OVALFileLinker from SCAP Security Guide ssg: [0, 1, 80], python: 3.10.12 5.11.2 2025-11-23T12:44:14 Record Unsuccessful Access Attempts to Files - truncate Ubuntu 22.04 Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled. Test if auditctl is in use for audit rules Ubuntu 22.04 Test if auditctl is in use for audit rules. Test if augenrules is enabled for audit rules Ubuntu 22.04 Test if augenrules is enabled for audit rules. Test for 64-bit Architecture Ubuntu 22.04 Generic test for 64-bit architectures to be used by other tests Test for aarch_64 Architecture Ubuntu 22.04 Generic test for aarch_64 architecture to be used by other tests Test for PPC and PPCLE Architecture Ubuntu 22.04 Generic test for PPC PPC64LE architecture to be used by other tests Test for s390_64 Architecture Ubuntu 22.04 Generic test for s390_64 architecture to be used by other tests Test for x86_64 Architecture Ubuntu 22.04 Generic test for x86_64 architecture to be used by other tests ^/etc/audit/rules\.d/.*\.rules$ 1 ^/etc/audit/rules\.d/.*\.rules$ 1 ^/etc/audit/rules\.d/.*\.rules$ 1 ^/etc/audit/rules\.d/.*\.rules$ 1 /etc/audit/audit.rules 1 /etc/audit/audit.rules 1 /etc/audit/audit.rules 1 /etc/audit/audit.rules 1 /usr/lib/systemd/system/auditd.service ^ExecStartPost=\-\/sbin\/auditctl.*$ 1 /usr/lib/systemd/system/auditd.service ^(ExecStartPost=\-\/sbin\/augenrules.*$|Requires=augenrules.service) 1 aarch64 ppc64 ppc64le s390x x86_64 ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* ^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&).)* [\s]+(?:-F\s+auid>=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ (?:-F\s+exit=-EACCES) (?:-F\s+exit=-EPERM) (?:-F\s+exit=-EACCES) (?:-F\s+exit=-EPERM)