Content 0.1.82

Important Highlights

• Add KylinSecServer6 OS baseline support (#14788)
• Add new product for Ubuntu 26.04 and a default profile (#14721)
• Create RHEL 10 STIG control file (#14826)
• Debian13 20260702 (#14851)
• DISA STIG Update RHEL 8 to v2r8 (#14986)
• DISA STIG Update RHEL 9 to v2r9 (#14987)
• Update OL8 STIG profile to DISA STIG V2R8 (#14738)
• Update RHEL 10 STIG to V1R2 (#14872)
• Update Ubuntu 24.04 STIG profile from V1R1 to V1R5 (#14854)

New Rules and Profiles

• Add new rule rsyslog_omfwd_authmode (#14911)
• Add new rule rsyslog_omfwd_streamdriver (#14887)
• Add new rule rsyslog_omfwd_tls (#14888)
• Add service disable rules for Kea DHCP server (CIS 2.1.3) (#14765)
• Add sshd_set_allow_groups rule for SSH group-based access control (#14774)
• Add sysctl persistence rules for Debian (#14768)
• Add UFW default policy rules with OVAL checks (CIS 3.3.x) (#14767)
• Adding Debian 13 CIS controls to the benchmark (#14684)
• Create new rule file_permissions_cron_not_modified (#14901)
• Create rule file_permissions_sshd_config_not_modified (#14897)
• Create rule socket_pcscd_enabled (#14902)
• Move RHEL-08-030610 to RHEL-09-653110 to use 0600 for audit files (#14991)

Updated Rules and Profiles

• Adapt audit rules for SLE16 platform (#14904)
• Adapt DHCP related rules to SLE16 platform (#14893)
• Add CIS Debian Linux 13 sections 2-4 to controls file (#14876)
• Add RHEL-08-040221, RHEL-08-040222, RHEL-08-040287 to RHEL8 STIG (#14997)
• Add slmicro6 and sle16 support for some rule (#14827)
• Check selection lines with direct attributes in aide.conf (#14883)
• controls/cis_debian13: Map remaining controls in sections 6-7 (#14877)
• Debian13 20260702 (#14851)
• DISA STIG Update RHEL 8 to v2r8 (#14986)
• DISA STIG Update RHEL 9 to v2r9 (#14987)
• Fix rsyslog rainerscript oval (#14728)
• Move RHEL-08-030610 to RHEL-09-653110 to use 0600 for audit files (#14991)
• Remove draft status from RHEL 10 OSPP profile (#14736)
• RHEL 10 STIG profile fixes (#14953)
• SLE16 fixes for sshd configuration related rules (#14439)
• Stabilization: Add missing hipaa reference to logind_session_timeout (#15045)
• Update RHEL 10 STIG to V1R2 (#14872)
• Update Ubuntu 24.04 STIG profile from V1R1 to V1R5 (#14854)

Changes in Remediations

• Adapt audit rules for SLE16 platform (#14904)
• Add slmicro6 and sle16 support for some rule (#14827)
• change to GVariant format (#14829)
• Check selection lines with direct attributes in aide.conf (#14883)
• fix: correct audit_backlog_limit definition in /etc/default/grub (#14850)
• SLE login.defs drop-in configuration fixes (#14925)
• SLE16 fixes in ansible for pcidss rules (#14972)
• Sle16 dropin hipaa fixes (#14954)
• Sle16 update sudoers related rules checks and remediations (#14698)
• Stabilization: Fix for sshd_lineinfile template to comply with newer ansible versions (#15055)

Changes in Checks

• change to GVariant format (#14829)
• Check selection lines with direct attributes in aide.conf (#14883)
• firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)
• Fix no_invalid_shell_accounts_unlocked for unlocked user in last line of /etc/passwd (#14751)
• Fix rsyslog rainerscript oval (#14728)
• Fix typo in snmpd_use_newer_protocol OVAL check and add tests (#14881)
• grub2_bootloader_argument_absent template: fix OVAL regex (#14908)
• Make no_shelllogin_for_systemaccounts oval consistent in uid_min usage (#14975)
• no_invalid_shell_accounts_unlocked: fix OVAL check to catch valid and invalid shell accounts (#14792)
• Remove RHEVH checks from RHEL 9 and 10 OS detection (#14909)
• SLE login.defs drop-in configuration fixes (#14925)
• Sle16 update sudoers related rules checks and remediations (#14698)
• template: kernel_module_disabled, use rule_id in OVAL definition name (#14787)

Changes in the Infrastructure

• Add COVERAGE_FILE for python unit tests (#14948)
• Add SLE16 to SUSE gating (#14742)
• Ensure all products are built in CI (#14756)
• Fix test_idtranslator_translate_oval_xmldiff (#14794)
• Fix three RCE vectors in the build system (#14882)
• lint: disable yamllint line-length check (#14793)
• Prevent duplicate keys in YAML files (#14966)
• Remove compliance-trestle dependency (CVE-2026-45725) (#14743)
• Update draft-pr skill to open PRs in the browser (#14791)

Changes in the Test Suite

• Allow Automatus to connect to remote qemu (#14935)
• firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)

Documentation

• Ensure all products are built in CI (#14756)
• lint: disable yamllint line-length check (#14793)
• Simplify build_product commands in Claude Skills (#14927)

Fixed Bugs

• Add a rationale for package_sssd_installed (#14856)
• CMP-4339: Added documentation_complete: true tags to rules that were missing it (#14810)
• Enable CIS rsyslog tailoring for RHEL 9 and RHEL 10 (#14960)
• file_permission_user_init_files_root: include /root in OCIL check (#14732)
• firewalld_loopback_traffic_restricted: fix OVAL check and OCIL typo (#14907)
• Fix overlayfs kernel mod name (#14763)
• Fix rsyslog CI issues (#14754)
• Fix rsyslog rainerscript oval (#14728)
• Fix typo in snmpd_use_newer_protocol OVAL check and add tests (#14881)
• grub2_bootloader_argument_absent template: fix OVAL regex (#14908)
• no_invalid_shell_accounts_unlocked: fix OVAL check to catch valid and invalid shell accounts (#14792)
• Remove RHEVH checks from RHEL 9 and 10 OS detection (#14909)
• Revert the bootc_build platoform change for disk_partitioning group (#14999)