compliance-operator: Scanner fails to detect remidiated auditd rules

I have been testing manually fixing issues reported by the compliance-operator using custom machineconfigs. So far I have tested manual fixes to /etc/ssh/sshd_config and /etc/audit/auditd.conf and these have worked fine.

One potential issue I have noticed that the scanner can’t seem to detect fixes I make to the auditd rules.

This was the process I went through when I encountered this issue:

1. Created a machine config that creates a new audit rules file /etc/audit/rules.d/test.rules
2. Waited for the nodes to apply this change
3. SSHed in to on of the nodes and confirmed the file was installed successfully with correct permissions (0600). Also confirmed that the rules had been successfully copied by the audit daemon to /etc/audit/audit.rules.
4. Ran a new scan by creating a new compliancesuite CR
5. I get similar output to for all the fixed audit rules:

You can see here that it is correctly detecting the rules in /etc/audit/audit.rules but not in /etc/audit/rules.d/test.rules

I have even tried downloading and running the remidation playbook and it applies no changes:

$ ansible-playbook -u core playbook.yaml -b -i "worker1.fqdn,"

PLAY [all] *************************************************************************************

TASK [Gathering Facts] *************************************************************************
[WARNING]: Distribution redhat 4.3 on host worker1.fqdn should use /usr/bin/python,
but is using /usr/libexec/platform-python, since the discovered platform python interpreter was
not present. See
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more
information.
ok: [worker1.fqdn]

TASK [Search /etc/audit/rules.d for audit rule entries for sysadmin actions] *******************
ok: [worker1.fqdn]

TASK [Use /etc/audit/rules.d/actions.rules as the recipient for the rule] **********************
skipping: [worker1.fqdn]

TASK [Use matched file as the recipient for the rule] ******************************************
ok: [worker1.fqdn]

TASK [Inserts/replaces audit rule for /etc/sudoers rule in rules.d] ****************************
ok: [worker1.fqdn]

TASK [Inserts/replaces audit rule for /etc/sudoers.d rule in rules.d] **************************
ok: [worker1.fqdn]

TASK [Inserts/replaces audit rule for /etc/sudoers in audit.rules] *****************************
ok: [worker1.fqdn]

TASK [Inserts/replaces audit rule for /etc/sudoers.d in audit.rules] ***************************
ok: [worker1fqdn]

PLAY RECAP *************************************************************************************
worker1.fqdn    : ok=7    changed=0    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0