" /proc/sys/kernel/osrelease || grep -sqE "^s390x$" /proc/sys/kernel/arch; ) ) ); }; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/^$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0600 "$file_to_inspect"
        fi
    fi

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    unset syscall_a
    unset syscall_grouping
    unset syscall_string
    unset syscall
    unset file_to_edit
    unset rule_to_edit
    unset rule_syscalls_to_edit
    unset other_string
    unset auid_string
    unset full_rule

    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    #
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/^$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/^$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields" || candidate_rules+=("$s_rule")
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls" || {
                       # A syscall was not found in the candidate rule
                       all_syscalls_found=1
                       }
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [ "${#candidate_rules[@]}" -gt 0 ]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [ "${#syscall_a[@]}" -gt 0 ]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS") || /bin/true
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS") || /bin/true
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY" || /bin/true
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod 0600 ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}" || {
                   # A syscall was not found in the candidate rule
                   new_grouped_syscalls+="${delimiter}${syscall}"
                   }
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_stime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_stime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - stime
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of stime in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: '*.rules'
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Reset syscalls found per file
    ansible.builtin.set_fact:
      syscalls_per_file: {}
      found_paths_dict: {}

  - name: Declare syscalls found per file
    ansible.builtin.set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
      :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
    loop: '{{ find_command.results | selectattr(''matched'') | list }}'

  - name: Declare files where syscalls were found
    ansible.builtin.set_fact: found_paths="{{ find_command.results | map(attribute='files')
      | flatten | map(attribute='path') | list }}"

  - name: Count occurrences of syscalls in paths
    ansible.builtin.set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
      0) }) }}"
    loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
      | list }}'

  - name: Get path with most syscalls
    ansible.builtin.set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
      | last).key }}"
    when: found_paths | length &gt;= 1

  - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
    when: found_paths | length == 0

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
        | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0

  - name: Declare list of syscalls
    ansible.builtin.set_fact:
      syscalls:
      - stime
      syscall_grouping:
      - adjtimex
      - settimeofday
      - stime

  - name: Check existence of stime in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit
      contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+(( -S
        |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
      patterns: audit.rules
    register: find_command
    loop: '{{ (syscall_grouping + syscalls) | unique }}'

  - name: Set path to /etc/audit/audit.rules
    ansible.builtin.set_fact: audit_file="/etc/audit/audit.rules"

  - name: Declare found syscalls
    ansible.builtin.set_fact: syscalls_found="{{ find_command.results | selectattr('matched')
      | map(attribute='item') | list }}"

  - name: Declare missing syscalls
    ansible.builtin.set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found)
      }}"

  - name: Replace the audit rule in {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found |
        join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
      line: \1\2\3{{ missing_syscalls | join("\3") }}\4
      backrefs: true
      state: present
      mode: g-rwx,o-rwx
    when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

  - name: Add the audit rule to {{ audit_file }}
    ansible.builtin.lineinfile:
      path: '{{ audit_file }}'
      line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
      create: true
      mode: g-rwx,o-rwx
      state: present
    when: syscalls_found | length == 0
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - ( not ( ansible_architecture == "aarch64" ) and not ( ansible_architecture ==
    "s390x" ) )
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_stime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_time_stime:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
        <Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="false" role="full" severity="medium">
          <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Record Attempts to Alter the localtime File</title>
          <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">



If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following lines to a file with suffix <html:code xmlns:html="http://www.w3.org/1999/xhtml">.rules</html:code> in the
directory <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/rules.d</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/localtime -p wa -k audit_time_rules</html:pre>

If the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> daemon is configured to use the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/audit.rules</html:code>:

<html:pre xmlns:html="http://www.w3.org/1999/xhtml">-w /etc/localtime -p wa -k audit_time_rules</html:pre>
       </description>
          <reference href="https://www.cisecurity.org/controls/">1</reference>
          <reference href="https://www.cisecurity.org/controls/">11</reference>
          <reference href="https://www.cisecurity.org/controls/">12</reference>
          <reference href="https://www.cisecurity.org/controls/">13</reference>
          <reference href="https://www.cisecurity.org/controls/">14</reference>
          <reference href="https://www.cisecurity.org/controls/">15</reference>
          <reference href="https://www.cisecurity.org/controls/">16</reference>
          <reference href="https://www.cisecurity.org/controls/">19</reference>
          <reference href="https://www.cisecurity.org/controls/">2</reference>
          <reference href="https://www.cisecurity.org/controls/">3</reference>
          <reference href="https://www.cisecurity.org/controls/">4</reference>
          <reference href="https://www.cisecurity.org/controls/">5</reference>
          <reference href="https://www.cisecurity.org/controls/">6</reference>
          <reference href="https://www.cisecurity.org/controls/">7</reference>
          <reference href="https://www.cisecurity.org/controls/">8</reference>
          <reference href="https://www.cisecurity.org/controls/">9</reference>
          <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO10.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
          <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS03.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.01</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.02</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.03</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.04</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA01.05</reference>
          <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</reference>
          <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.2.6.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.6.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
          <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 1.13</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.6</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.5</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 3.8</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 4.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 5.3</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.2</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
          <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.11.2.6</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.1.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.13.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.1.3</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.14.2.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.15.2.2</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.1</reference>
          <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.6.2.2</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</reference>
          <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
          <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
          <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.4.2.b</reference>
          <reference href="https://cyber.gouv.fr/sites/default/files/document/linux_configuration-en-v2.pdf">R73</reference>
          <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.3.4</reference>
          <reference href="https://www.cyber.gov.au/acsc/view-all-content/ism">0582</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6.3</reference>
          <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.6</reference>
          <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</rationale>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'






# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"

    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_time_rules.rules' to list of files for inspection.

readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/localtime" /etc/audit/rules.d/*.rules)


# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_time_rules.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_time_rules.rules"
    # If the audit_time_rules.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0600 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present

    if grep -q -P -- "^[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"

    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule

        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")

        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule

        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"

    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key


        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"

    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
          <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Check if watch rule for /etc/localtime
    already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Search /etc/audit/rules.d for
    other rules with specified key audit_time_rules
  ansible.builtin.find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Use /etc/audit/rules.d/audit_time_rules.rules
    as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
    - /etc/audit/rules.d/audit_time_rules.rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Use matched file as the recipient
    for the rule
  ansible.builtin.set_fact:
    all_files:
    - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
    is defined and find_existing_watch_rules_d.matched == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Add watch rule for /etc/localtime
    in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Check if watch rule for /etc/localtime
    already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Record Attempts to Alter the localtime File - Add watch rule for /etc/localtime
    in /etc/audit/audit.rules
  ansible.builtin.lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0600'
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
    == 0
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.1.7
  - NIST-800-53-AC-6(9)
  - NIST-800-53-AU-12(c)
  - NIST-800-53-AU-2(d)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4.2.b
  - PCI-DSSv4-10.6
  - PCI-DSSv4-10.6.3
  - audit_rules_time_watch_localtime
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
          <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
            <check-content-ref name="oval:ssg-audit_rules_time_watch_localtime:def:1" href="ssg-al2023-oval.xml"/>
          </check>
          <check system="http://scap.nist.gov/schema/ocil/2">
            <check-content-ref name="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
          </check>
        </Rule>
      </Group>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_configure_auditd_data_retention">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Data Retention</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit system writes data to <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit/audit.log</html:code>. By default,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
      <html:br xmlns:html="http://www.w3.org/1999/xhtml"/>
Using a dedicated partition for <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var/log/audit</html:code> prevents the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/var</html:code> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> can be configured to halt the machine
if it runs out of space. <html:b xmlns:html="http://www.w3.org/1999/xhtml">Note:</html:b> Since older logs are rotated,
configuring <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> this way does not prevent older logs from being
rotated away before they can be viewed.

<html:i xmlns:html="http://www.w3.org/1999/xhtml">If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<html:code>/var/log/audit</html:code> is on its own partition, and that this partition is
larger than the maximum amount of data <html:code>auditd</html:code> will retain
normally.</html:i>
     </description>
      <platform idref="#package_audit"/>
      <Value id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Account for auditd to send email when actions occurs</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for action_mail_acct in /etc/audit/auditd.conf</description>
        <value selector="admin">admin</value>
        <value>root</value>
        <value selector="root">root</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk space is low</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for admin_space_left_action in /etc/audit/auditd.conf</description>
        <value>single</value>
        <value selector="email">email</value>
        <value selector="exec">exec</value>
        <value selector="halt">halt</value>
        <value selector="single">single</value>
        <value selector="suspend">suspend</value>
        <value selector="syslog">syslog</value>
        <value selector="rotate">rotate</value>
        <value selector="ignore">ignore</value>
        <value selector="cis_rhel8">single|halt</value>
        <value selector="cis_rhel9">single|halt</value>
        <value selector="cis_rhel10">single|halt</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" type="number">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Maximum audit log file size for auditd</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for max_log_file in /etc/audit/auditd.conf</description>
        <value selector="1">1</value>
        <value selector="10">10</value>
        <value selector="20">20</value>
        <value selector="5">5</value>
        <value selector="6">6</value>
        <value selector="8">8</value>
        <value>6</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when log files reach their maximum size</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for max_log_file_action in /etc/audit/auditd.conf. The following options are available:
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>ignore - audit daemon does nothing.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>syslog - audit daemon will issue a warning to syslog.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>suspend - audit daemon will stop writing records to the disk.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>rotate - audit daemon will rotate logs in the same convention used by logrotate.
<html:br xmlns:html="http://www.w3.org/1999/xhtml"/>keep_logs - similar to rotate but prevents audit logs to be overwritten. May trigger space_left_action if volume is full.</description>
        <value>rotate</value>
        <value selector="keep_logs">keep_logs</value>
        <value selector="rotate">rotate</value>
        <value selector="suspend">suspend</value>
        <value selector="syslog">syslog</value>
        <value selector="ignore">ignore</value>
      </Value>
      <Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" type="string">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Action for auditd to take when disk space just starts to run low</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The setting for space_left_action in /etc/audit/auditd.conf</description>
        <value>email</value>
        <value selector="email">email</value>
        <value selector="exec">exec</value>
        <value selector="halt">halt</value>
        <value selector="single">single</value>
        <value selector="suspend">suspend</value>
        <value selector="syslog">syslog</value>
        <value selector="rotate">rotate</value>
        <value selector="ignore">ignore</value>
        <value selector="cis_rhel8">email|exec|single|halt</value>
        <value selector="cis_rhel9">email|exec|single|halt</value>
        <value selector="cis_rhel10">email|exec|single|halt</value>
      </Value>
      <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd mail_acct Action on Low Disk Space</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code> to ensure that administrators are notified
via email for those situations:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2">action_mail_acct = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
       </html:pre>
      </description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R1.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.1.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-003-8 R5.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.1.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7.a</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.2.3</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

var_auditd_action_mail_acct='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^action_mail_acct")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_action_mail_acct"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^action_mail_acct\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^action_mail_acct\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)
  - PCI-DSS-Req-10.7.a
  - auditd_data_retention_action_mail_acct
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space - Configure auditd mail_acct
    Action on Low Disk Space
  ansible.builtin.lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^action_mail_acct
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-5(1)
  - PCI-DSS-Req-10.7.a
  - auditd_data_retention_action_mail_acct
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
          <check-content-ref name="oval:ssg-auditd_data_retention_action_mail_acct:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd admin_space_left Action on Low Disk Space</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">admin_space_left_action = <html:i>ACTION</html:i>
       </html:pre>
Set this value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code> and
<html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the
<html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.2.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

var_auditd_admin_space_left_action='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>'


var_auditd_admin_space_left_action="$(echo $var_auditd_admin_space_left_action | cut -d \| -f 1)"

AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^admin_space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_admin_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^admin_space_left_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^admin_space_left_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_admin_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  ansible.builtin.lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action .split('|')[0]
      }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_admin_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
          <check-content-ref name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd Max Log File Size</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Determine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
<html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Add or modify the following line, substituting
the correct value of <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/> for <html:i xmlns:html="http://www.w3.org/1999/xhtml">STOREMB</html:i>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">max_log_file = <html:i>STOREMB</html:i>
       </html:pre>
Set the value to <html:code xmlns:html="http://www.w3.org/1999/xhtml">6</html:code> (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R2.2.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-004-6 R3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.1</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.2</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R5.3.3</reference>
        <reference href="https://www.nerc.com/standards/reliability-standards/cip">CIP-007-3 R6.5</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.2.1</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

var_auditd_max_log_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^max_log_file\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-11
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file # promote to variable
  set_fact:
    var_auditd_max_log_file: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>
  tags:
    - always

- name: Configure auditd Max Log File Size
  ansible.builtin.lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*max_log_file\s*=\s*.*$
    line: max_log_file = {{ var_auditd_max_log_file }}
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-11
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_auditd_max_log_file:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file"/>
          <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code>, add or correct the line in <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">max_log_file_action = <html:i>ACTION</html:i>
       </html:pre>
Possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man
page. These include:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>ignore</html:code></html:li><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code xmlns:html="http://www.w3.org/1999/xhtml"><html:i>ACTION</html:i></html:code> to <html:code xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/></html:code>.
The setting is case-insensitive.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.2.2</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Automatically rotating logs (by setting this to <html:code xmlns:html="http://www.w3.org/1999/xhtml">rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code xmlns:html="http://www.w3.org/1999/xhtml">keep_logs</html:code> can be employed.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

var_auditd_max_log_file_action='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>'


AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^max_log_file_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  ansible.builtin.lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - auditd_data_retention_max_log_file_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
          <check-content-ref name="oval:ssg-auditd_data_retention_max_log_file_action:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Configure auditd space_left Action on Low Disk Space</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd</html:code> service can be configured to take an action
when disk space <html:i xmlns:html="http://www.w3.org/1999/xhtml">starts</html:i> to run low.
Edit the file <html:code xmlns:html="http://www.w3.org/1999/xhtml">/etc/audit/auditd.conf</html:code>. Modify the following line,
substituting <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> appropriately:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">space_left_action = <html:i>ACTION</html:i>
       </html:pre>
Possible values for <html:i xmlns:html="http://www.w3.org/1999/xhtml">ACTION</html:i> are described in the <html:code xmlns:html="http://www.w3.org/1999/xhtml">auditd.conf</html:code> man page.
These include:
<html:ul xmlns:html="http://www.w3.org/1999/xhtml"><html:li><html:code>syslog</html:code></html:li><html:li><html:code>email</html:code></html:li><html:li><html:code>exec</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>single</html:code></html:li><html:li><html:code>halt</html:code></html:li></html:ul>
Set this to <html:code xmlns:html="http://www.w3.org/1999/xhtml">email</html:code> (instead of the default,
which is <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code>) as it is more likely to get prompt attention. Acceptable values
also include <html:code xmlns:html="http://www.w3.org/1999/xhtml">suspend</html:code>, <html:code xmlns:html="http://www.w3.org/1999/xhtml">single</html:code>, and <html:code xmlns:html="http://www.w3.org/1999/xhtml">halt</html:code>.</description>
        <reference href="https://www.cisecurity.org/controls/">1</reference>
        <reference href="https://www.cisecurity.org/controls/">11</reference>
        <reference href="https://www.cisecurity.org/controls/">12</reference>
        <reference href="https://www.cisecurity.org/controls/">13</reference>
        <reference href="https://www.cisecurity.org/controls/">14</reference>
        <reference href="https://www.cisecurity.org/controls/">15</reference>
        <reference href="https://www.cisecurity.org/controls/">16</reference>
        <reference href="https://www.cisecurity.org/controls/">19</reference>
        <reference href="https://www.cisecurity.org/controls/">2</reference>
        <reference href="https://www.cisecurity.org/controls/">3</reference>
        <reference href="https://www.cisecurity.org/controls/">4</reference>
        <reference href="https://www.cisecurity.org/controls/">5</reference>
        <reference href="https://www.cisecurity.org/controls/">6</reference>
        <reference href="https://www.cisecurity.org/controls/">7</reference>
        <reference href="https://www.cisecurity.org/controls/">8</reference>
        <reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO11.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO12.06</reference>
        <reference href="https://www.isaca.org/resources/cobit">APO13.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI03.05</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI04.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">BAI08.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.02</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS02.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS03.01</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.04</reference>
        <reference href="https://www.isaca.org/resources/cobit">DSS05.07</reference>
        <reference href="https://www.isaca.org/resources/cobit">MEA02.01</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</reference>
        <reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.2.3.10</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.3.9</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.3.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.4.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.6</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.7</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.3.4.5.8</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.1</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.2</reference>
        <reference href="https://www.isa.org/products/isa-62443-2-1-2009-security-for-industrial-automat">4.4.2.4</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.10</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.11</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.12</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.8</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 2.9</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 6.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.1</reference>
        <reference href="https://www.isa.org/products/ansi-isa-62443-3-3-99-03-03-2013-security-for-indu">SR 7.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.1.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.2</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.3</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.4.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.12.7.1</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.4</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.5</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.16.1.7</reference>
        <reference href="https://www.iso.org/contents/data/standard/05/45/54534.html">A.17.2.1</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</reference>
        <reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</reference>
        <reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</reference>
        <reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf">Req-10.7</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.2.3</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5.1</reference>
        <reference href="https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0.pdf">10.5</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit &amp;&amp; rpm --quiet -q kernel; then

var_auditd_space_left_action='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>'


var_auditd_space_left_action="$(echo $var_auditd_space_left_action | cut -d \| -f 1)"
#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^space_left_action\\&gt;" "$AUDITCONFIG"; then
    escaped_formatted_output=$(sed -e 's|/|\\/|g' &lt;&lt;&lt; "$formatted_output")
    LC_ALL=C sed -i --follow-symlinks "s/^space_left_action\\&gt;.*/$escaped_formatted_output/gi" "$AUDITCONFIG"
else
    if [[ -s "$AUDITCONFIG" ]] &amp;&amp; [[ -n "$(tail -c 1 -- "$AUDITCONFIG" || true)" ]]; then
        LC_ALL=C sed -i --follow-symlinks '$a'\\ "$AUDITCONFIG"
    fi
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  ansible.builtin.lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action.split('|')[0] }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when:
  - '"audit" in ansible_facts.packages'
  - '"kernel" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-53-AU-5(1)
  - NIST-800-53-AU-5(2)
  - NIST-800-53-AU-5(4)
  - NIST-800-53-AU-5(b)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.7
  - PCI-DSSv4-10.5
  - PCI-DSSv4-10.5.1
  - auditd_data_retention_space_left_action
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
          <check-content-ref name="oval:ssg-auditd_data_retention_space_left_action:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
    </Group>
    <Group id="xccdf_org.ssgproject.content_group_file_permissions_auditd">
      <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">System Accounting with auditd</title>
      <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The audit service provides substantial capabilities
for recording system activities. This section
deals with permissions of auditd related files.</description>
      <Rule id="xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that audit tools are owned by group root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Amazon Linux 2023 operating system audit tools must have the proper
ownership configured to protected against unauthorized access.

Verify it by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ stat -c "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules

/sbin/auditctl root

/sbin/aureport root

/sbin/ausearch root

/sbin/autrace root

/sbin/auditd root

/sbin/audispd root

/sbin/augenrules root

</html:pre>

Audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators</description>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.10</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protecting audit information also includes identifying and protecting the
tools used to view and manipulate log data. Therefore, protecting audit
tools is necessary to prevent unauthorized operation on audit information.

Operating systems providing tools to interface with audit information
will leverage user permissions and roles identifying the user accessing the
tools and the corresponding rights the user enjoys to make access decisions
regarding the access to audit tools.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_audit_binaries" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newgroup=""
if getent group "0" &gt;/dev/null 2&gt;&amp;1; then
  newgroup="0"
fi

if [[ -z "${newgroup}" ]]; then
  &gt;&amp;2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/sbin/auditctl" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/auditctl
fi
if ! stat -c "%g %G" "/sbin/aureport" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/aureport
fi
if ! stat -c "%g %G" "/sbin/ausearch" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/ausearch
fi
if ! stat -c "%g %G" "/sbin/autrace" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/autrace
fi
if ! stat -c "%g %G" "/sbin/auditd" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/auditd
fi
if ! stat -c "%g %G" "/sbin/audispd" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/audispd
fi
if ! stat -c "%g %G" "/sbin/augenrules" | grep -E -w -q "0"; then
    chgrp --no-dereference "$newgroup" /sbin/augenrules
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_groupownership_audit_binaries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_groupownership_audit_binaries_newgroup variable if represented
    by gid
  ansible.builtin.set_fact:
    file_groupownership_audit_binaries_newgroup: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  ansible.builtin.stat:
    path: /sbin/auditctl
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/auditctl
  ansible.builtin.file:
    path: /sbin/auditctl
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  ansible.builtin.stat:
    path: /sbin/aureport
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/aureport
  ansible.builtin.file:
    path: /sbin/aureport
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  ansible.builtin.stat:
    path: /sbin/ausearch
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/ausearch
  ansible.builtin.file:
    path: /sbin/ausearch
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  ansible.builtin.stat:
    path: /sbin/autrace
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/autrace
  ansible.builtin.file:
    path: /sbin/autrace
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  ansible.builtin.stat:
    path: /sbin/auditd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/auditd
  ansible.builtin.file:
    path: /sbin/auditd
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/audispd
  ansible.builtin.stat:
    path: /sbin/audispd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/audispd
  ansible.builtin.file:
    path: /sbin/audispd
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  ansible.builtin.stat:
    path: /sbin/augenrules
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure group owner on /sbin/augenrules
  ansible.builtin.file:
    path: /sbin/augenrules
    follow: false
    group: '{{ file_groupownership_audit_binaries_newgroup }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_groupownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_groupownership_audit_binaries:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_groupownership_audit_binaries_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that audit tools are owned by root</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Amazon Linux 2023 operating system audit tools must have the proper
ownership configured to protected against unauthorized access.

Verify it by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ stat -c "%n %U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules

/sbin/auditctl root

/sbin/aureport root

/sbin/ausearch root

/sbin/autrace root

/sbin/auditd root

/sbin/audispd root

/sbin/augenrules root

</html:pre>

Audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators</description>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.9</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protecting audit information also includes identifying and protecting the
tools used to view and manipulate log data. Therefore, protecting audit
tools is necessary to prevent unauthorized operation on audit information.

Operating systems providing tools to interface with audit information
will leverage user permissions and roles identifying the user accessing the
tools and the corresponding rights the user enjoys to make access decisions
regarding the access to audit tools.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_audit_binaries" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

newown=""
if id "0" &gt;/dev/null 2&gt;&amp;1; then
  newown="0"
fi

if [[ -z "$newown" ]]; then
  &gt;&amp;2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/sbin/auditctl" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/auditctl
fi
if ! stat -c "%u %U" "/sbin/aureport" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/aureport
fi
if ! stat -c "%u %U" "/sbin/ausearch" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/ausearch
fi
if ! stat -c "%u %U" "/sbin/autrace" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/autrace
fi
if ! stat -c "%u %U" "/sbin/auditd" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/auditd
fi
if ! stat -c "%u %U" "/sbin/audispd" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/audispd
fi
if ! stat -c "%u %U" "/sbin/augenrules" | grep -E -w -q "0"; then
    chown --no-dereference "$newown" /sbin/augenrules
fi

fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_ownership_audit_binaries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Set the file_ownership_audit_binaries_newown variable if represented by uid
  ansible.builtin.set_fact:
    file_ownership_audit_binaries_newown: '0'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  ansible.builtin.stat:
    path: /sbin/auditctl
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/auditctl
  ansible.builtin.file:
    path: /sbin/auditctl
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  ansible.builtin.stat:
    path: /sbin/aureport
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/aureport
  ansible.builtin.file:
    path: /sbin/aureport
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  ansible.builtin.stat:
    path: /sbin/ausearch
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/ausearch
  ansible.builtin.file:
    path: /sbin/ausearch
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  ansible.builtin.stat:
    path: /sbin/autrace
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/autrace
  ansible.builtin.file:
    path: /sbin/autrace
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  ansible.builtin.stat:
    path: /sbin/auditd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/auditd
  ansible.builtin.file:
    path: /sbin/auditd
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/audispd
  ansible.builtin.stat:
    path: /sbin/audispd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/audispd
  ansible.builtin.file:
    path: /sbin/audispd
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  ansible.builtin.stat:
    path: /sbin/augenrules
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure owner on /sbin/augenrules
  ansible.builtin.file:
    path: /sbin/augenrules
    follow: false
    owner: '{{ file_ownership_audit_binaries_newown }}'
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_ownership_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_ownership_audit_binaries:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_ownership_audit_binaries_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
      <Rule id="xccdf_org.ssgproject.content_rule_file_permissions_audit_binaries" selected="false" role="full" severity="medium">
        <title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Verify that audit tools Have Mode 0755 or less</title>
        <description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">The Amazon Linux 2023 operating system audit tools must have the proper
permissions configured to protected against unauthorized access.

Verify it by running the following command:
<html:pre xmlns:html="http://www.w3.org/1999/xhtml">$ stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/audispd /sbin/augenrules

/sbin/auditctl 755

/sbin/aureport 755

/sbin/ausearch 755

/sbin/autrace 755

/sbin/auditd 755

/sbin/audispd 755

/sbin/augenrules 755

</html:pre>

Audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators</description>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</reference>
        <reference href="https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</reference>
        <reference href="https://www.cisecurity.org/benchmark/amazon_linux/">5.2.4.8</reference>
        <rationale xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US">Protecting audit information also includes identifying and protecting the
tools used to view and manipulate log data. Therefore, protecting audit
tools is necessary to prevent unauthorized operation on audit information.

Operating systems providing tools to interface with audit information
will leverage user permissions and roles identifying the user accessing the
tools and the corresponding rights the user enjoys to make access decisions
regarding the access to audit tools.</rationale>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_audit_binaries" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

chmod u-s,g-ws,o-wt /sbin/auditctl

chmod u-s,g-ws,o-wt /sbin/aureport

chmod u-s,g-ws,o-wt /sbin/ausearch

chmod u-s,g-ws,o-wt /sbin/autrace

chmod u-s,g-ws,o-wt /sbin/auditd

chmod u-s,g-ws,o-wt /sbin/audispd

chmod u-s,g-ws,o-wt /sbin/augenrules

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</fix>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" id="file_permissions_audit_binaries" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditctl
  ansible.builtin.stat:
    path: /sbin/auditctl
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/auditctl
  ansible.builtin.file:
    path: /sbin/auditctl
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/aureport
  ansible.builtin.stat:
    path: /sbin/aureport
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/aureport
  ansible.builtin.file:
    path: /sbin/aureport
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/ausearch
  ansible.builtin.stat:
    path: /sbin/ausearch
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/ausearch
  ansible.builtin.file:
    path: /sbin/ausearch
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/autrace
  ansible.builtin.stat:
    path: /sbin/autrace
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/autrace
  ansible.builtin.file:
    path: /sbin/autrace
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/auditd
  ansible.builtin.stat:
    path: /sbin/auditd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/auditd
  ansible.builtin.file:
    path: /sbin/auditd
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/audispd
  ansible.builtin.stat:
    path: /sbin/audispd
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/audispd
  ansible.builtin.file:
    path: /sbin/audispd
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /sbin/augenrules
  ansible.builtin.stat:
    path: /sbin/augenrules
  register: file_exists
  when: '"kernel" in ansible_facts.packages'
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-s,g-ws,o-wt on /sbin/augenrules
  ansible.builtin.file:
    path: /sbin/augenrules
    mode: u-s,g-ws,o-wt
  when:
  - '"kernel" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_audit_binaries
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
</fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg-file_permissions_audit_binaries:def:1" href="ssg-al2023-oval.xml"/>
        </check>
        <check system="http://scap.nist.gov/schema/ocil/2">
          <check-content-ref name="ocil:ssg-file_permissions_audit_binaries_ocil:questionnaire:1" href="ssg-al2023-ocil.xml"/>
        </check>
      </Rule>
    </Group>
  </Group>
  <TestResult id="xccdf_org.open-scap_testresult_xccdf_pelotech_profile_cis_fips" start-time="2026-03-29T19:51:33+00:00" end-time="2026-03-29T19:53:37+00:00" version="0.1.79" test-system="cpe:/a:redhat:openscap:1.3.13">
    <benchmark href="/tmp/scap-security-guide-0.1.79/ssg-al2023-ds.xml" id="xccdf_org.ssgproject.content_benchmark_AL-2023"/>
    <title>OSCAP Scan Result</title>
    <identity authenticated="false" privileged="false">ec2-user</identity>
    <profile idref="xccdf_pelotech_profile_cis_fips"/>
    <target>ip-172-31-90-234.ec2.internal</target>
    <target-address>127.0.0.1</target-address>
    <target-address>172.31.90.234</target-address>
    <target-address>0:0:0:0:0:0:0:1</target-address>
    <target-address>fe80:0:0:0:1070:81ff:feb5:921f</target-address>
    <target-facts>
      <fact name="urn:xccdf:fact:scanner:name" type="string">OpenSCAP</fact>
      <fact name="urn:xccdf:fact:scanner:version" type="string">1.3.13</fact>
      <fact name="urn:xccdf:fact:asset:identifier:fqdn" type="string">ip-172-31-90-234.ec2.internal</fact>
      <fact name="urn:xccdf:fact:asset:identifier:host_name" type="string">ip-172-31-90-234.ec2.internal</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:00:00:00:00:00</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:00:00:00:00:00</fact>
      <fact name="urn:xccdf:fact:ethernet:MAC" type="string">12:70:81:B5:92:1F</fact>
      <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">12:70:81:B5:92:1F</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">127.0.0.1</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">172.31.90.234</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">::1</fact>
      <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::1070:81ff:feb5:921f</fact>
    </target-facts>
    <platform idref="#not_bootc_and_not_container"/>
    <platform idref="#package_dnf"/>
    <platform idref="#package_pam"/>
    <platform idref="cpe:/o:amazon:amazon_linux:2023"/>
    <platform idref="#ipv6_enabled"/>
    <platform idref="#mount_tmp"/>
    <platform idref="#package_nftables"/>
    <set-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy">FIPS</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_logfile">/var/log/sudo.log</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout">5</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">^(Authorized[\s\n]+users[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_motd_banner_text">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_remote_login_banner_text">^(Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.|^(?!.*(\\|fedora|rhel|sle|ubuntu)).*)$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm">SHA512</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm_pam">sha512</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir">/var/run/faillock</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time">900</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember">5</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag">requisite,required</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass">4</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">14</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry">3</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration">30</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs">365</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs">7</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su">sugroup</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">900</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex">^\.[\w\- ]+$</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask">027</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address">logcollector</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nftables_family">inet</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_nftables_table">firewalld</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name">targeted</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_state">enforcing</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces">loopback-only</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">900</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value">4</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_sshd_required">0</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions">10</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">1</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_login_grace_time">60</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups">10:30:60</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_audit_backlog_limit">8192</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct">root</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action">halt</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file">6</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action">keep_logs</set-value>
    <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action">email</set-value>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_aide_installed" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_aide_build_database" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_aide_check_audit_tools" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" role="full" time="2026-03-29T19:51:33+00:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
        <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_dev_shm" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_dev_shm:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_home" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-partition_for_tmp:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notselected</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_sudo_installed" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_add_use_pty" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_custom_logfile" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sudo_require_reauthentication" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" role="full" time="2026-03-29T19:51:33+00:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_issue_net" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_banner_etc_motd" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_motd" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_issue:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_issue_net:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_motd" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_motd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_id" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_group_unique_id" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_group_unique_name" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_name" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" role="full" time="2026-03-29T19:51:33+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow" role="full" time="2026-03-29T19:51:33+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_forward_files" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" role="full" time="2026-03-29T19:51:33+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_root_gid_zero" role="full" time="2026-03-29T19:51:33+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_root_password_configured" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_password_auth_for_systemaccounts" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_pam_wheel_group_for_su:var:1" value-id="xccdf_org.ssgproject.content_value_var_pam_wheel_group_for_su"/>
        <check-content-ref name="oval:ssg-use_pam_wheel_group_for_su:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_tmout" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_users_netrc_file_permissions" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_users_netrc_file_permissions:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_home_directories" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupownership_home_directories:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_home_directories" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_ownership_home_directories:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permission_user_init_files" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export export-name="oval:ssg-var_user_initialization_files_regex:var:1" value-id="xccdf_org.ssgproject.content_value_var_user_initialization_files_regex"/>
        <check-content-ref name="oval:ssg-file_permission_user_init_files:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_home_directories" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_home_directories:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-accounts_root_path_dirs_no_write:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_root_path_no_dot" role="full" time="2026-03-29T19:51:33+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-root_path_no_dot:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_user_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_user_cfg" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsyslog_installed" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_journald_compress" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_journald_forward_to_syslog" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_journald_storage" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_socket_systemd-journal-remote_disabled" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_nolisten" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians" role="full" time="2026-03-29T19:51:33+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians" role="full" time="2026-03-29T19:51:33+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses" role="full" time="2026-03-29T19:51:33+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward" role="full" time="2026-03-29T19:51:33+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_nftables_installed" role="full" time="2026-03-29T19:51:57+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_nftables_disabled" role="full" time="2026-03-29T19:51:57+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_set_nftables_table" role="full" time="2026-03-29T19:51:57+00:00" severity="medium" weight="1.000000">
      <result>notchecked</result>
      <message severity="info">No candidate or applicable check found.</message>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled" role="full" time="2026-03-29T19:51:57+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_rds_disabled" role="full" time="2026-03-29T19:51:57+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled" role="full" time="2026-03-29T19:51:57+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" role="full" time="2026-03-29T19:51:57+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits" role="full" time="2026-03-29T19:52:06+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable" role="full" time="2026-03-29T19:52:35+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_unauthorized_world_writable:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_ungroupowned:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_files_unowned_by_user" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_backup_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_backup_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_gshadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_gshadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" role="full" time="2026-03-29T19:53:36+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled" role="full" time="2026-03-29T19:53:36+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled" role="full" time="2026-03-29T19:53:36+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_nodev:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_noexec:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_dev_shm_nosuid:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_home_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_home_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_nodev:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_noexec:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-mount_option_tmp_nosuid:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_libselinux_installed" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_mcstrans_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_enable_selinux" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_not_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_policytype" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_selinux_state" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_avahi_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_avahi_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_crond_enabled" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_d" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_crontab" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_d" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_daily" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_hourly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_monthly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_weekly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_crontab" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_d" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_daily" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_crontab" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_at_deny_not_exist" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_cron_allow_exists" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_at_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_at_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_cron_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_at_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_cron_allow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_dhcp_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_dhcp_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_dnsmasq_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_dnsmasq_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_bind_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_bind_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_ftp_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_ftp_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_vsftpd_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_vsftpd_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_httpd_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_httpd_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_nginx_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_nginx_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_cyrus-imapd_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_cyrus-imapd_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_dovecot_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_dovecot_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_openldap-clients_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_openldap-clients_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_has_nonlocal_mta" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_rpcbind_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_nfs_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_rsync_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_rsync_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_no_rsh_trust_files" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnet-server_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_telnet-server_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_telnet_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_telnet_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_tftp-server_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_tftp-server_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_cups_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_cups_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_squid_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_squid_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_samba_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_samba_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_net-snmp_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_net-snmp_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_snmpd_disabled" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_sshd_config" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_config" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_disable_host_auth" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" role="full" time="2026-03-29T19:53:37+00:00" severity="high" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_rhosts" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_tcp_forwarding" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_disable_x11_forwarding" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_pam" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_limit_user_access" role="full" time="2026-03-29T19:53:37+00:00" severity="unknown" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_max_sessions" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_maxstartups" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>pass</result>
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:ssg-package_xorg-x11-server-common_removed:def:1" href="ssg-al2023-oval.xml"/>
      </check>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_package_audit_installed" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" role="full" time="2026-03-29T19:53:37+00:00" severity="low" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification_usr_share" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_sudo_log_events" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_group_ownership_var_log_audit" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit_stig" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_create" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_query" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usermod" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_audit_binaries" role="full" time="2026-03-29T19:53:37+00:00" severity="medium" weight="1.000000">
      <result>notapplicable</result>
    </rule-result>
    <score system="urn:xccdf:scoring:default" maximum="100.000000">100.000000</score>
  </TestResult>
</Benchmark>
