openscap icon indicating copy to clipboard operation
openscap copied to clipboard
verified publisher icon OpenSCAP

Audit rules and augenrules

Open Pierre-Goffe opened this issue 2 months ago • 0 comments

On RHEL 10, the augenrules.service unit no longer exists — it has been replaced by audit-rules.service. The current pattern (ExecStartPost=-/sbin/augenrules.*$|Requires=augenrules.service) causes a false negative when evaluating the ANSSI-BP-028 Enhanced profile. Suggest updating the pattern to support both service names or conditionally check depending on the OS version.

Pierre-Goffe avatar Oct 21 '25 12:10 Pierre-Goffe