enable oval checks for audit tools on fedora and fix failing tests

Arden97 · Arden97 · commit e4c164cacc32 · 2026-02-10T17:49:29.000+01:00
diff --git a/shared/checks/oval/audit_rules_auditctl.xml b/shared/checks/oval/audit_rules_auditctl.xml
@@ -18,7 +18,7 @@
     <ind:object object_ref="object_audit_rules_auditctl" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_auditctl" version="1">
-{{% if product in ['rhel10', 'ol10'] %}}
+{{% if product in ['fedora', 'rhel10', 'ol10'] %}}
     <ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
     <ind:pattern operation="pattern match">^ExecStart=\/sbin\/auditctl.*$</ind:pattern>
   {{% else %}}
diff --git a/shared/checks/oval/audit_rules_augenrules.xml b/shared/checks/oval/audit_rules_augenrules.xml
@@ -18,7 +18,7 @@
     <ind:object object_ref="object_audit_rules_augenrules" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_audit_rules_augenrules" version="1">
-  {{% if product in ['rhel10', 'ol10']  %}}
+  {{% if product in ['fedora', 'rhel10', 'ol10']  %}}
     <ind:filepath>/usr/lib/systemd/system/audit-rules.service</ind:filepath>
     <ind:pattern operation="pattern match">^ExecStart=(\/usr|)?\/sbin\/augenrules.*$</ind:pattern>
   {{% else %}}
diff --git a/shared/macros/20-test-scenarios.jinja b/shared/macros/20-test-scenarios.jinja
@@ -15,6 +15,23 @@ This macro changes the configuration of the audit service so that it looks like
 {{%- endmacro -%}}
 
 
+{{#
+This macro changes the configuration of the audit service so that it looks like augenrules is used to load rules.
+#}}
+
+{{%- macro setup_augenrules_environment () -%}}
+  {{% if product in ["fedora", "ol10", "rhel10"] %}}
+  sed -i "s%^ExecStart=.*%ExecStart=/sbin/augenrules%" /usr/lib/systemd/system/audit-rules.service
+  {{% else %}}
+  {{% if product == "sle15" %}}
+  sed -i "s%^#ExecStartPost=.*%ExecStartPost=-/sbin/augenrules%" /usr/lib/systemd/system/auditd.service
+  {{% else %}}
+  sed -i "s%^ExecStartPost=.*%ExecStartPost=-/sbin/augenrules%" /usr/lib/systemd/system/auditd.service
+  {{% endif %}}
+  {{% endif %}}
+{{%- endmacro -%}}
+
+
 {{#
 This macro is used by pam_account_password_faillock template to initialize
 the external variable and parameter value to a desired state.
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct_extra_permission.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct_extra_permission.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_correct_without_key.pass.sh b/shared/templates/audit_rules_watch/tests/augenrules_correct_without_key.pass.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_remove_all_rules.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_remove_all_rules.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule_without_key.fail.sh b/shared/templates/audit_rules_watch/tests/augenrules_wrong_rule_without_key.fail.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
+
 path={{{ PATH }}}
 style={{{ audit_watches_style }}}
 filter_type={{{ FILTER_TYPE }}}
diff --git a/shared/templates/audit_rules_watch/tests/rules_not_there.fail.sh b/shared/templates/audit_rules_watch/tests/rules_not_there.fail.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # packages = audit
 
+{{{ setup_augenrules_environment() }}}
 
 rm -f /etc/audit/rules.d/*
 > /etc/audit/audit.rules
diff --git a/tests/shared/audit_rules_watch/auditctl_wrong_rule.fail.sh b/tests/shared/audit_rules_watch/auditctl_wrong_rule.fail.sh
@@ -2,8 +2,10 @@
 # packages = audit
 
 if [[ "$style" == "modern" ]] ; then
+    sed -i "/$filter_type=$(echo "$path" | sed 's/\//\\\//g')/d" /etc/audit/audit.rules 
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/audit.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/audit.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/audit.rules
     echo "-w $path -p w -k logins" >> /etc/audit/audit.rules
 fi
diff --git a/tests/shared/audit_rules_watch/auditctl_wrong_rule_without_key.fail.sh b/tests/shared/audit_rules_watch/auditctl_wrong_rule_without_key.fail.sh
@@ -2,8 +2,10 @@
 # packages = audit
 
 if [[ "$style" == "modern" ]] ; then
+    sed -i "/$filter_type=$(echo "$path" | sed 's/\//\\\//g')/d" /etc/audit/audit.rules
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w" >> /etc/audit/audit.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w" >> /etc/audit/audit.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/audit.rules
     echo "-w $path -p w" >> /etc/audit/audit.rules
 fi
diff --git a/tests/shared/audit_rules_watch/augenrules_wrong_rule.fail.sh b/tests/shared/audit_rules_watch/augenrules_wrong_rule.fail.sh
@@ -3,8 +3,11 @@
 
 
 if [[ "$style" == "modern" ]] ; then
+    escaped_path=$(echo "$path" | sed 's/\//\\\//g')
+    sed -i "/$filter_type=$escaped_path/d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/rules.d/login.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w -F key=logins" >> /etc/audit/rules.d/login.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-w $path -p w -k login" >> /etc/audit/rules.d/login.rules
 fi
diff --git a/tests/shared/audit_rules_watch/augenrules_wrong_rule_without_key.fail.sh b/tests/shared/audit_rules_watch/augenrules_wrong_rule_without_key.fail.sh
@@ -3,8 +3,10 @@
 
 
 if [[ "$style" == "modern" ]] ; then
+    sed -i "/$filter_type=$(echo "$path" | sed 's/\//\\\//g')/d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-a always,exit -F arch=b32 -F $filter_type=$path -F perm=w" >> /etc/audit/rules.d/login.rules
     echo "-a always,exit -F arch=b64 -F $filter_type=$path -F perm=w" >> /etc/audit/rules.d/login.rules
 else
+    sed -i "\#-w $path#d" /etc/audit/rules.d/*.rules 2>/dev/null || true
     echo "-w $path -p w" >> /etc/audit/rules.d/login.rules
 fi
