Rule file_permissions_audit_configuration_stig fails after Ansible Remediation on CentOS Stream #15006

Description of problem:

PR #14991 introduced new rule file_permissions_audit_configuration_stig. The rule fails in the test /hardening/host-os/ansible/stig on CentOS Stream.

The rule fails in the final OpenSCAP scan because /etc/audit/audit.rules has incorrect permissions - it has 0640 but the expected mode is 0600.

The fail isn't reproducible with RHEL, we couldn't reproduce it in a custom GitLab pipeline on RHEL, it happens only on CentOS Stream.

SCAP Security Guide Version:

Operating System Version:

CentOS Stream 8
CentOS Stream 9

Steps to Reproduce:

1. Run contest test /hardening/host-os/ansible/stig on CentOS Stream machine

Actual Results:

file_permissions_audit_configuration_stig is evaluated as fail in the post-remediaton scan

Expected Results:

file_permissions_audit_configuration_stig is evaluated as pass in the post-remediaton scan

Additional Information/Debugging Steps:

See the discussion in #14991