Override auditd_kmod OVAL to allow old watch format on Ubuntu

[mpurg]

Description:

The rule audit_rules_privileged_commands_kmod uses the template audit_rules_privileged_commands which uses the new watch format (-a always,exit -F path=/bin/kmod ...) whereas Ubuntu STIGs suggest the old format (-w /bin/kmod ...).

This change aligns the content to the Ubuntu STIGs by allowing both formats.

Rationale:

• Fixes Ubuntu OpenSCAP kernel module audit rule bug #14099

Automatus results

$ python3 tests/automatus.py rule --libvirt qemu:///system sec-noble-amd64  --datastream build/ssg-ubuntu2404-ds.xml --remove-fips-certified --remediate-using bash --profile "(all)" --dontclean audit_rules_privileged_commands_kmod

Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
WARNING - Script 'auditctl_missing_arch.fail.sh' is not applicable on 'ubuntu2404' target because its platform is 'Red Hat Enterprise Linux 10'
WARNING - Script 'augenrules_missing_arch.fail.sh' is not applicable on 'ubuntu2404' target because its platform is 'Red Hat Enterprise Linux 10'
INFO - xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_kmod
INFO - Script auditctl_comented_value.fail.sh using profile (all) OK
INFO - Script auditctl_missing_auid.fail.sh using profile (all) OK
INFO - Script augenrules_missing_auid.fail.sh using profile (all) OK
INFO - Script auditctl_missing_perm_x.fail.sh using profile (all) OK
INFO - Script augenrules_missing_perm_x.fail.sh using profile (all) OK
INFO - Script augenrules_comented_value.fail.sh using profile (all) OK
INFO - Script auditctl_correct_value.pass.sh using profile (all) OK
INFO - Script augenrules_correct_value.pass.sh using profile (all) OK
INFO - Script augenrules_correct_old_format.pass.sh using profile (all) OK
INFO - Script auditctl_correct_old_format.pass.sh using profile (all) OK

[openshift-ci]

Hi @mpurg. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dodys]

lgtm, thanks!