Update rule aide_scan_notification for sle 15

[svet-se]

Description:

• Update rule aide_scan_notification for sle 15

Rationale:

• Accoring DISA recommendations Version 1, Release 9 from 26 January 2023 about SLE 15 STIG - "SLES-15-010570 - Verify the SUSE operating system notifies the SA when AIDE discovers anomalies in the operation of any security functions"

[openshift-ci]

Hi @svet-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit 8a90b8c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.5% (0.0% change).

View more on Code Climate.

[teacup-on-rockingchair]

Changes look perfect to me, but my tests showed that remediations/oval checks are not behaving correct on my SLES15 setup. I observed two issues:

1. explicit package dependency of crontabs, which looks not like a universal package name, for SUSE platforms, the correct package seem to be cronie.
   @svet-se can you please double check with your setup.
   @marcusburghardt if my theory is correct we might have same issue on other platforms also or I am missing something else in the picture? If it is generic problem across all platforms maybe it deserves an issue and dedicated PR :) ?
2. The oval checks verify for cron entries in /var/spool/cron/root and /etc/cron.(d|daily|weekly|monthly, while the ansible cron procedure places the cron entry in a drop-in configuration file /var/spool/cron/tabs/root. @marcusburghardt I am suspecting here again generic issue, what do you think?

[svet-se]

@teacup-on-rockingchair I also noticed this, and communicate with maage who submitted this PR which added the crontabs logic (it affected other rules too). Will see if this will be fixed in the next PR-s, but IMHO this issue should be fixed in another PR.

[teacup-on-rockingchair]

LGTM 👍