[stabilization] Update auditd_data_retention_max_log_file_action_stig OVAL to accept expected values from RHEL9 STIG profile

[ggbecker]

Description:

• Backport: Update auditd_data_retention_max_log_file_action_stig OVAL to accept expected values from RHEL9 STIG profile #9557
• Contains parts of https://github.com/ComplianceAsCode/content/pull/9512/files#diff-fc92eed3a8195184bed2c8089f93bac332d6609b80c0e0b9e48214f136356edb

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig' differs.
--- oval:ssg-auditd_data_retention_max_log_file_action_stig:def:1
+++ oval:ssg-auditd_data_retention_max_log_file_action_stig:def:1
@@ -1,3 +1,3 @@
 criteria OR
-criterion oval:ssg-test_auditd_data_retention_max_log_file_action_stig_syslog:tst:1
-criterion oval:ssg-test_auditd_data_retention_max_log_file_action_stig_keep_logs:tst:1
+criterion oval:ssg-test_auditd_data_retention_max_log_file_action_stig_rotate:tst:1
+criterion oval:ssg-test_auditd_data_retention_max_log_file_action_stig_single:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig' differs.
--- ocil:ssg-auditd_data_retention_max_log_file_action_stig_ocil:questionnaire:1
+++ ocil:ssg-auditd_data_retention_max_log_file_action_stig_ocil:questionnaire:1
@@ -1,8 +1,9 @@
-Verify that the SA and ISSO (at a minimum) are notified when the audit storage volume is full.
+Verify Red Hat Enterprise Linux 8 takes the appropriate action when the audit files have reached maximum size.
 
-Check which action Red Hat Enterprise Linux 8 takes when the audit storage volume is full with the following command:
+Check that Red Hat Enterprise Linux 8 takes the appropriate action when the audit files have reached maximum size with the following command:
 
 $ sudo grep max_log_file_action /etc/audit/auditd.conf
+
 max_log_file_action = 
- Is it the case that the value of the "max_log_file_action" option is set to "ignore", "rotate", or "suspend", or the line is commented out?
+ Is it the case that the value of the "disk_full_action" option is not "ROTATE", "SINGLE", or the line is commented out, ask the system administrator to indicate how the system takes appropriate action when an audit storage volume is full. If there is no evidence of appropriate action?