`mount_option_nodev_nonroot_local_partitions` misaligned with DISA STIG SCAP Content

[ggbecker]

Description of problem:

8.10	fail	/scanning/disa-alignment/oscap	mount_option_nodev_nonroot_local_partitions		SSG result: pass, DISA result(s): SV-230301r1017111_rule:fail
8.10	fail	/scanning/disa-alignment/ansible	mount_option_nodev_nonroot_local_partitions		SSG result: pass, DISA result(s): SV-230301r1017111_rule:fail

SCAP Security Guide Version:

fe081c9

Operating System Version:

RHEL8.10

[jan-cerny]

DISA's check fail on /boot partition.

Our OVAL check intentionally doesn't check the /boot partition. There is a comment in the OVAL code:
/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/oval/shared.xml

  <linux:partition_object id="object_non_root_partitions" version="1">
    <!--
      Look at all partitions except / (root), /boot and /efi. The / is
      excluded because nodev is allowed on / by the rule text. The /boot and
      /efi are excluded because they are special partitions that are
      usually handled by a systemd mount which causes troubles if the rule is
      used in operating system installation.
      -->
    <linux:mount_point operation="pattern match">^/(?!boot|efi)\w.*$</linux:mount_point>
    <filter action="include">state_local_nodev</filter>
  </linux:partition_object>

[vojtapolasek]

It seems we exclude these partitions for a reason:
#12270 (comment)