{ "generatedAt": "2026-09-04T23:16:42.273Z", "independentVerification": true, "baseline": { "runId": 5187, "targetId": 5187, "score": 49.761906, "passed": 66, "failed": 25 }, "remediation": { "runId": 5192, "targetId": 5192, "score": 89.166664, "passed": 66, "failed": 0, "fixed": 22 }, "convergence": { "attempted": true, "runId": 5207, "targetId": 5207, "score": 100, "passed": 0, "failed": 0, "fixed": 1, "initialVerificationRunId": 5205, "targetedRuleIds": [ "xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer" ] }, "verification": { "runId": 5209, "targetId": 5209, "score": 100, "passed": 93, "failed": 0 }, "delta": { "score": 50.238094, "passedDelta": 27, "failedDelta": -25, "failuresRemaining": 0, "failToPass": 25, "passToFail": 0, "changedRules": 27 }, "transitions": { "failToPass": 25, "passToFail": 0, "unchangedPass": 66, "unchangedFail": 0, "changedRules": 27 }, "rules": [ { "ruleId": "xccdf_org.ssgproject.content_rule_aide_build_database", "title": "Build and Test AIDE Database", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer", "title": "Configure Systemd Timer Execution of AIDE", "severity": "medium", "before": "notapplicable", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_all_apparmor_profiles_in_enforce_complain_mode", "title": "All AppArmor Profiles are in enforce or complain mode", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_banner_etc_issue_cis", "title": "Ensure Local Login Warning Banner Is Configured Properly", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis", "title": "Ensure Remote Login Warning Banner Is Configured Properly", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_banner_etc_motd_cis", "title": "Ensure Message Of The Day Is Configured Properly", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled", "title": "Enable GNOME3 Login Warning Banner", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text", "title": "Set the GNOME3 Login Warning Banner Text", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_disable_users_coredumps", "title": "Disable Core Dumps for All Users", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue", "title": "Verify Group Ownership of System Login Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net", "title": "Verify Group Ownership of System Login Banner for Remote Connections", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd", "title": "Verify Group Ownership of Message of the Day Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_auth", "title": "Verify Group Who Owns /var/log/auth.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_cloud_init", "title": "Verify Group Who Owns /var/log/cloud-init.log* File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_journal", "title": "Verify Group Who Owns /var/log/*.journal(~) File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_lastlog", "title": "Verify Group Who Owns /var/log/lastlog File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_localmessages", "title": "Verify Group Who Owns /var/log/localmessages* File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages", "title": "Verify Group Who Owns /var/log/messages File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_secure", "title": "Verify Group Who Owns /var/log/secure File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog", "title": "Verify Group Who Owns /var/log/syslog File", "severity": "medium", "before": "notapplicable", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_waagent", "title": "Verify Group Who Owns /var/log/waagent.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_wbtmp", "title": "Verify Group Who Owns /var/log/(b|w)tmp(.*|-*) File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log", "title": "Verify ownership of log files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_apt", "title": "Verify Groupownership of Files in /var/log/apt", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm", "title": "Verify Groupownership of Files in /var/log/gdm", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm3", "title": "Verify Groupownership of Files in /var/log/gdm3", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_landscape", "title": "Verify Groupownership of Files in /var/log/landscape", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_sssd", "title": "Verify Grouponwership of Files in /var/log/sssd", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_etc_issue", "title": "Verify ownership of System Login Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net", "title": "Verify ownership of System Login Banner for Remote Connections", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_etc_motd", "title": "Verify ownership of Message of the Day Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg", "title": "Verify /boot/grub/grub.cfg User Ownership", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_auth", "title": "Verify User Who Owns /var/log/auth.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_cloud_init", "title": "Verify User Who Owns /var/log/cloud-init.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_journal", "title": "Verify User Who Owns /var/log/*.journal(~) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_lastlog", "title": "Verify User Who Owns /var/log/lastlog File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_localmessages", "title": "Verify User Who Owns /var/log/localmessages File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_messages", "title": "Verify User Who Owns /var/log/messages File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_secure", "title": "Verify User Who Owns /var/log/secure File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog", "title": "Verify User Who Owns /var/log/syslog File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_waagent", "title": "Verify User Who Owns /var/log/waagent.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_owner_var_log_wbtmp", "title": "Verify User Who Owns /var/log/(b|w)tmp(.*|-*) File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log", "title": "Verify ownership of log files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_apt", "title": "Verify Ownership of Files in /var/log/apt", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm", "title": "Verify Ownership of Files in /var/log/gdm", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm3", "title": "Verify Ownership of Files in /var/log/gdm3", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_landscape", "title": "Verify Ownership of Files in /var/log/landscape", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_sssd", "title": "Verify Ownership of Files in /var/log/sssd", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_etc_issue", "title": "Verify permissions on System Login Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net", "title": "Verify permissions on System Login Banner for Remote Connections", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_etc_motd", "title": "Verify permissions on Message of the Day Banner", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg", "title": "Verify /boot/grub/grub.cfg Permissions", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable", "title": "Ensure No World-Writable Files Exist", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned", "title": "Ensure All Files Are Owned by a Group", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_apt", "title": "Verify Permissions on files in the /var/log/apt/.* directory", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_auth", "title": "Verify Permissions on /var/log/auth.log File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_cloud-init", "title": "Verify Permissions on /var/log/cloud-init.log(.*) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm", "title": "Verify Permissions of Files in /var/log/gdm", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm3", "title": "Verify Permissions of Files in /var/log/gdm3", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_lastlog", "title": "Verify Permissions on /var/log/lastlog(.*) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_localmessages", "title": "Verify Permissions on /var/log/localmessages(.*) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages", "title": "Verify Permissions on /var/log/messages File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_secure", "title": "Verify Permissions on /var/log/secure File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_sssd", "title": "Verify Permissions of Files in /var/log/sssd", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog", "title": "Verify Permissions on /var/log/syslog File", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_waagent", "title": "Verify Permissions on /var/log/waagent.log(.*) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_file_permissions_var_log_wbtmp", "title": "Verify Permissions on /var/log/wtmp(.*) Files", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_grub2_enable_apparmor", "title": "Ensure AppArmor is enabled in the bootloader configuration", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_journald_compress", "title": "Ensure journald is configured to compress large log files", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_journald_forward_to_syslog", "title": "Ensure journald is configured to send logs to rsyslog", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_journald_storage", "title": "Ensure journald is configured to write log files to persistent disk", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled", "title": "Disable Mounting of cramfs", "severity": "low", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled", "title": "Disable Mounting of freevxfs", "severity": "low", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled", "title": "Disable Mounting of hfs", "severity": "low", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled", "title": "Disable Mounting of hfsplus", "severity": "low", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled", "title": "Disable Mounting of jffs2", "severity": "low", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled", "title": "Disable Modprobe Loading of USB Storage Driver", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_logging_services_active", "title": "Ensure One Logging Service Is In Use", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev", "title": "Add nodev Option to /dev/shm", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec", "title": "Add noexec Option to /dev/shm", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid", "title": "Add nosuid Option to /dev/shm", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_home_nodev", "title": "Add nodev Option to /home", "severity": "unknown", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_home_nosuid", "title": "Add nosuid Option to /home", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev", "title": "Add nodev Option to /var/log/audit", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec", "title": "Add noexec Option to /var/log/audit", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid", "title": "Add nosuid Option to /var/log/audit", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev", "title": "Add nodev Option to /var/log", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec", "title": "Add noexec Option to /var/log", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid", "title": "Add nosuid Option to /var/log", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_nodev", "title": "Add nodev Option to /var", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_nosuid", "title": "Add nosuid Option to /var", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev", "title": "Add nodev Option to /var/tmp", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec", "title": "Add noexec Option to /var/tmp", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid", "title": "Add nosuid Option to /var/tmp", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_no_files_unowned_by_user", "title": "Ensure All Files Are Owned by a User", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_package_aide_installed", "title": "Install AIDE", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_package_apparmor-utils_installed", "title": "Ensure AppArmor Utils is installed", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_package_apparmor_installed", "title": "Ensure AppArmor is installed", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_package_autofs_removed", "title": "Remove autofs Package", "severity": "low", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_package_rsyslog_installed", "title": "Ensure rsyslog is Installed", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_partition_for_dev_shm", "title": "Ensure /dev/shm is configured", "severity": "low", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_permissions_local_var_log", "title": "Verify permissions of log files", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode", "title": "Ensure rsyslog Default File Permissions Configured", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_service_autofs_disabled", "title": "Disable the Automounter", "severity": "medium", "before": "notapplicable", "after": "notapplicable", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_service_rsyslog_enabled", "title": "Enable rsyslog Service", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled", "title": "Enable systemd-journald Service", "severity": "medium", "before": "pass", "after": "pass", "changed": false }, { "ruleId": "xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable", "title": "Disable Core Dumps for SUID programs", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space", "title": "Enable Randomized Layout of Virtual Address Space", "severity": "medium", "before": "fail", "after": "pass", "changed": true }, { "ruleId": "xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope", "title": "Restrict usage of ptrace to descendant processes", "severity": "medium", "before": "fail", "after": "pass", "changed": true } ], "verificationGate": { "passed": true, "coverageComplete": true, "selectedControlCount": 109, "expectedResultCount": 109, "expectedResultRuleIds": [ "xccdf_org.ssgproject.content_rule_aide_build_database", "xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer", "xccdf_org.ssgproject.content_rule_all_apparmor_profiles_in_enforce_complain_mode", "xccdf_org.ssgproject.content_rule_banner_etc_issue_cis", "xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis", "xccdf_org.ssgproject.content_rule_banner_etc_motd_cis", "xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled", "xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text", "xccdf_org.ssgproject.content_rule_disable_users_coredumps", "xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue", "xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net", "xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_auth", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_cloud_init", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_journal", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_lastlog", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_localmessages", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_secure", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_waagent", "xccdf_org.ssgproject.content_rule_file_groupowner_var_log_wbtmp", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_apt", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_gdm3", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_landscape", "xccdf_org.ssgproject.content_rule_file_groupownerships_var_log_sssd", "xccdf_org.ssgproject.content_rule_file_owner_etc_issue", "xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net", "xccdf_org.ssgproject.content_rule_file_owner_etc_motd", "xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg", "xccdf_org.ssgproject.content_rule_file_owner_var_log_auth", "xccdf_org.ssgproject.content_rule_file_owner_var_log_cloud_init", "xccdf_org.ssgproject.content_rule_file_owner_var_log_journal", "xccdf_org.ssgproject.content_rule_file_owner_var_log_lastlog", "xccdf_org.ssgproject.content_rule_file_owner_var_log_localmessages", "xccdf_org.ssgproject.content_rule_file_owner_var_log_messages", "xccdf_org.ssgproject.content_rule_file_owner_var_log_secure", "xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog", "xccdf_org.ssgproject.content_rule_file_owner_var_log_waagent", "xccdf_org.ssgproject.content_rule_file_owner_var_log_wbtmp", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_apt", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_gdm3", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_landscape", "xccdf_org.ssgproject.content_rule_file_ownerships_var_log_sssd", "xccdf_org.ssgproject.content_rule_file_permissions_etc_issue", "xccdf_org.ssgproject.content_rule_file_permissions_etc_issue_net", "xccdf_org.ssgproject.content_rule_file_permissions_etc_motd", "xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg", "xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable", "xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_apt", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_auth", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_cloud-init", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_gdm3", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_lastlog", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_localmessages", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_messages", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_secure", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_sssd", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_syslog", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_waagent", "xccdf_org.ssgproject.content_rule_file_permissions_var_log_wbtmp", "xccdf_org.ssgproject.content_rule_grub2_enable_apparmor", "xccdf_org.ssgproject.content_rule_journald_compress", "xccdf_org.ssgproject.content_rule_journald_forward_to_syslog", "xccdf_org.ssgproject.content_rule_journald_storage", "xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled", "xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled", "xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled", "xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled", "xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled", "xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled", "xccdf_org.ssgproject.content_rule_logging_services_active", "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev", "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec", "xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid", "xccdf_org.ssgproject.content_rule_mount_option_home_nodev", "xccdf_org.ssgproject.content_rule_mount_option_home_nosuid", "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev", "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec", "xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid", "xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev", "xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec", "xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid", "xccdf_org.ssgproject.content_rule_mount_option_var_nodev", "xccdf_org.ssgproject.content_rule_mount_option_var_nosuid", "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev", "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec", "xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid", "xccdf_org.ssgproject.content_rule_no_files_unowned_by_user", "xccdf_org.ssgproject.content_rule_package_aide_installed", "xccdf_org.ssgproject.content_rule_package_apparmor-utils_installed", "xccdf_org.ssgproject.content_rule_package_apparmor_installed", "xccdf_org.ssgproject.content_rule_package_autofs_removed", "xccdf_org.ssgproject.content_rule_package_rsyslog_installed", "xccdf_org.ssgproject.content_rule_partition_for_dev_shm", "xccdf_org.ssgproject.content_rule_permissions_local_var_log", "xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode", "xccdf_org.ssgproject.content_rule_service_autofs_disabled", "xccdf_org.ssgproject.content_rule_service_rsyslog_enabled", "xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled", "xccdf_org.ssgproject.content_rule_sysctl_fs_suid_dumpable", "xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space", "xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" ], "suppressedConflictRuleIds": [], "baselineResultCount": 109, "verificationResultCount": 109, "baselineMissingRuleIds": [], "baselineUnexpectedRuleIds": [], "verificationMissingRuleIds": [], "verificationUnexpectedRuleIds": [], "scoreNotLower": true, "failedNotHigher": true, "noPassToFailRegressions": true, "improvementRequired": true, "improvementProven": true, "fipsPostReboot": { "required": false, "setupProofPassed": true, "nonPassRuleIds": [] }, "pciZeroFindings": { "required": false, "passed": true, "reasons": [] }, "runtimeProofAcceptedRuleIds": [], "effectiveVerificationFailed": 0, "reasons": [] }, "fipsSetupProof": null, "oracle9PciConvergenceProof": null, "oracle9Sdl1ConvergenceProof": null, "oracle10Sdl1ConvergenceProof": null, "rhel8PciConvergenceProof": null, "rhel10Sdl1ConvergenceProof": null, "almaSdl1ConvergenceProof": null, "al2023Sdl1ConvergenceProof": null, "rockySdl1ConvergenceProof": null, "ubuntu2204PciConvergenceProof": null, "ubuntu2404PciConvergenceProof": null, "ubuntu2404PciFinalStabilizationProof": null, "ubuntu2004PciConvergenceProof": null, "ubuntu2004PciFinalStabilizationProof": null, "ubuntu2004Sdl1ConvergenceProof": null, "ubuntu2404Sdl1ConvergenceProof": null, "ubuntu2604Sdl1ConvergenceProof": null, "ubuntu2604PciConvergenceProof": null, "ubuntu2604PciFinalStabilizationProof": null, "rebootDeferredVerification": null }