Automatus audit_rules_privileged_commands_unix2_chkpwd/only_chkpwd_rule.fail fails on RHEL-10

[comps]

Description of problem:

The test does

##### audit_rules_privileged_commands_unix2_chkpwd / only_chkpwd_rule.fail.sh #####
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentityFile=/var/lib/libvirt/images/contest.sshkey [email protected] cd /root/ssgts/audit_rules_privileged_commands_unix2_chkpwd; SHARED=/root/ssgts/shared bash -x only_chkpwd_rule.fail.sh
STDERR: Warning: Permanently added '192.168.123.155' (ED25519) to the list of known hosts.
+ echo '-a always,exit -F path=/sbin/unix2_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged'

which is then found by the OVAL and passes.

Unless I misunderstood .pass.sh tests, that means we have a broken test, since it feeds OVAL exactly what it's looking for, AFAICT.

ARF attached to help in further investigation.

SCAP Security Guide Version:

master @ 1424df5

Operating System Version:

RHEL-10

Steps to Reproduce:

1. Run automatus scenarios for audit_rules_privileged_commands_unix2_chkpwd

Additional Information/Debugging Steps:

• ARF: initial-arf.xml.gz