Add missing OCIL to three PCI-DSS RHEL8 rules (#4913)

linux_os/guide/auditing/auditd_configure_rules/audit_rules_session_events/rule.yml

@@ -50,3 +50,12 @@ references:
     nist-csf: DE.AE-3,DE.AE-5,DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4
     pcidss: Req-10.2.3
     srg: SRG-APP-000505-CTR-001285
+
+ocil_clause: 'there is not output'
+
+ocil: |-
+    To determine if the system is configured to audit attempts to alter process
+    and session initiation information, run the following command:
+    <pre>$ sudo auditctl -l | grep -E '(/var/run/utmp|/var/log/btmp|/var/log/wtmp)'</pre>
+    If the system is configured to watch these files, lines should be returned for
+    each file specified (and with <tt>perm=wa</tt> for each).

linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml

@@ -104,3 +104,18 @@ references:
     nist: CM-6(a),AU-8(1)(a),AU-8(2),AU-12(1)
     nist-csf: PR.PT-1
     pcidss: Req-10.4.3
+
+ocil_clause: 'fewer than two remote NTP servers are configured for the NTP daemon in use'
+
+ocil: |-
+    Verify that {{{ full_name }}} is configured with more than one remote NTP server.
+
+    If the system uses <tt>chronyd</tt> as the NTP daemon (the default), run the following command:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" {{{ chrony_conf_path }}}</pre>
+
+    Also check any drop-in configuration files the daemon includes.
+
+    If the system uses <tt>ntpd</tt> as the NTP daemon, run the following command instead:
+    <pre>$ sudo grep -E "^[[:space:]]*server[[:space:]]+" /etc/ntp.conf</pre>
+
+    Two or more <tt>server</tt> lines must be returned for the NTP daemon that is in use.

linux_os/guide/system/software/integrity/disable_prelink/rule.yml

@@ -37,3 +37,19 @@ references:
     nist: SC-13,CM-6(a)
     nist-csf: PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1
     pcidss: Req-11.5
+
+ocil_clause: 'the prelink package is installed and prelinking is not disabled'
+
+ocil: |-
+    Verify that prelinking is disabled on {{{ full_name }}}.
+
+    First determine whether the <tt>prelink</tt> package is installed:
+    <pre>$ rpm -q prelink</pre>
+
+    If the package is not installed, prelinking cannot be in use and the requirement is met.
+
+    If the package is installed, verify that prelinking is disabled:
+    <pre>$ grep -i PRELINKING /etc/sysconfig/prelink</pre>
+
+    The output must be:
+    <pre>PRELINKING=no</pre>