Rule mount_option_tmp_noexec fails in /hardening/host-os/ansible

[jan-cerny]

Description of problem:

Rule mount_option_tmp_noexec fails in Contest test /hardening/host-os/ansible.

The issue has been noticed during review of #14999 but the issue is long-standing, isn't caused by that PR.

The fail is currently hidden by this really generic waiver:

# we don't control partitions on the host OS
/hardening/host-os/.+/mount_option_(home|opt|srv|var|var_log|var_log_audit|tmp)_(noexec|nosuid|nodev|usrquota|grpquota)
    True

The rule fails because OVAL detects it as applicable but Ansible detects it as notapplicable. It seems that the Ansible expression in ansible_mounts works differently than we expect.

SCAP Security Guide Version:

current upstream master as of 2026-08-17

Operating System Version:

RHEL 9.9 and 10.3

Steps to Reproduce:

1. Run eg. /hardening/host-os/ansible/anssi_bp28_high
2. Look for waived fail

Actual Results:

mount_option_tmp_noexec is "waived fail"

Expected Results:

mount_option_tmp_noexec is pass

Additional Information/Debugging Steps:

no