Skip to content

Add audit rules for cron dirs to Ubuntu 22.04 STIG#14416

Merged
dodys merged 1 commit intoComplianceAsCode:masterfrom
mpurg:ubuntu_stig_UBTU-22-654041
Feb 20, 2026
Merged

Add audit rules for cron dirs to Ubuntu 22.04 STIG#14416
dodys merged 1 commit intoComplianceAsCode:masterfrom
mpurg:ubuntu_stig_UBTU-22-654041

Conversation

@mpurg
Copy link
Copy Markdown
Contributor

@mpurg mpurg commented Feb 18, 2026

Description:

Add audit rules for cron dirs to Ubuntu 22.04 STIG

Rationale:

Aligns with UBTU-22-654041
(Ubuntu 22.04 LTS must audit any script or executable called by cron as root or by any privileged user)

Tests:

(KVM)

$ python3 "tests/automatus.py" rule         --libvirt qemu:///system "sec-jammy-amd64"         --datastream "build/ssg-ubuntu2204-ds.xml"         --remove-fips-certified         --remediate-using "bash"         --profile "stig"         --dontclean   
      "audit_rules_etc_cron_d"                                                                                              
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_audit_rules_etc_cron_d
INFO - Script auditctl_wrong_rule_without_key.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script rules_not_there.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct_without_key.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_correct.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_remove_all_rules.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_wrong_rule_without_key.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_remove_all_rules.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_correct_without_key.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_correct_extra_permission.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_wrong_rule.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct_extra_permission.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_wrong_rule.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK

$ python3 "tests/automatus.py" rule         --libvirt qemu:///system "sec-jammy-amd64"         --datastream "build/ssg-ubuntu2204-ds.xml"         --remove-fips-certified         --remediate-using "bash"         --profile "stig"         --dontclean   
      "audit_rules_var_spool_cron"                                                                                          
Setting console output to log level INFO                      
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_audit_rules_var_spool_cron
INFO - Script augenrules_correct.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_correct_extra_permission.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct_extra_permission.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_wrong_rule_without_key.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script rules_not_there.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_correct_without_key.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct_without_key.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_wrong_rule.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_wrong_rule.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_remove_all_rules.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_correct.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script augenrules_wrong_rule_without_key.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script auditctl_remove_all_rules.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK

Aligns with UBTU-22-654041
(Ubuntu 22.04 LTS must audit any script or executable called by cron as
root or by any privileged user)
@mpurg mpurg added the Ubuntu Ubuntu product related. label Feb 18, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Feb 18, 2026

@mpurg: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-openshift-platform-compliance ec98e30 link true /test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance ec98e30 link true /test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@mpurg mpurg added the STIG STIG Benchmark related. label Feb 19, 2026
@mpurg mpurg requested a review from dodys February 19, 2026 12:25
@mpurg mpurg added this to the 0.1.81 milestone Feb 19, 2026
@dodys dodys self-assigned this Feb 20, 2026
Copy link
Copy Markdown
Contributor

@dodys dodys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@dodys dodys merged commit 3c5ce78 into ComplianceAsCode:master Feb 20, 2026
60 of 64 checks passed
hdean3 added a commit to hdean3/content that referenced this pull request Feb 26, 2026
All V2R7 control PRs (ComplianceAsCode#14427, ComplianceAsCode#14418, ComplianceAsCode#14415, ComplianceAsCode#14416, ComplianceAsCode#14433) were
merged without updating the version metadata fields. This causes STIG
Viewer imports and auditor reports to display V2R3 while the actual
content reflects V2R7 rules.

Updated files:
- controls/stig_ubuntu2204.yml: version V2R3 → V2R7
- products/ubuntu2204/profiles/stig.profile: version, title, and
  description strings V2R3 → V2R7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

STIG STIG Benchmark related. Ubuntu Ubuntu product related.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants