Update cis_ubuntu22-04.yml

[Johnng007]

Related issue
#20231

Description

The debian12 SCA is affected by the "Ensure permissions on bootloader config are configured." wrong check entry.
The rule associated with it is wrong because the rationale explains that the permission should be set as read write for the root user. Also this is reflected in the remediation chown root:root /boot/grub/grub.cfg # chmod og-rwx /boot/grub/grub.cfg.

Unit testing

• a) Output from agent.log after the SCA scan and a raw output of the result of the checks.

Tests results

2024/04/26 02:29:39 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2024/04/26 02:29:39 sca: INFO: Security Configuration Assessment scan finished. Duration: 6 seconds.

[Johnng007]

Update: 26/04/2024

Unit Testing

2024/04/26 02:29:39 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2024/04/26 02:29:39 sca: INFO: Security Configuration Assessment scan finished. Duration: 6 seconds.

[Elyasnz]

hi there
thanks for the great work here
also not that rule 28532 Ensure core dumps are restricted. has false positive when coredump is not installed

this condition should also handle No such file or directory
systemctl is-enabled coredump.service -> r:enabled|masked|disabled

Suggested fix:
systemctl is-enabled coredump.service -> r:enabled|masked|disabled|No such file or directory