grub2 argument rules are misaligned with DISA

[jan-cerny]

Description of problem:

On 2025-02-12 the daily productization run showed that the following rules failed tests /scanning/disa-alignment/anaconda, /scanning/disa-alignment/ansible and /scanning/disa-alignment/oscap on RHEL 8.10:

• grub2_pti_argument
• grub2_vsyscall_argument
• grub2_page_poison_argument
• grub2_slub_debug_argument
• grub2_audit_argument
• grub2_audit_backlog_limit_argument

The content is misaligned with an external (third party) content that targets the same policy - typically, this means that a system hardened by our content doesn't pass the scan by the external content.

Details:

Our rules are evaluated as pass. The corresponding DISA rules are evaluated as fail.

I think the reason is that our rules allow kernelopts variable in /boot/loader/entries/*.conf but their checks don't allow this and require the exact argument there.

This issue might be related to #12375.

Outcome:

• This project's content can be improved:
  • Check needs to be improved.
  • Remediation needs to be improved.
• The external content's check is faulty - the other party needs to be notified, they have work to do.

SCAP Security Guide Version:

current upstream master as of 2025-02-12 as of HEAD 0f151a1

External Content's Version:

V2R2