Skip to content

Commit bc7c46b

Browse files
authored
Merge pull request #14620 from Mab879/fix_14584
Fix augenrules OVAL check for Fedora and flatten conditionals
2 parents 1f86c36 + c6c48f0 commit bc7c46b

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

shared/checks/oval/audit_rules_augenrules.xml

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,19 @@
1818
<ind:object object_ref="object_audit_rules_augenrules" />
1919
</ind:textfilecontent54_test>
2020
<ind:textfilecontent54_object id="object_audit_rules_augenrules" version="1">
21-
{{% if product in ['fedora', 'rhel10', 'ol10'] %}}
21+
{{% if product in ['rhel10', 'ol10'] %}}
2222
<ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
2323
<ind:pattern operation="pattern match">^ExecStart=(\/usr|)?\/sbin\/augenrules.*$</ind:pattern>
24+
{{% elif product in ['fedora'] %}}
25+
<ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
26+
<ind:pattern operation="pattern match">^ExecStart=\/usr\/bin\/augenrules.*$</ind:pattern>
27+
{{% elif product in ['debian13'] %}}
28+
<ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
29+
<ind:pattern operation="pattern match">^ExecStart=\/usr\/sbin\/augenrules.*$</ind:pattern>
2430
{{% else %}}
25-
{{% if product in ['debian13'] %}}
26-
<ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
27-
<ind:pattern operation="pattern match">^ExecStart=\/usr\/sbin\/augenrules.*$</ind:pattern>
28-
{{% else %}}
29-
<ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
30-
<ind:pattern operation="pattern match">^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service)</ind:pattern>
31-
{{% endif %}}
32-
{{% endif %}}
31+
<ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
32+
<ind:pattern operation="pattern match">^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service)</ind:pattern>
33+
{{% endif %}}
3334
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
3435
</ind:textfilecontent54_object>
3536

0 commit comments

Comments
 (0)