From b2772806fffbcb2be6e8b339f3cfa0af528ea899 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Fri, 22 Nov 2024 10:28:15 +0100
Subject: [PATCH] Adjust OVAL for directory_permissions_var_log_audit

---
 .../directory_permissions_var_log_audit/oval/shared.xml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/shared.xml b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/shared.xml
index b7c87b0befd..15c6c6a0ec1 100644
--- a/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/shared.xml
+++ b/linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/shared.xml
@@ -2,7 +2,7 @@
   <definition class="compliance" id="directory_permissions_var_log_audit" version="1">
     {{{ oval_metadata("Checks for correct permissions for audit logs.") }}}
     <criteria operator="OR">
-      {{% if product not in ["ol8", "rhel8"] %}}
+      {{% if product not in ["ol8"] and 'rhel' not in product %}}
       <criteria operator="AND" comment="log_file set">
         <extend_definition comment="log_file set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" negate="true" />
         <criteria operator="AND" comment="log_group in auditd.conf is not root">
@@ -16,7 +16,7 @@
       <criteria operator="AND" comment="log_group in auditd.conf is not root">
         <extend_definition comment="log_group in auditd.conf is not root"
         definition_ref="auditd_conf_log_group_not_root" />
-        <criterion test_ref="test_dir_permissions_var_log_audit-non_root" negate="true" /> 
+        <criterion test_ref="test_dir_permissions_var_log_audit-non_root" negate="true" />
       </criteria>
       {{% else %}}
       <criteria operator="AND" comment="log_file set">