From 3ac4d1076efdda3a50a4ee2875d385f75cd9cd4f Mon Sep 17 00:00:00 2001
From: raviaxo <s.alonso.rodriguez@gmail.com>
Date: Sat, 22 Aug 2026 20:52:14 -0400
Subject: [PATCH] Add missing OCIL to three PCI-DSS RHEL8 rules (#4913)

Issue #4913 lists five rules in the PCI-DSS RHEL8 profile as missing OCIL.
Two of them already have it on current master and are left untouched:

  audit_rules_immutable        - has ocil_clause + ocil
  security_patches_up_to_date  - has ocil_clause + ocil

The remaining three are addressed here:

  audit_rules_session_events                 uses the existing
      ocil_audit_rules_watch() macro for /var/run/utmp, /var/log/btmp and
      /var/log/wtmp with the "session" key, matching how
      audit_rules_sysadmin_actions renders its watches.

  chronyd_or_ntpd_specify_multiple_servers   checks for two or more
      "server" lines for whichever NTP daemon is in use. Uses the
      chrony_conf_path product variable rather than a hardcoded path,
      since it differs on Debian-family products.

  disable_prelink                            follows the OVAL, which is an
      OR of "prelink package not installed" and "PRELINKING=no in
      /etc/sysconfig/prelink", so the OCIL checks the package first and
      the setting second.

Each ocil_clause is phrased so it reads as the failure condition, matching
the surrounding rules.
---
 .../audit_rules_session_events/rule.yml          |  7 +++++++
 .../rule.yml                                     | 15 +++++++++++++++
 .../software/integrity/disable_prelink/rule.yml  | 16 ++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
index 1cb90f75c145..b4529c3c752a 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
+++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml
@@ -50,3 +50,10 @@ references:
     nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
     pcidss: Req-10.2.3
     srg: SRG-APP-000505-CTR-001285
+
+ocil_clause: 'there is not output'
+
+ocil: |-
+    {{{ ocil_audit_rules_watch("/var/run/utmp", "session") }}}
+    {{{ ocil_audit_rules_watch("/var/log/btmp", "session") }}}
+    {{{ ocil_audit_rules_watch("/var/log/wtmp", "session") }}}
diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
index dec1be4ebf29..20459bac9314 100644
--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
+++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
@@ -104,3 +104,18 @@ references:
     nist: CM-6(a),AU-8(1)(a),AU-8(2),AU-12(1)
     nist-csf: PR.PT-1
     pcidss: Req-10.4.3
+
+ocil_clause: 'fewer than two remote NTP servers are configured for the NTP daemon in use'
+
+ocil: |-
+    Verify that {{{ full_name }}} is configured with more than one remote NTP server.
+
+    If the system uses <tt>chronyd</tt> as the NTP daemon (the default), run the following command:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" {{{ chrony_conf_path }}}</pre>
+
+    Also check any drop-in configuration files the daemon includes.
+
+    If the system uses <tt>ntpd</tt> as the NTP daemon, run the following command instead:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" /etc/ntp.conf</pre>
+
+    Two or more <tt>server</tt> lines must be returned for the NTP daemon that is in use.
diff --git a/linux_os/guide/system/software/integrity/disable_prelink/rule.yml b/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
index c187957e630f..a62a0ccfbf94 100644
--- a/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
+++ b/linux_os/guide/system/software/integrity/disable_prelink/rule.yml
@@ -37,3 +37,19 @@ references:
     nist: SC-13,CM-6(a)
     nist-csf: PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1
     pcidss: Req-11.5
+
+ocil_clause: 'the prelink package is installed and prelinking is not disabled'
+
+ocil: |-
+    Verify that prelinking is disabled on {{{ full_name }}}.
+
+    First determine whether the <tt>prelink</tt> package is installed:
+    <pre>$ rpm -q prelink</pre>
+
+    If the package is not installed, prelinking cannot be in use and the requirement is met.
+
+    If the package is installed, verify that prelinking is disabled:
+    <pre>$ grep -i PRELINKING /etc/sysconfig/prelink</pre>
+
+    The output must be:
+    <pre>PRELINKING=no</pre>