Add operation/datatype support to grub2_bootloader_argument

The grub2_bootloader_argument OVAL template relied on regex pattern
matching for all value comparisons, including numeric thresholds like
audit_backlog_limit.  This meant "8192 >= 8192" was evaluated as a
string match, not a numeric comparison — any value containing the
expected digits would pass regardless of magnitude.

Add operation and datatype parameters to the template so the OVAL
state element uses native OVAL comparison (equals, greater than or
equal, pattern match) with the correct datatype (string, int).
Objects now extract only the argument value via capturing groups
instead of matching the entire line.

Changes:
- oval.template: rewrite objects to extract values, states use
  operation/datatype attributes, remove local_variable/concat,
  nousb triggers existence-only checks
- template.py: add validation for operation/datatype combinations,
  require quoted arg_value in rule.yml, require explicit params
  for arg_variable rules, compute test scenario values
- 19 rule.yml files: add operation/datatype parameters
- 2 .var files: change type from string to number
- bash.template: rename SANITIZED_ARG_NAME to ARG_NAME_UNDERSCORED
- tests: fix wrong_variable=wrong to use proper wrong values,
  add 3 GTE boundary tests, add comments to all ARG_VARIABLE blocks
- template_reference.md: document new parameters

Author: macko1

docs/templates/template_reference.md

@@ -455,18 +455,63 @@ they must be of the same length.
 -   Languages: Bash, OVAL
 
 #### grub2_bootloader_argument
--   Ensures that a kernel command line argument is present in GRUB 2 configuration.
+- Ensures that a kernel command line argument is present in GRUB 2 configuration
+  with the expected value.
 
--   Parameters:
-
-    -   **arg_name** - argument name, eg. `audit`
-
-    -   **arg_value** - argument value, eg. `'1'`
-
-    -   **arg_variable** - the variable used as the value for the argument, eg. `'var_slub_debug_options'`
-        This parameter is mutually exclusive with **arg_value**.
+- Parameters:
 
--   Languages: Ansible, Bash, OVAL, Blueprint, Kickstart
+    - **arg_name** - kernel argument name, e.g. `audit`, `audit_backlog_limit`, `nousb`.
+
+    - **arg_value** - expected value, e.g. `'1'`, `'on'`. Mutually exclusive with
+      **arg_variable**. Omit for flag-only arguments like `nousb`.
+      **Must be quoted** in `rule.yml` — YAML auto-parses unquoted scalars
+      (`8192` becomes int, `on`/`off` become bool), but the template needs a
+      string to build regexes and config file content. The build will fail with
+      a clear error if the value is not a string.
+
+    - **arg_variable** - XCCDF variable providing the expected value at scan time,
+      e.g. `var_audit_backlog_limit`. Mutually exclusive with **arg_value**.
+      When `arg_variable` is used, **operation** and **datatype** are required —
+      the `.var` file defines the XCCDF variable `type` (string/number) and
+      `operator` (equals/greater than or equal/...), and the OVAL state must
+      use matching values. `template.py` cannot read `.var` files, so the rule
+      author must declare both in `rule.yml` and keep them in sync manually.
+
+    - **operation** - OVAL comparison operation applied to the extracted value.
+      Default: `equals`. Supported values: `equals`, `not equal`, `greater than`,
+      `less than`, `greater than or equal`, `less than or equal`, `pattern match`.
+        - `equals` — the extracted value must match the expected value exactly.
+          Use for arguments with a single known-good value (e.g. `audit=1`,
+          `pti=on`).
+        - `pattern match` — the extracted value is matched against the expected
+          value as a regex. Use when multiple values are acceptable and the
+          expected value is a pattern (e.g. `slub_debug` on OL8 where the
+          variable value `P` must appear anywhere inside values like `FZP`).
+          Replaces the deprecated `is_substring` parameter.
+        - `greater than or equal` — the extracted value must be numerically
+          greater than or equal to the expected value. Requires `datatype: int`.
+          Use for threshold arguments (e.g. `audit_backlog_limit>=8192`).
+        - Other operations (`not equal`, `greater than`, `less than`,
+          `less than or equal`) are supported for future use but no current
+          rule uses them.
+
+    - **datatype** - OVAL datatype for the comparison. Default: `string`.
+      Supported values: `string`, `int`.
+        - `string` — lexicographic comparison. Use for non-numeric values
+          (e.g. `on`, `force`, `none`).
+        - `int` — numeric comparison. Use when the value is a number
+          (e.g. `audit_backlog_limit=8192`, `audit=1`). Required for numeric
+          operations like `greater than or equal`.
+
+- Test values: for `arg_value` rules, `template.py` computes `correct_value`
+  and `wrong_value` based on `operation` and `datatype`. For `arg_variable`
+  rules, the real value is only known at scan time (from the XCCDF profile),
+  so `template.py` uses safe dummy values — same approach as the `sysctl`
+  template. Test scripts for `arg_variable` rules use
+  `# variables = var_name=value` to tell Automatus what value to set at
+  runtime.
+
+- Languages: Ansible, Bash, OVAL, Blueprint, Kickstart
 
 #### grub2_bootloader_argument_absent
 -   Ensures that a kernel command line argument is absent in GRUB 2 configuration.

linux_os/guide/auditing/grub2_audit_argument/rule.yml

@@ -57,6 +57,8 @@ template:
     vars:
         arg_name: audit
         arg_value: '1'
+        datatype: int
+        operation: equals
 
 fixtext: |-
     {{{ describe_grub2_argument("audit=1") | indent(4) }}}

linux_os/guide/auditing/grub2_audit_backlog_limit_argument/rule.yml

@@ -52,3 +52,5 @@ template:
     vars:
         arg_name: audit_backlog_limit
         arg_variable: var_audit_backlog_limit
+        datatype: int
+        operation: greater than or equal

linux_os/guide/auditing/var_audit_backlog_limit.var

@@ -7,9 +7,9 @@ description: |-
     The audit_backlog_limit parameter determines how auditd records can
     be held in the auditd backlog.
 
-type: string
+type: number
 
-operator: equals
+operator: greater than or equal
 
 interactive: true
 

linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml

@@ -37,3 +37,5 @@ template:
     vars:
         arg_name: iommu
         arg_value: 'force'
+        datatype: string
+        operation: equals

linux_os/guide/system/bootloader-grub2/grub2_init_on_alloc_argument/rule.yml

@@ -33,3 +33,5 @@ template:
     vars:
         arg_name: init_on_alloc
         arg_value: '1'
+        datatype: int
+        operation: equals

linux_os/guide/system/bootloader-grub2/grub2_init_on_free/rule.yml

@@ -29,3 +29,5 @@ template:
     vars:
         arg_name: init_on_free
         arg_value: '1'
+        datatype: int
+        operation: equals

linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml

@@ -52,5 +52,7 @@ template:
     vars:
         arg_name: random.trust_cpu
         arg_value: 'on'
+        datatype: string
+        operation: equals
     backends:
         oval: "off"

linux_os/guide/system/bootloader-grub2/grub2_l1tf_argument/rule.yml

@@ -43,3 +43,5 @@ template:
     vars:
         arg_name: l1tf
         arg_variable: var_l1tf_options
+        datatype: string
+        operation: equals

linux_os/guide/system/bootloader-grub2/grub2_mce_argument/rule.yml

@@ -36,3 +36,5 @@ template:
     vars:
         arg_name: mce
         arg_value: '0'
+        datatype: int
+        operation: equals