Adding rules for /etc/cron.yearly directory configuration

[Arden97]

Description:

This commit implements three new security hardening rules for the /etc/cron.yearly directory to complete the cron directory security coverage:

• file_owner_cron_yearly: Verifies that /etc/cron.yearly is owned by root (uid 0)
• file_groupowner_cron_yearly: Verifies that /etc/cron.yearly has root as group owner (gid 0)
• file_permissions_cron_yearly: Verifies that /etc/cron.yearly has permissions set to 0700 (rwx------)

The implementation adds:

• Three new rule definitions in linux_os/guide/services/cron_and_at/
• STIG policy mappings for all three rules
• Integration with the crontabs component
• CIS RHEL10 control mapping (control 2.4.1.7) updated from pending to automated status
• Profile updates for CIS RHEL10 (base, server_l1, workstation_l1, workstation_l2)
• CCE identifier allocation (CCE-88898-2, CCE-90735-2, CCE-90732-9)

Rationale:

• The RHEL 10 CIS Benchmark v1.0.1 requirement 2.4.1.7 require that writing access to /etc/cron.yearly was granted for non-privileged users

• Fixes # NEW RULE - 2.4.1.7 - Ensure access to /etc/cron.yearly is configured (Automated)

[openshift-ci]

Hi @Arden97. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Mab879]

No need for these extra new lines

[Mab879]

No need for these extra new lines.

[Mab879]

No needs for these new lines.

[Mab879]

Please fix the CI issues:

Rule 'file_permissions_cron_yearly' must be in component 'cronie' because it's a member of 'cron_and_at' group.
Rule 'file_owner_cron_yearly' must be in component 'cronie' because it's a member of 'cron_and_at' group.
Rule 'file_groupowner_cron_yearly' must be in component 'cronie' because it's a member of 'cron_and_at' group.

[Arden97]

fixed in 6a54d25

[Arden97]

@Mab879 are there any other changes required before this PR can be merged? If not, may I ask you to merge it so I can move the ticket to the 'Review' state?"