further fixes

macko1 · macko1 · commit 5d68582ed9ca · 2026-04-08T13:13:27.000+02:00
diff --git a/linux_os/guide/auditing/var_audit_backlog_limit.var b/linux_os/guide/auditing/var_audit_backlog_limit.var
@@ -8,7 +8,7 @@ description: |-
     records can be held in the backlog queue before the audit daemon
     starts processing them.
 
-type: string
+type: number
 
 operator: greater than or equal
 
diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template
@@ -4,7 +4,10 @@
 # complexity = medium
 # disruption = low
 
-{{% if ARG_VARIABLE %}}
+{{% if ARG_MINIMAL_VALUE %}}
+{{{ ansible_instantiate_variables(ARG_MINIMAL_VALUE) }}}
+{{% set ARG_NAME_VALUE = ARG_NAME ~ "={{ " ~ ARG_MINIMAL_VALUE ~ " }}" %}}
+{{% elif ARG_VARIABLE %}}
 {{{ ansible_instantiate_variables(ARG_VARIABLE) }}}
 {{% set ARG_NAME_VALUE = ARG_NAME ~ "={{ " ~ ARG_VARIABLE ~ " }}" %}}
 {{% endif %}}
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
@@ -4,7 +4,10 @@
    Product-specific categorization should be synced across all template content types
 -#}}
 
-{{%- if ARG_VARIABLE %}}
+{{%- if ARG_MINIMAL_VALUE %}}
+{{{- bash_instantiate_variables(ARG_MINIMAL_VALUE) }}}
+{{%- set ARG_NAME_VALUE = ARG_NAME ~ "=$" ~ ARG_MINIMAL_VALUE %}}
+{{%- elif ARG_VARIABLE %}}
 {{{- bash_instantiate_variables(ARG_VARIABLE) }}}
 {{%- set ARG_NAME_VALUE = ARG_NAME ~ "=$" ~ ARG_VARIABLE %}}
 {{% endif %}}
diff --git a/shared/templates/grub2_bootloader_argument/blueprint.template b/shared/templates/grub2_bootloader_argument/blueprint.template
@@ -1,5 +1,7 @@
 # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_almalinux
-{{%- if ARG_VARIABLE %}}
+{{%- if ARG_MINIMAL_VALUE %}}
+{{%- set ARG_NAME_VALUE = ARG_NAME ~ "=(blueprint-populate " ~ ARG_MINIMAL_VALUE ~ ")" -%}}
+{{%- elif ARG_VARIABLE %}}
 {{%- set ARG_NAME_VALUE = ARG_NAME ~ "=(blueprint-populate " ~ ARG_VARIABLE ~ ")" -%}}
 {{%- endif %}}
 [customizations.kernel]
diff --git a/shared/templates/grub2_bootloader_argument/kickstart.template b/shared/templates/grub2_bootloader_argument/kickstart.template
@@ -4,7 +4,9 @@
 # complexity = medium
 # disruption = low
 
-{{%- if ARG_VARIABLE %}}
+{{%- if ARG_MINIMAL_VALUE %}}
+{{%- set ARG_NAME_VALUE = ARG_NAME ~ "=(kickstart-populate " ~ ARG_MINIMAL_VALUE ~ ")" -%}}
+{{%- elif ARG_VARIABLE %}}
 {{%- set ARG_NAME_VALUE = ARG_NAME ~ "=(kickstart-populate " ~ ARG_VARIABLE ~ ")" -%}}
 {{%- endif %}}
 
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_in_entries.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_in_entries.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_fedora,multi_platform_rhel
+{{% endif %}}
 # packages = grub2,grubby
 
 {{%- if ARG_VARIABLE %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
 {{%- set ARG_NAME_VALUE= ARG_NAME ~ "=correct_value" %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_and_not_referenced.pass.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_and_not_referenced.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Oracle Linux 8,Red Hat Enterprise Linux 8
+{{% endif %}}
 # packages = grub2,grubby
 
 {{%- if ARG_VARIABLE %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_but_referenced.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_not_in_grubenv_but_referenced.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Oracle Linux 8,Red Hat Enterprise Linux 8
+{{% endif %}}
 # packages = grub2,grubby
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_value_below_minimal.fail.sh b/shared/templates/grub2_bootloader_argument/tests/arg_value_below_minimal.fail.sh
@@ -2,59 +2,32 @@
 {{#-
   Test: arg_value_below_minimal — expected result: FAIL
 
-  Scenario:
-    The kernel argument (e.g. audit_backlog_limit) is set to a value that is
-    BELOW the required minimum.  The OVAL check uses "greater than or equal",
-    so below-minimum is a failing case.
-
-  What happens:
-    1. The XCCDF variable (e.g. var_audit_backlog_limit) is set to 8192.
-    2. The remediation macro writes ARG_NAME=100 into all GRUB locations
-       (grubby, /etc/default/grub, grub.cfg — depending on the product).
-    3. The OVAL object captures "100" (the digits after ARG_NAME=).
-    4. The OVAL state compares: 100 >= 8192 → false → FAIL.
-
-  Applicability:
-    Only runs for rules that use arg_minimal_value (e.g. audit_backlog_limit).
-    Rules using arg_value or arg_variable skip this test (platform = Not Applicable).
+  Only meaningful when the rule uses arg_minimal_value; otherwise the
+  "# platform = Not Applicable" directive tells Automatus to skip this test.
+
+  How it works:
+    1. "# variables" overrides the XCCDF variable to 8192 (the default
+       minimum from the .var file).
+    2. grub2_bootloader_argument_remediation writes ARG_NAME=8191 into
+       every GRUB location — one below the threshold.
+    3. Automatus runs oscap.  The OVAL object captures "8191" from the files.
+    4. The OVAL state compares: 8191 >= 8192 → false → FAIL.
 -#}}
 
-{{#- This test only makes sense for rules using arg_minimal_value.
-     If the rule does NOT use arg_minimal_value (i.e. it uses arg_value or
-     arg_variable instead), emit "platform = Not Applicable" so Automatus
-     skips it.  Otherwise, run on all platforms.
-     ("# platform = ..." is an Automatus directive parsed from the rendered
-     script — bash sees it as a comment, but Automatus uses it to decide
-     whether to run the test.) -#}}
 {{% if not ARG_MINIMAL_VALUE %}}
 # platform = Not Applicable
 {{% else %}}
 # platform = multi_platform_all
 {{% endif %}}
-
-{{#- Ubuntu only needs the grub2 package.
-     All other products also need grubby (used by the remediation macro to
-     write kernel arguments into /boot/loader/entries/*.conf).
-     ("# packages = ..." is an Automatus directive — it installs these
-     packages on the test VM before running the script.) -#}}
 {{%- if 'ubuntu' in product %}}
 # packages = grub2
 {{%- else %}}
 # packages = grub2,grubby
 {{%- endif %}}
-
-{{#- When arg_minimal_value is set, tell Automatus which XCCDF variable to
-     use and what value to assign it.  "# variables = ..." is an Automatus
-     directive that sets the variable before the OVAL scan runs.
-     Here we set the minimum to 8192. -#}}
 {{%- if ARG_MINIMAL_VALUE %}}
 # variables = {{{ ARG_MINIMAL_VALUE }}}=8192
 {{%- endif %}}
 
-{{#- common.sh sets up the GRUB environment for the test (creates necessary
-     files, cleans previous state, etc.). -#}}
 source common.sh
 
-{{#- Write ARG_NAME=100 into all GRUB config locations.
-     Value is below the minimum (100 < 8192) → the check should FAIL. -#}}
-{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=100") }}}
+{{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=8191") }}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/arg_value_meets_minimal.pass.sh b/shared/templates/grub2_bootloader_argument/tests/arg_value_meets_minimal.pass.sh
@@ -2,59 +2,33 @@
 {{#-
   Test: arg_value_meets_minimal — expected result: PASS
 
-  Scenario:
-    The kernel argument (e.g. audit_backlog_limit) is set to a value that
-    EQUALS the required minimum.  The OVAL check uses "greater than or equal",
-    so equal-to-minimum is a passing case.
-
-  What happens:
-    1. The XCCDF variable (e.g. var_audit_backlog_limit) is set to 8192.
-    2. The remediation macro writes ARG_NAME=8192 into all GRUB locations
-       (grubby, /etc/default/grub, grub.cfg — depending on the product).
-    3. The OVAL object captures "8192" (the digits after ARG_NAME=).
+  Only meaningful when the rule uses arg_minimal_value; otherwise the
+  "# platform = Not Applicable" directive tells Automatus to skip this test.
+
+  How it works:
+    1. "# variables" overrides the XCCDF variable to 8192 (the default
+       minimum from the .var file).
+    2. grub2_bootloader_argument_remediation (shared/macros/10-bash.jinja)
+       writes ARG_NAME=8192 into every GRUB location (/etc/default/grub,
+       entries, grubenv, grub.cfg).
+    3. Automatus runs oscap.  The OVAL object captures "8192" from the files.
     4. The OVAL state compares: 8192 >= 8192 → true → PASS.
-
-  Applicability:
-    Only runs for rules that use arg_minimal_value (e.g. audit_backlog_limit).
-    Rules using arg_value or arg_variable skip this test (platform = Not Applicable).
 -#}}
 
-{{#- This test only makes sense for rules using arg_minimal_value.
-     If the rule does NOT use arg_minimal_value (i.e. it uses arg_value or
-     arg_variable instead), emit "platform = Not Applicable" so Automatus
-     skips it.  Otherwise, run on all platforms.
-     ("# platform = ..." is an Automatus directive parsed from the rendered
-     script — bash sees it as a comment, but Automatus uses it to decide
-     whether to run the test.) -#}}
 {{% if not ARG_MINIMAL_VALUE %}}
 # platform = Not Applicable
 {{% else %}}
 # platform = multi_platform_all
 {{% endif %}}
-
-{{#- Ubuntu only needs the grub2 package.
-     All other products also need grubby (used by the remediation macro to
-     write kernel arguments into /boot/loader/entries/*.conf).
-     ("# packages = ..." is an Automatus directive — it installs these
-     packages on the test VM before running the script.) -#}}
 {{%- if 'ubuntu' in product %}}
 # packages = grub2
 {{%- else %}}
 # packages = grub2,grubby
 {{%- endif %}}
-
-{{#- When arg_minimal_value is set, tell Automatus which XCCDF variable to
-     use and what value to assign it.  "# variables = ..." is an Automatus
-     directive that sets the variable before the OVAL scan runs.
-     Here we set the minimum to 8192. -#}}
 {{%- if ARG_MINIMAL_VALUE %}}
 # variables = {{{ ARG_MINIMAL_VALUE }}}=8192
 {{%- endif %}}
 
-{{#- common.sh sets up the GRUB environment for the test (creates necessary
-     files, cleans previous state, etc.). -#}}
 source common.sh
 
-{{#- Write ARG_NAME=8192 into all GRUB config locations.
-     Value equals the minimum → the check should PASS. -#}}
 {{{ grub2_bootloader_argument_remediation(ARG_NAME, ARG_NAME ~ "=8192") }}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_recovery_disabled.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_recovery_disabled.pass.sh
@@ -1,5 +1,9 @@
 #!/bin/bash
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 
 {{%- if 'ubuntu' in product %}}
 # packages = grub2
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_etcdefault_dir.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_etcdefault_dir.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_ubuntu
+{{% endif %}}
 # packages = grub2
 
 # Clean up
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_etcdefault_dir_noupdate.fail.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_etcdefault_dir_noupdate.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_ubuntu
+{{% endif %}}
 # packages = grub2
 
 {{%- if ARG_VARIABLE %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_grubenv_only.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_grubenv_only.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Oracle Linux 8,Red Hat Enterprise Linux 8
+{{% endif %}}
 # packages = grub2,grubby
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_mix_entries_and_grubenv.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_mix_entries_and_grubenv.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Oracle Linux 8,Red Hat Enterprise Linux 8
+{{% endif %}}
 # packages = grub2,grubby
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_noupdate.fail.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_noupdate.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 # packages = grub2
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/correct_value_remediated.pass.sh b/shared/templates/grub2_bootloader_argument/tests/correct_value_remediated.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 {{%- if 'ubuntu' in product %}}
 # packages = grub2
 {{%- else %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh b/shared/templates/grub2_bootloader_argument/tests/invalid_rescue.pass.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10,multi_platform_fedora
+{{% endif %}}
 # packages = grub2,grubby
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/wrong_value_entries.fail.sh b/shared/templates/grub2_bootloader_argument/tests/wrong_value_entries.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_fedora,multi_platform_rhel
+{{% endif %}}
 # packages = grub2,grubby
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefault.fail.sh b/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefault.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 
 {{%- if 'ubuntu' in product %}}
 # packages = grub2
diff --git a/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefault_dir.fail.sh b/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefault_dir.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_ubuntu
+{{% endif %}}
 # packages = grub2
 
 {{%- if ARG_VARIABLE %}}
diff --git a/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefaultgrub_recovery_disabled.fail.sh b/shared/templates/grub2_bootloader_argument/tests/wrong_value_etcdefaultgrub_recovery_disabled.fail.sh
@@ -1,5 +1,9 @@
 #!/bin/bash
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = multi_platform_all
+{{% endif %}}
 
 {{%- if ARG_VARIABLE %}}
 # variables = {{{ ARG_VARIABLE }}}=correct_value
diff --git a/shared/templates/grub2_bootloader_argument/tests/wrong_value_grubenv.fail.sh b/shared/templates/grub2_bootloader_argument/tests/wrong_value_grubenv.fail.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
+{{% if ARG_MINIMAL_VALUE %}}
+# platform = Not Applicable
+{{% else %}}
 # platform = Oracle Linux 8,Red Hat Enterprise Linux 8
+{{% endif %}}
 # packages = grub2,grubby
 
 {{%- if ARG_VARIABLE %}}
