Anchore STIG Profiles Release Notes - 2026-11-03

Anchore STIG Profiles - 2026-11-03

The profile-inputs.yaml files for the RHEL 8 and RHEL 9 profiles are corrected. The profiles themselves are unchanged. The update was published through the Anchore Data Service on 2026-11-03. Anchore Enterprise deployments receive it at their next feed sync. Air-gapped deployments receive it when they next download and import the datasets.

The files had outdated values that gave some wrong results. This affected evaluations that used rhel8/profile-inputs.yaml or rhel9/profile-inputs.yaml as an inputs file, for example with --stig-input-file. Evaluations run without an inputs file used the profiles’ built-in defaults, which already have the corrected values, and were not affected.

Corrected Inputs

The corrected non_removable_media_fs and system_activity_timeout values do not change results for container images: no rhel8 control reads system_activity_timeout, and the controls that read non_removable_media_fs are Not Applicable to containers.

rhel8 SV-230337 and SV-256974 and rhel9 SV-258057 appear under both Fixed: Wrong Failures and Fixed: Wrong Passes: with the old values, these checks failed images that met the STIG and passed images that did not.

Fixed: Wrong Failures

• rhel8 SV-256973 looked for a CentOS key file, which RHEL 8 images do not have, so it failed on every RHEL 8 image evaluated with the old rhel8/profile-inputs.yaml. It now checks the Red Hat key file.
• rhel8 SV-230373 and rhel9 SV-258049 failed on images that disable accounts after 35 days of inactivity, as the STIG requires. They now accept up to 35 days.
• rhel8 SV-230337 and rhel9 SV-258057 failed on images that keep accounts locked until an administrator unlocks them (unlock_time = 0), as the STIG requires. They now require that setting.
• rhel8 SV-256974 checked for postfix, so it failed on images without postfix, including images that have the mailx package that the STIG names. It now checks for mailx.
• rhel8 SV-230317 and rhel9 SV-258050 also checked root’s initialization files, which the STIG check does not cover, so they could fail on root’s PATH settings. They now skip root.

Fixed: Wrong Passes

• rhel8 SV-244531 and SV-244532 skipped every user, so they passed without checking anything. They now check the files in users’ home directories.
• rhel8 SV-230553 checked 1 of the 4 X server packages that must not be installed. It now checks all 4.
• rhel8 SV-230337 and rhel9 SV-258057 passed on images that unlock accounts automatically after 7 days (unlock_time = 604800). They now fail there.
• rhel8 SV-256974 passed on images with postfix instead of mailx. It now fails there.

Update and Rescan

• If you pass the shipped profile-inputs.yaml with --stig-input-file, run anchorectl stig write-profiles again after your deployment has synced the update, then rescan RHEL 8 and RHEL 9 images.
• If you keep your own inputs file, check it against the table above.
• To see which commands replace an image’s existing evaluation, see Managing STIG Evaluations.