Fix audit_rules_privileged_commands_unix2_chkpwd

[ggbecker]

Description:

• Fix audit_rules_privileged_commands_unix2_chkpwd

Rationale:

• Fixes Automatus audit_rules_privileged_commands_unix2_chkpwd/only_chkpwd_rule.fail fails on RHEL-10 #12880

Review Hints:

• tests/automatus.py rule --libvirt qemu:///system rhel10 --debug --datastream build/ssg-rhel10-ds.xml --remediate-using bash --scenarios only_chkpwd_rule.fail audit_rules_privileged_commands_unix2_chkpwd

I'm opening as draft as it should fix the issue but I didn't have time to verify it. I should get back to this next week, in the meantime feel free to reuse the idea and close this one in case you fix it in another PR.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1

[codeclimate]

Code Climate has analyzed commit a00ae30 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.