[Ubuntu] Fix tmpfiles.d rules

[alanmcanonical]

Description:

• Change tmpfiles.d conf path per stig noble v1r6

[openshift-ci]

Hi @alanmcanonical. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_owner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_owner_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_owner_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_permissions_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_owner_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_system_journal
+++ xccdf_org.ssgproject.content_rule_file_permissions_system_journal
@@ -1,23 +1,38 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~0640 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

[alanmcanonical]

test result:

python3 tests/automatus.py rule --libvirt qemu:///system sec-noble-amd64 --datastream build/ssg-ubuntu2404-ds.xml --remediate-using bash --profile dir_permissions_system_journal dir_permissions_system_journal --profile stig
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/alan.moore@canonical.com/dev/cac/content/logs/rule-custom-2026-08-31-1703/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
INFO - Script stricter_permisions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script vendor_conf_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_runtime_dropin_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script stricter_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script correct_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script no_file.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_late_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_line_type_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_early_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script nested_subdir_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script lenient_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_hardened_dropin.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK

[alanmcanonical]

python3 tests/automatus.py rule --libvirt qemu:///system sec-noble-amd64 --datastream build/ssg-ubuntu2404-ds.xml --remediate-using bash --profile file_permissions_system_journal file_permissions_system_journal dir_permissions_system_journal --profile stig
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/alan.moore@canonical.com/dev/cac/content/logs/rule-custom-2026-09-02-1003/test_suite.log
libvirt: QEMU Driver error : argument unsupported: QEMU guest agent is not configured
INFO - xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
INFO - Script stricter_permisions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script vendor_conf_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_runtime_dropin_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script stricter_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script correct_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script no_file.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_late_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_line_type_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_early_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script nested_subdir_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script lenient_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_hardened_dropin.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - xccdf_org.ssgproject.content_rule_file_permissions_system_journal
INFO - Script lenient_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script stricter_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script correct_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script no_file.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script executable_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script deep_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script group_writable_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script unexpected_name_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script namespace_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script world_writable_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script world_readable_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script setuid_file.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK