The auditd checks should process the actively running rules

[trevor-vaughan]

Description of problem:

The default configuration of auditd will cause rules to not be loaded after the first failing rule. This means that, while the checks may pass, the actual rules loaded at runtime may be completely blank.

SCAP Security Guide Version:

All

Operating System Version:

Any

[yuumasato]

Checking the runtime environment with OVAL can be tricky, we can't just run the auditctl -l command.
Do you have ideas how this could be done?

[yuumasato]

Well, the answer is in the future with auditdline_test:
OVAL-Community/OVAL#112

[gdidot]

The proposal is now present at OVAL-Community/OVAL#114

[Mab879]

Until the above OVAL issue is closed we will close this issue.

No comment on the OVAL issue since 2021. :(