Disabling Kernel Modules does not align with DISA STIG RHEL 9 V2R2

[christopher-davidson]

Description of problem:

Disabling Kernel Modules does not align with DISA STIG RHEL 9 V2R2 and likely others.

Details:

This content is not aligned with content from DISA STIG. All of these rules are checking that "install /bin/true" when the STIG states that these should be /bin/false

The misalignment affects these profiles:

• RHEL 9

The misalignment affects these rules:

• V-257804 (kernel_module_atm_disabled)
• V-257806 (kernel_module_firewire-core_disabled)
• V-257807 (kernel_module_sctp_disabled)
• V-257808 (kernel_module_tipc_disabled)
• V-258039 (kernel_module_bluetooth_disabled)

This may effect many more kernel_module_*_disabled rules

Outcome:

• This project's content can be improved:
  • [ X ] Check needs to be improved.
  • Remediation needs to be improved.
• The external content's check is faulty - the other party needs to be notified, they have work to do.

SCAP Security Guide Version:

0.1.74

External Content's Version:

V2R2

[Mab879]

While our check is little more loose then DISA's check the end result is the same. We allow both since some polices (CIS IIRC) allow both and we don't have to have two rules for this, one that only allows /bin/true and one the allows both.