Blob Blame History Raw
From c7eb8fafacbf7625e35b68d9934c98a1eb65ef65 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 13 Feb 2023 17:49:13 +0100
Subject: [PATCH 2/5] Extends rsyslog_logfiles_attributes_modify template for
 permissions

Patch-name: scap-security-guide-0.1.67-rsyslog_files_permissions_template-PR_10139.patch
Patch-status: Extends rsyslog_logfiles_attributes_modify template for permissions
---
 .../ansible/shared.yml                        |  59 --------
 .../rsyslog_files_permissions/bash/shared.sh  |  92 ------------
 .../rsyslog_files_permissions/oval/shared.xml | 131 -----------------
 .../rsyslog_files_permissions/rule.yml        |  30 +++-
 .../IncludeConfig_glob_perms_0600.pass.sh     |  40 -----
 .../IncludeConfig_glob_perms_0601.fail.sh     |  41 ------
 .../tests/IncludeConfig_perms_0600.pass.sh    |  39 -----
 .../tests/IncludeConfig_perms_0601.fail.sh    |  40 -----
 .../include_config_syntax_perms_0600.pass.sh  |  85 -----------
 .../include_config_syntax_perms_0601.fail.sh  |  86 -----------
 .../include_multiline_perms_0600.pass.sh      |  41 ------
 .../tests/include_perms_0600.pass.sh          |  39 -----
 ...erms_0600_IncludeConfig_perms_0600.pass.sh |  52 -------
 ...erms_0600_IncludeConfig_perms_0601.fail.sh |  53 -------
 ...00_IncludeConfig_perms_0601_hidden.pass.sh |  53 -------
 ...0_IncludeConfig_perms_0601_missing.pass.sh |  45 ------
 .../include_perms_0600_cloudinit.pass.sh      |  23 ---
 .../tests/include_perms_0601.fail.sh          |  41 ------
 .../include_perms_0601_cloudinit.fail.sh      |  22 ---
 .../mixed_correct_attr_group_read.pass.sh     |  25 ++++
 .../tests/mixed_correct_attr_stricter.pass.sh |  25 ++++
 .../tests/perms_0600.pass.sh                  |  35 -----
 .../tests/perms_0601.fail.sh                  |  34 -----
 .../ansible.template                          |   7 +-
 .../bash.template                             |  33 ++---
 .../oval.template                             | 138 +++++++++---------
 .../template.py                               |  18 +++
 .../tests/IncludeConfig_is_other.fail.sh      |  50 -------
 .../tests/include_is_other.fail.sh            |  50 -------
 ...udeConfig_is_other_RainerLogClause.fail.sh |  75 ----------
 .../tests/include_is_root.pass.sh             |  46 ------
 ...ude_is_root_IncludeConfig_is_other.fail.sh |  63 --------
 ...lude_is_root_IncludeConfig_is_root.pass.sh |  58 --------
 ...ludeConfig_is_root_RainerLogClause.pass.sh |  59 --------
 .../tests/include_multiline_is_root.pass.sh   |  47 ------
 .../tests/is_root.pass.sh                     |  30 ----
 ...er.fail.sh => legacy_correct_attr.pass.sh} |  26 ++--
 ...sh => legacy_include_correct_attr.pass.sh} |  32 ++--
 .../legacy_include_incorrect_attr.fail.sh     |  50 +++++++
 .../tests/legacy_incorrect_attr.fail.sh       |  33 +++++
 .../tests/mixed_correct_attr.pass.sh          |  33 +++++
 .../tests/mixed_include_correct_attr.pass.sh  |  58 ++++++++
 ...ixed_include_incorrect_attr_legacy.fail.sh |  63 ++++++++
 ...ixed_include_incorrect_attr_rainer.fail.sh |  63 ++++++++
 .../mixed_incorrect_attr_cloudinit.fail.sh    |  38 +++++
 .../tests/mixed_incorrect_attr_legacy.fail.sh |  38 +++++
 .../tests/mixed_incorrect_attr_rainer.fail.sh |  38 +++++
 .../tests/rainer_correct_attr.pass.sh         |  31 ++++
 .../tests/rainer_include_correct_attr.pass.sh |  45 ++++++
 .../rainer_include_incorrect_attr.fail.sh     |  50 +++++++
 ...ner_include_multiline_correct_attr.pass.sh |  47 ++++++
 ...r_include_multiline_incorrect_attr.fail.sh |  52 +++++++
 .../tests/rainer_incorrect_attr.fail.sh       |  33 +++++
 53 files changed, 875 insertions(+), 1660 deletions(-)
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh
 delete mode 100644 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh
 create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh
 create mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh
 delete mode 100755 linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh
 create mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/template.py
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh
 delete mode 100644 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh
 delete mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh
 rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{is_other.fail.sh => legacy_correct_attr.pass.sh} (53%)
 rename shared/templates/rsyslog_logfiles_attributes_modify/tests/{IncludeConfig_is_root.pass.sh => legacy_include_correct_attr.pass.sh} (51%)
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh
 create mode 100755 shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
deleted file mode 100644
index ae8bbe3302..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/ansible/shared.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
-# reboot = false
-# strategy = configure
-# complexity = low
-# disruption = medium
-
-- name: "Set rsyslog logfile configuration facts"
-  set_fact:
-    rsyslog_etc_config: "/etc/rsyslog.conf"
-{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}
-    desired_perm_mode: "640"
-{{% else %}}
-    desired_perm_mode: "600"
-{{% endif %}}
-
-# * And also the log file paths listed after rsyslog's $IncludeConfig directive
-#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
-- name: "Get IncludeConfig directive"
-  shell: |
-    set -o pipefail
-    grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
-  register: rsyslog_old_inc
-  changed_when: False
-
-- name: "Get include files directives"
-  shell: |
-    set -o pipefail
-    grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut  -d"\"" -f 2 || true
-  register: rsyslog_new_inc
-  changed_when: False
-
-- name: "Expand glob expressions"
-  shell: |
-    set -o pipefail
-    eval printf '%s\\n' {{ item }}
-  register: include_config_output
-  loop: "{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines }}"
-
-- name: "List all config files"
-  shell: find {{ item }} -not -path "*/.*" -type f
-  loop: "{{ include_config_output.results|map(attribute='stdout_lines')|list|flatten }}"
-  register: rsyslog_config_files
-  failed_when: False
-  changed_when: False
-
-- name: "Extract log files"
-  shell: |
-    set -o pipefail
-    grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }}  |awk '{print $NF}'|sed -e 's/^-//' || true
-  loop: "{{ rsyslog_config_files.results|map(attribute='stdout_lines')|list|flatten|unique + [ rsyslog_etc_config ] }}"
-  register: log_files
-  changed_when: False
-
-- name: "Setup log files permissions"
-  ignore_errors: yes
-  file:
-    path: "{{ item }}"
-    mode: "{{ desired_perm_mode }}"
-  loop: "{{ log_files.results|map(attribute='stdout_lines')|list|flatten|unique }}"
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
deleted file mode 100644
index e4e2ade29e..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/bash/shared.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle
-
-# List of log file paths to be inspected for correct permissions
-# * Primarily inspect log file paths listed in /etc/rsyslog.conf
-RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
-# * And also the log file paths listed after rsyslog's $IncludeConfig directive
-#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
-readarray -t OLD_INC < <(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
-readarray -t RSYSLOG_INCLUDE_CONFIG < <(for INCPATH in "${OLD_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
-readarray -t NEW_INC < <(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)
-readarray -t RSYSLOG_INCLUDE < <(for INCPATH in "${NEW_INC[@]}"; do eval printf '%s\\n' "${INCPATH}"; done)
-
-# Declare an array to hold the final list of different log file paths
-declare -a LOG_FILE_PATHS
-
-# Array to hold all rsyslog config entries
-RSYSLOG_CONFIGS=()
-RSYSLOG_CONFIGS=("${RSYSLOG_ETC_CONFIG}" "${RSYSLOG_INCLUDE_CONFIG[@]}" "${RSYSLOG_INCLUDE[@]}")
-
-# Get full list of files to be checked
-# RSYSLOG_CONFIGS may contain globs such as
-# /etc/rsyslog.d/*.conf /etc/rsyslog.d/*.frule
-# So, loop over the entries in RSYSLOG_CONFIGS and use find to get the list of included files.
-RSYSLOG_CONFIG_FILES=()
-for ENTRY in "${RSYSLOG_CONFIGS[@]}"
-do
-	# If directory, rsyslog will search for config files in recursively.
-	# However, files in hidden sub-directories or hidden files will be ignored.
-	if [ -d "${ENTRY}" ]
-	then
-		readarray -t FINDOUT < <(find "${ENTRY}" -not -path '*/.*' -type f)
-		RSYSLOG_CONFIG_FILES+=("${FINDOUT[@]}")
-	elif [ -f "${ENTRY}" ]
-	then
-		RSYSLOG_CONFIG_FILES+=("${ENTRY}")
-	else
-		echo "Invalid include object: ${ENTRY}"
-	fi
-done
-
-# Browse each file selected above as containing paths of log files
-# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
-for LOG_FILE in "${RSYSLOG_CONFIG_FILES[@]}"
-do
-	# From each of these files extract just particular log file path(s), thus:
-	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
-	# * Ignore empty lines,
-	# * Strip quotes and closing brackets from paths.
-	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
-	# * From the remaining valid rows select only fields constituting a log file path
-	# Text file column is understood to represent a log file path if and only if all of the following are met:
-	# * it contains at least one slash '/' character,
-	# * it is preceded by space
-	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
-	# Search log file for path(s) only in case it exists!
-	if [[ -f "${LOG_FILE}" ]]
-	then
-		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
-		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' <<< "${NORMALIZED_CONFIG_FILE_LINES}")
-		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
-		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
-		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
-		# Since above sed command might return more than one item (delimited by newline), split the particular
-		# matches entries into new array specific for this log file
-		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
-		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
-		# items from newly created array for this log file
-		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
-		# Delete the temporary array
-		unset ARRAY_FOR_LOG_FILE
-	fi
-done
-{{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}
-DESIRED_PERM_MOD=640
-{{% else %}}
-DESIRED_PERM_MOD=600
-{{% endif %}}
-# Correct the form o
-for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
-do
-	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
-	if [ -z "$LOG_FILE_PATH" ]
-	then
-		continue
-	fi
-
-	# Also for each log file check if its permissions differ from 600. If so, correct them
-	if [ -f "$LOG_FILE_PATH" ] && [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne $DESIRED_PERM_MOD ]
-	then
-		/bin/chmod $DESIRED_PERM_MOD "$LOG_FILE_PATH"
-	fi
-done
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
deleted file mode 100644
index 559d5fb101..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/oval/shared.xml
+++ /dev/null
@@ -1,131 +0,0 @@
-<def-group oval_version="5.11">
-  <definition class="compliance" id="rsyslog_files_permissions" version="1">
-    {{{ oval_metadata("File permissions for all syslog log files should be set correctly.") }}}
-
-    <criteria operator="AND">
-      {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804"] %}}
-      <extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="package_rsyslog_installed" />
-      {{% endif %}}
-      <criterion comment="Check permissions of all system log files" test_ref="test_rsyslog_files_permissions" />
-    </criteria>
-
-  </definition>
-
-  <!-- First obtain rsyslog's $IncludeConfig directive and include() object (introduced in rsyslog v8.33.0) values.
-       To workaround empty include objects case, when FunctionGroup operations return "does not exist" result, added empty string match -->
-  <ind:textfilecontent54_object id="object_rfp_rsyslog_include_config_value" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
-    <ind:filepath>/etc/rsyslog.conf</ind:filepath>
-    <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
-    <filter action="exclude">state_permissions_ignore_hidden_paths</filter>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_state id="state_permissions_ignore_hidden_paths" comment="ignore hidden conf files" version="1">
-    <!-- Among the paths matched in object_rfp_rsyslog_include_config_value there can be paths from
-         include() or $IncludeConfig that point to hidden dirs or files.
-         Rsyslog ignores these conf files, so we should ignore them too.
-    -->
-    <ind:subexpression operation="pattern match">^.*\/\..*$</ind:subexpression>
-  </ind:textfilecontent54_state>
-
-  <!-- Turn that glob value into Perl's regex so it can be used as filepath pattern below -->
-  <local_variable id="var_rfp_include_config_regex" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
-    <unique>
-      <glob_to_regex>
-        <object_component item_field="subexpression" object_ref="object_rfp_rsyslog_include_config_value" />
-      </glob_to_regex>
-    </unique>
-  </local_variable>
-
-  <!-- Create a variable_object from the regex variable
-       If the variable has no values, there won't be any objects -->
-  <ind:variable_object id="object_var_rfp_include_config_regex" comment="Make variable object from regex variable" version="1">
-    <ind:var_ref>var_rfp_include_config_regex</ind:var_ref>
-  </ind:variable_object>
-
-  <local_variable id="var_rfp_syslog_config" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
-    <literal_component datatype="string">^/etc/rsyslog.conf$</literal_component>
-  </local_variable>
-
-  <ind:variable_object id="object_var_rfp_syslog_config" comment="Make variable object for use" version="1">
-    <ind:var_ref>var_rfp_syslog_config</ind:var_ref>
-  </ind:variable_object>
-
-  <!-- Combine the two variable_objects into one variable_object
-       We do it this way to avoid referencing an empty variable in a state comparison, which
-       will cause a test to evaluate to fail. Combining an empty set of objects is fine though -->
-  <ind:variable_object id="object_var_rfp_all_log_files" comment="Filter out empty string" version="1">
-    <set>
-      <object_reference>object_var_rfp_include_config_regex</object_reference>
-      <object_reference>object_var_rfp_syslog_config</object_reference>
-    </set>
-  </ind:variable_object>
-
-  <!-- In element filepath of object_rfg_log_files_paths we need to pass a list of values,
-       a list of objects won't do. So we make a local_variable from the variable_objects. -->
-  <local_variable id="var_rfp_all_log_files" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
-    <object_component object_ref="object_var_rfp_all_log_files" item_field="value"/>
-  </local_variable>
-
-  <!-- For each item from that collection (particular rsyslog's configuration file path) search
-       that rsyslog's configuration file to select file paths for log files directives
-  -->
-  <ind:textfilecontent54_object id="object_rfp_log_files_paths" comment="All rsyslog configuration files" version="1">
-    <ind:filepath operation="pattern match" var_ref="var_rfp_all_log_files" var_check="at least one" />
-    <!-- Chunk of text retrieved from rsyslog's configuration file is considered
-         to constitute a log file path if all of the following conditions are met:
-         * the string represents a regular file on particular file system
-           (verified via corresponding file_state below),
-         * the chunk of text is in the last column in the row,
-           (possibly suffixed by ';' character and rsyslog Template name),
-         * contains at least one slash '/' character, and simultaneously
-           doesn't contain any of ';', ':' and space characters,
-         * the chunk was retrieved from a row not starting with space, '#',
-           or '$' characters
-    -->
-    <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
-    <filter action="exclude">state_permissions_ignore_include_paths</filter>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_state id="state_permissions_ignore_include_paths" comment="ignore" version="1">
-    <!-- Among the paths matched in object_rfp_log_files_paths there can be paths from
-         include() or $IncludeConfig statements.
-         These paths are conf files, not log files. Their permissions don't need to be as
-         required for log files, thus, lets exclude them from the list of objects found
-    -->
-    <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
-  </ind:textfilecontent54_state>
-
-  <!-- Define OVAL variable to hold all the various system log files locations
-       retrieved from the different rsyslog configuration files
-  -->
-  <local_variable id="var_rfp_log_files_paths" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
-    <object_component item_field="subexpression" object_ref="object_rfp_log_files_paths" />
-  </local_variable>
-
-  <!-- Perform the test if all rsyslog system log files have correct permissions -->
-  <unix:file_test check="all" check_existence="all_exist" id="test_rsyslog_files_permissions" version="1" comment="Permissions of system log files are correct">
-    <unix:object object_ref="object_rsyslog_files_permissions" />
-    <unix:state state_ref="state_rsyslog_files_permissions" />
-  </unix:file_test>
-
-  <unix:file_object id="object_rsyslog_files_permissions" comment="Various system log files" version="1">
-    <unix:filepath datatype="string" var_ref="var_rfp_log_files_paths" var_check="at least one" />
-  </unix:file_object>
-
-  <unix:file_state id="state_rsyslog_files_permissions" version="1">
-    <unix:type operation="equals">regular</unix:type>
-    <unix:uexec datatype="boolean">false</unix:uexec>
-    {{% if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}
-    <unix:gread datatype="boolean">true</unix:gread>
-    {{% else %}}
-    <unix:gread datatype="boolean">false</unix:gread>
-    {{% endif %}}
-    <unix:gwrite datatype="boolean">false</unix:gwrite>
-    <unix:gexec datatype="boolean">false</unix:gexec>
-    <unix:oread datatype="boolean">false</unix:oread>
-    <unix:owrite datatype="boolean">false</unix:owrite>
-    <unix:oexec datatype="boolean">false</unix:oexec>
-  </unix:file_state>
-</def-group>
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
index 508ff73cde..042c35362d 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
@@ -1,18 +1,24 @@
+{{%- if product in ["debian10", "debian11", "ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204", "sle15", "sle12"] %}}
+    {{%- set rsyslog_perm='640' %}}
+{{%- else %}}
+    {{%- set rsyslog_perm='600' %}}
+{{%- endif %}}
+
 documentation_complete: true
 
 title: 'Ensure System Log Files Have Correct Permissions'
 
 description: |-
     The file permissions for all log files written by <tt>rsyslog</tt> should
-    be set to 600, or more restrictive. These log files are determined by the
+    be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the
     second part of each Rule line in <tt>/etc/rsyslog.conf</tt> and typically
     all appear in <tt>/var/log</tt>. For each log file <i>LOGFILE</i>
     referenced in <tt>/etc/rsyslog.conf</tt>, run the following command to
     inspect the file's permissions:
     <pre>$ ls -l <i>LOGFILE</i></pre>
-    If the permissions are not 600 or more restrictive, run the following
+    If the permissions are not {{{ rsyslog_perm }}} or more restrictive, run the following
     command to correct this:
-    <pre>$ sudo chmod 0600 <i>LOGFILE</i></pre>"
+    <pre>$ sudo chmod {{{ rsyslog_perm }}} <i>LOGFILE</i></pre>"
 
 rationale: |-
     Log files can contain valuable information regarding system
@@ -46,9 +52,23 @@ ocil_clause: 'the permissions are not correct'
 
 ocil: |-
     The file permissions for all log files written by <tt>rsyslog</tt> should
-    be set to 600, or more restrictive. These log files are determined by the
+    be set to {{{ rsyslog_perm }}}, or more restrictive. These log files are determined by the
     second part of each Rule line in <tt>/etc/rsyslog.conf</tt> and typically
     all appear in <tt>/var/log</tt>. To see the permissions of a given log
     file, run the following command:
     <pre>$ ls -l <i>LOGFILE</i></pre>
-    The permissions should be 600, or more restrictive.
+    The permissions should be {{{ rsyslog_perm }}}, or more restrictive.
+
+template:
+  name: rsyslog_logfiles_attributes_modify
+  vars:
+    attribute: permissions
+    value: '0600'
+    value@debian10: '0640'
+    value@debian11: '0640'
+    value@sle12: '0640'
+    value@sle15: '0640'
+    value@ubuntu1604: '0640'
+    value@ubuntu1804: '0640'
+    value@ubuntu2004: '0640'
+    value@ubuntu2204: '0640'
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh
deleted file mode 100755
index c27e7874d9..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0600.pass.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0600 from $IncludeConfig passes.
-# test $IncludeConfig with wildcard (*.conf)
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh
deleted file mode 100755
index 124b5e863e..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_glob_perms_0601.fail.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0601 from $IncludeConfig fails.
-# test $IncludeConfig with wildcard (*.conf)
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*      ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh
deleted file mode 100755
index a6ff6a1109..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0600.pass.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0600 from $IncludeConfig passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-\$IncludeConfig ${test_conf}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh
deleted file mode 100755
index 2ae5c89a4e..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/IncludeConfig_perms_0601.fail.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0601 from $IncludeConfig fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*      ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-\$IncludeConfig ${test_conf}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
deleted file mode 100755
index a5a2f67fad..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0600.pass.sh
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0600 from $IncludeConfig passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 5
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[2]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[3]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[4]}
-
-# create test configuration files
-conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir
-mkdir ${conf_subdir}
-mkdir ${conf_hiddir}
-
-test_conf_in_subdir=${conf_subdir}/in_subdir.conf
-test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak
-
-test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf
-test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf
-
-cat << EOF > ${test_conf_in_subdir}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-cat << EOF > ${test_conf_name_bak}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-cat << EOF > ${test_conf_in_hiddir}
-# rsyslog configuration file
-# not used
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[3]}
-EOF
-
-cat << EOF > ${test_conf_dot_name}
-# rsyslog configuration file
-# not used
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[4]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
-include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-include(file="${RSYSLOG_TEST_DIR}" mode="optional")
-
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-\$IncludeConfig ${RSYSLOG_TEST_DIR}
-
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
deleted file mode 100755
index fe4db0a3c9..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_config_syntax_perms_0601.fail.sh
+++ /dev/null
@@ -1,86 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0601 from $IncludeConfig fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 5
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[3]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[4]}
-
-# create test configuration files
-conf_subdir=${RSYSLOG_TEST_DIR}/subdir
-conf_hiddir=${RSYSLOG_TEST_DIR}/.hiddir
-mkdir ${conf_subdir}
-mkdir ${conf_hiddir}
-
-test_conf_in_subdir=${conf_subdir}/in_subdir.conf
-test_conf_name_bak=${RSYSLOG_TEST_DIR}/name.bak
-
-test_conf_in_hiddir=${conf_hiddir}/in_hiddir.conf
-test_conf_dot_name=${RSYSLOG_TEST_DIR}/.name.conf
-
-cat << EOF > ${test_conf_in_subdir}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-cat << EOF > ${test_conf_name_bak}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-cat << EOF > ${test_conf_in_hiddir}
-# rsyslog configuration file
-# not used
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[3]}
-EOF
-
-cat << EOF > ${test_conf_dot_name}
-# rsyslog configuration file
-# not used
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[4]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${RSYSLOG_TEST_DIR}/*/*.conf" mode="optional")
-include(file="${RSYSLOG_TEST_DIR}/*.conf" mode="optional")
-include(file="${RSYSLOG_TEST_DIR}" mode="optional")
-
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*/*.conf
-\$IncludeConfig ${RSYSLOG_TEST_DIR}/*.conf
-\$IncludeConfig ${RSYSLOG_TEST_DIR}
-
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh
deleted file mode 100755
index eabcb21956..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_multiline_perms_0600.pass.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0600 from multiline include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(
-   file="${test_conf}"
-)
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh
deleted file mode 100755
index 32cd4c334a..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600.pass.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0600 from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh
deleted file mode 100755
index 357d4f9718..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0600.pass.sh
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-
-# Check rsyslog.conf with log file permisssions 0600 from rules and
-# log file permissions 0600 from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh
deleted file mode 100755
index 7bdb830c00..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601.fail.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-
-# Check rsyslog.conf with log file permisssions 0600 from rules and
-# log file permissions 0601 from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
deleted file mode 100644
index 9b0185c6b2..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_hidden.pass.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-
-# Check rsyslog.conf with log file permisssions 0600 from rules and
-# log file permissions 0601 from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create hidden test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/.test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
deleted file mode 100644
index b929f2a94a..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_IncludeConfig_perms_0601_missing.pass.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-
-# Check rsyslog.conf with log file permisssions 0600 from rules and
-# log file permissions 0601 from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_PASS=0600
-PERMS_FAIL=0601
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[1]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# Skip creation test2 configuration file
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh
deleted file mode 100644
index 2eb515a43e..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0600_cloudinit.pass.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[@]}
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh
deleted file mode 100755
index fd3f9e92ec..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601.fail.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8
-
-# Check rsyslog.conf with log file permissions 0600 from rules and
-# log file permissions 0601 from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS_FAIL=0601
-
-PERMS_PASS=0600
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod $PERMS_PASS ${RSYSLOG_TEST_LOGS[0]}
-chmod $PERMS_FAIL ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*      ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh
deleted file mode 100644
index 7a598626d0..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/include_perms_0601_cloudinit.fail.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-source $SHARED/rsyslog_log_utils.sh
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files and permissions
-chmod 0600 ${RSYSLOG_TEST_LOGS[0]}
-chmod 0601 ${RSYSLOG_TEST_LOGS[1]}
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh
new file mode 100755
index 0000000000..b3846fec47
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_group_read.pass.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# platform = multi_platform_sle,multi_platform_ubuntu
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+CHATTR="chmod"
+ATTR_VALUE="0640"
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh
new file mode 100755
index 0000000000..0b4cb5dce0
--- /dev/null
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/mixed_correct_attr_stricter.pass.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+# platform = multi_platform_all
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+CHATTR="chmod"
+ATTR_VALUE="0400"
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh
deleted file mode 100755
index fbdcd18f77..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0600.pass.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check if log file with permissions 0600 in rsyslog.conf passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0600
-
-# setup test data
-create_rsyslog_test_logs 4
-
-# setup all files with incorrect permission
-chmod 0601 "${RSYSLOG_TEST_LOGS[@]}"
-
-# setup the real logfile with correct permissions
-chmod $PERMS "${RSYSLOG_TEST_LOGS[0]}"
-
-# add rule with 0600 permissions log file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*        ${RSYSLOG_TEST_LOGS[0]}
-
- *.*        ${RSYSLOG_TEST_LOGS[1]}
-
-authpriv.*        /nonexistent_file
-
-# *.*        /irrelevant_file
-
-\$something /irrelevant_file
-
-EOF
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh
deleted file mode 100755
index 75e9558c63..0000000000
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/tests/perms_0601.fail.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check if log file with permissions 0601 in rsyslog.conf fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-PERMS=0601
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log file and permissions
-chmod $PERMS ${RSYSLOG_TEST_LOGS[0]}
-
-# add rule with 0601 permissions log file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-cron.*        /nonexistent_file
-
- authpriv.*        /irrelevant_file
-
-# *.*        /irrelevant_file
-
-\$something /irrelevant_file
-
-something.*	${RSYSLOG_TEST_LOGS[2]}
-
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template
index fc9e8844b6..81d6220415 100644
--- a/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/ansible.template
@@ -20,7 +20,7 @@
 - name: '{{{ rule_title }}} - Get include files directives'
   ansible.builtin.shell: |
     set -o pipefail
-    grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut  -d"\"" -f 2 || true
+    awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' {{ rsyslog_etc_config }} || true
   register: rsyslog_new_inc
   changed_when: False
 
@@ -61,8 +61,9 @@
 - name: '{{{ rule_title }}} -Setup log files attribute'
   ansible.builtin.file:
     path: "{{ item }}"
-    owner: '{{ ( "{{{ ATTRIBUTE }}}" is match("owner")) | ternary({{{ VALUE }}}, omit) }}'
-    group: '{{ ( "{{{ ATTRIBUTE }}}" is match("groupowner")) | ternary({{{ VALUE }}} , omit) }}'
+    {{{ 'owner: ' ~ VALUE if ATTRIBUTE == "owner" }}}
+    {{{- 'group: ' ~ VALUE if ATTRIBUTE == "groupowner" }}}
+    {{{- 'mode: ' ~ VALUE if ATTRIBUTE == "permissions" }}}
     state: file
   loop: "{{ log_files | list | flatten | unique }}"
   failed_when: false
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template
index ab4a563dc5..d6755d5692 100644
--- a/shared/templates/rsyslog_logfiles_attributes_modify/bash.template
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/bash.template
@@ -48,7 +48,8 @@ do
 	# * Strip quotes and closing brackets from paths.
 	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
 	# * From the remaining valid rows select only fields constituting a log file path
-	# Text file column is understood to represent a log file path if and only if all of the following are met:
+	# Text file column is understood to represent a log file path if and only if all of the
+	# following are met:
 	# * it contains at least one slash '/' character,
 	# * it is preceded by space
 	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
@@ -60,8 +61,8 @@ do
 		FILTERED_PATHS=$(awk '{if(NF>=2&&($NF~/^\//||$NF~/^-\//)){sub(/^-\//,"/",$NF);print $NF}}' <<< "${LINES_WITH_PATHS}")
 		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" <<< "${FILTERED_PATHS}")
 		MATCHED_ITEMS=$(sed -e "/^$/d" <<< "${CLEANED_PATHS}")
-		# Since above sed command might return more than one item (delimited by newline), split the particular
-		# matches entries into new array specific for this log file
+		# Since above sed command might return more than one item (delimited by newline), split
+		# the particular matches entries into new array specific for this log file
 		readarray -t ARRAY_FOR_LOG_FILE <<< "$MATCHED_ITEMS"
 		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
 		# items from newly created array for this log file
@@ -71,7 +72,8 @@ do
 	fi
 done
 
-# Check for RainerScript action log format which might be also multiline so grep regex is a bit curly
+# Check for RainerScript action log format which might be also multiline so grep regex is a bit
+# curly:
 # extract possibly multiline action omfile expressions
 # extract File="logfile" expression
 # match only "logfile" expression
@@ -82,22 +84,10 @@ do
 	LOG_FILE_PATHS+=("$(echo "${OMFILE_LINES}"| grep -oE "\"([/[:alnum:][:punct:]]*)\""|tr -d "\"")")
 done
 
-FILE_PARAM="{{{ ATTRIBUTE }}}"
-FILE_CMD=""
-case "$FILE_PARAM" in
-     "groupowner")
-        FILE_CMD=$(which chgrp)
-        ;;
-     "owner")
-        FILE_CMD=$(which chown)
-        ;;
-      *)
-        echo -n "Not supported file attribute! "
-        exit 1
-      ;;
-esac
-
-# Correct the form o
+# Ensure the correct attribute if file exists
+{{{ 'FILE_CMD="chown"' if ATTRIBUTE == "owner" }}}
+{{{- 'FILE_CMD="chgrp"' if ATTRIBUTE == "groupowner" }}}
+{{{- 'FILE_CMD="chmod"' if ATTRIBUTE == "permissions" }}}
 for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
 do
 	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
@@ -105,6 +95,5 @@ do
 	then
 		continue
 	fi
-
-	$FILE_CMD "+{{{ VALUE }}}" "$LOG_FILE_PATH"
+	$FILE_CMD "{{{ VALUE }}}" "$LOG_FILE_PATH"
 done
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template
index 4f288df1c9..243d678852 100644
--- a/shared/templates/rsyslog_logfiles_attributes_modify/oval.template
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/oval.template
@@ -3,59 +3,57 @@
     {{{ oval_metadata("All syslog log files should have appropriate ownership.") }}}
     <criteria operator="AND">
       {{% if product in ["debian10", "debian11", "ubuntu1604"] %}}
-      <extend_definition comment="rsyslog daemon is used as local logging daemon"
-      definition_ref="package_rsyslog_installed" />
+      <extend_definition definition_ref="package_rsyslog_installed"
+        comment="rsyslog daemon is used as local logging daemon"/>
       {{% endif %}}
-      <criterion comment="Check if all system log files are owned by the appropriate 
-      {{{ ATTRIBUTE  }}}" test_ref="test_{{{ _RULE_ID }}}" />
+      <criterion test_ref="test_{{{ _RULE_ID }}}"
+        comment="Check if all system log files have appropriate {{{ ATTRIBUTE }}} set"/>
     </criteria>
-
   </definition>
 
-  <!-- First obtain rsyslog's $IncludeConfig directive and include() object (introduced in rsyslog
-  v8.33.0) values.  -->
-  
-  <ind:textfilecontent54_object id="object_{{{ _RULE_ID }}}_include_config_value"
-       comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
+  <!-- First obtain rsyslog's $IncludeConfig directive and include() object values.
+       The last was introduced in rsyslog v8.33.0). -->
+  <ind:textfilecontent54_object id="object_{{{ _RULE_ID }}}_include_config_value" version="1"
+       comment="rsyslog's $IncludeConfig and include() statements values.">
     <ind:filepath>/etc/rsyslog.conf</ind:filepath>
     <ind:pattern
-    operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
+      operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <!-- Turn that glob value into Perl's regex so it can be used as filepath pattern below -->
   <local_variable id="var_{{{ _RULE_ID }}}_include_config_regex" datatype="string" version="1"
-  comment="$IncludeConfig value converted to regex">
+    comment="rsyslog's include config values converted to regex.">
     <unique>
       <glob_to_regex>
         <object_component item_field="subexpression"
-                          object_ref="object_{{{ _RULE_ID }}}_include_config_value" />
+          object_ref="object_{{{ _RULE_ID }}}_include_config_value"/>
       </glob_to_regex>
     </unique>
   </local_variable>
 
-  <!-- Create a variable_object from the regex variable
-       If the variable has no values, there won't be any objects -->
-  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_include_config_regex"
-                       comment="Make variable object from regex variable" version="1">
+  <!-- Create a variable_object from the regex variable.
+       If the variable has no values, there won't be any objects. -->
+  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_include_config_regex" version="1"
+    comment="Make variable object from regex variable.">
     <ind:var_ref>var_{{{ _RULE_ID }}}_include_config_regex</ind:var_ref>
   </ind:variable_object>
 
-  <local_variable id="var_{{{ _RULE_ID }}}_syslog_config" datatype="string"
-                  version="1" comment="Locations of all rsyslog configuration files as collection">
+  <local_variable id="var_{{{ _RULE_ID }}}_syslog_config" datatype="string" version="1"
+    comment="Main rsyslog configuration file.">
     <literal_component datatype="string">^/etc/rsyslog.conf$</literal_component>
   </local_variable>
 
-  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_syslog_config"
-                       comment="Make variable object for use" version="1">
+  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_syslog_config" version="1"
+    comment="Make variable object from local variable.">
     <ind:var_ref>var_{{{ _RULE_ID }}}_syslog_config</ind:var_ref>
   </ind:variable_object>
 
-  <!-- Combine the two variable_objects into one variable_object
-       We do it this way to avoid referencing an empty variable in a state comparison, which
-       will cause a test to evaluate to fail. Combining an empty set of objects is fine though -->
-  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_all_log_files"
-                       comment="Filter out empty string" version="1">
+  <!-- Combine the two variable_objects into one variable_object.
+       We do it this way to avoid referencing an empty variable in a state comparison, which will
+       cause a test to evaluate to fail. Combining an empty set of objects is fine though. -->
+  <ind:variable_object id="object_var_{{{ _RULE_ID }}}_all_conf_files" version="1"
+    comment="Variable containing all rsyslog configuration files.">
     <set>
       <object_reference>object_var_{{{ _RULE_ID }}}_include_config_regex</object_reference>
       <object_reference>object_var_{{{ _RULE_ID }}}_syslog_config</object_reference>
@@ -64,74 +62,72 @@
 
   <!-- In element filepath of object_rfg_log_files_paths we need to pass a list of values,
        a list of objects won't do. So we make a local_variable from the variable_objects. -->
-  <local_variable id="var_{{{ _RULE_ID }}}_all_log_files" datatype="string" version="1"
-                  comment="Locations of all rsyslog configuration files as collection">
-    <object_component object_ref="object_var_{{{ _RULE_ID }}}_all_log_files" item_field="value"/>
+  <local_variable id="var_{{{ _RULE_ID }}}_all_conf_files" datatype="string" version="1"
+    comment="Locations of all rsyslog configuration files as collection.">
+    <object_component object_ref="object_var_{{{ _RULE_ID }}}_all_conf_files" item_field="value"/>
   </local_variable>
 
-  <!-- For each item from that collection (particular rsyslog's configuration file path) search
-       that rsyslog's configuration file to select file paths for log files directives
-  -->
-  <ind:textfilecontent54_object id="object_{{{ _RULE_ID }}}_log_files_paths"
-                                comment="All rsyslog configuration files" version="1">
-    <ind:filepath operation="pattern match" var_ref="var_{{{ _RULE_ID }}}_all_log_files"
-                  var_check="at least one" />
-    <!-- Chunk of text retrieved from rsyslog's configuration file is considered
-         to constitute a log file path if all of the following conditions are met:
-         * the string represents a regular file on particular file system
-           (verified via corresponding file_state below),
-         * the chunk of text is in the last column in the row,
-           (possibly suffixed by ';' character and rsyslog Template name),
-         * contains at least one slash '/' character, and simultaneously
-           doesn't contain any of ';', ':' and space characters,
-         * the chunk was retrieved from a row not starting with space, '#',
-           or '$' characters
-    -->
-    <ind:pattern 
-     operation="pattern match">^\s*[^(\s|#|\$)]+\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$</ind:pattern>
+  <!-- For each item from that collection (particular rsyslog's configuration files paths) search
+       that rsyslog's configuration files to select file paths for log files directives -->
+  <ind:textfilecontent54_object id="object_{{{ _RULE_ID }}}_log_files_paths" version="1"
+    comment="All rsyslog log files collected from rsyslog configuration files." >
+    <ind:filepath operation="pattern match" var_check="at least one"
+      var_ref="var_{{{ _RULE_ID }}}_all_conf_files"/>
+      <!-- Chunk of text retrieved from rsyslog's configuration file is considered to constitute
+           a log file path if all of the following conditions are met:
+            * the string represents a regular file on particular file system
+              (verified via corresponding file_state below),
+            * the chunk of text is in the last column in the row,
+              (possibly suffixed by ';' character and rsyslog Template name),
+            * contains at least one slash '/' character, and simultaneously doesn't contain any
+              of ';', ':' and space characters,
+            * the chunk was retrieved from a row not starting with space, '#', or '$' characters
+      -->
+    <ind:pattern
+      operation="pattern match">^\s*[^(\s|#|\$)]+\s+.*\s+-?[\w\(="\s]*(\/[^:;\s"]+)+.*$</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
-    <filter action="exclude">state_{{{ _RULE_ID }}}_ownership_ignore_include_paths</filter>
+    <filter action="exclude">state_{{{ _RULE_ID }}}_ignore_include_paths</filter>
   </ind:textfilecontent54_object>
 
-  <ind:textfilecontent54_state id="state_{{{ _RULE_ID }}}_ownership_ignore_include_paths"
-                               comment="ignore" version="1">
-    <!-- Among the paths matched in object_rfp_log_files_paths there can be paths from
-         include() or $IncludeConfig statements.
-         These paths are conf files, not log files. Their groupownership don't need to be as
-         required for log files, thus, lets exclude them from the list of objects found
-    -->
+  <ind:textfilecontent54_state id="state_{{{ _RULE_ID }}}_ignore_include_paths"
+    comment="ignore" version="1">
+    <!-- Among the paths matched in object_{{{ _RULE_ID }}}_log_files_paths there can be paths
+         from include() or $IncludeConfig statements. These paths are conf files, not log files.
+         Their properties don't need to be as required for log files, thus, lets exclude them
+         from the list of objects found. -->
     <ind:text
     operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
   </ind:textfilecontent54_state>
 
   <!-- Define OVAL variable to hold all the various system log files locations
-       retrieved from the different rsyslog configuration files
-  -->
+       retrieved from the different rsyslog configuration files. -->
   <local_variable id="var_{{{ _RULE_ID }}}_log_files_paths" datatype="string" version="1"
-                  comment="File paths of all rsyslog configuration files">
-    <object_component item_field="subexpression" object_ref="object_{{{ _RULE_ID }}}_log_files_paths" />
+    comment="File paths of all rsyslog log files">
+    <object_component item_field="subexpression"
+      object_ref="object_{{{ _RULE_ID }}}_log_files_paths" />
   </local_variable>
 
-  <!-- Perform the test if all rsyslog system log files are owned by the appropriate group -->
-  <unix:file_test check="all" check_existence="all_exist" id="test_{{{ _RULE_ID }}}" version="1"
-                  comment="System log files are owned by the appropriate group">
-    <unix:object object_ref="object_rsyslog_files_{{{ _RULE_ID }}}_ownership" />
+  <!-- Perform the test if all rsyslog system log files have appropriate attribute -->
+  <unix:file_test id="test_{{{ _RULE_ID }}}" check="all" check_existence="all_exist" version="1"
+    comment="System log files have appropriate {{{ ATTRIBUTE }}} set">
+    <unix:object object_ref="object_{{{ _RULE_ID }}}_{{{ ATTRIBUTE }}}" />
     <unix:state state_ref="state_{{{ _RULE_ID }}}" />
   </unix:file_test>
 
-  <unix:file_object id="object_rsyslog_files_{{{ _RULE_ID }}}_ownership"
-                    comment="Various system log files" version="1">
-    <unix:filepath datatype="string" var_ref="var_{{{ _RULE_ID }}}_log_files_paths"
-                   var_check="at least one" />
+  <unix:file_object id="object_{{{ _RULE_ID }}}_{{{ ATTRIBUTE }}}" version="1"
+    comment="All system log files collected from rsyslog configuration files">
+    <unix:filepath datatype="string" var_check="at least one"
+      var_ref="var_{{{ _RULE_ID }}}_log_files_paths"/>
   </unix:file_object>
 
   <unix:file_state id="state_{{{ _RULE_ID }}}" version="1">
     <unix:type operation="equals">regular</unix:type>
     {{% if ATTRIBUTE == "groupowner" %}}
     <unix:group_id datatype="int">{{{ VALUE }}}</unix:group_id>
-    {{% else %}}
+    {{% elif ATTRIBUTE == "owner" %}}
     <unix:user_id datatype="int">{{{ VALUE }}}</unix:user_id>
+    {{% else %}}
+    {{{ STATEMODE | indent(4) }}}
    {{% endif %}}
   </unix:file_state>
-
 </def-group>
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/template.py b/shared/templates/rsyslog_logfiles_attributes_modify/template.py
new file mode 100644
index 0000000000..9ea31c9a6b
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/template.py
@@ -0,0 +1,18 @@
+def preprocess(data, lang):
+    if lang == "oval" and data["attribute"] == 'permissions':
+        # create STATEMODE used in the OVAL template by processing the octal permission and
+        # creating the equivalent permission fields of "unix:file_state" element.
+        mode = data["value"]
+        fields = [
+            'oexec', 'owrite', 'oread', 'gexec', 'gwrite', 'gread',
+            'uexec', 'uwrite', 'uread', 'sticky', 'sgid', 'suid']
+        mode_int = int(mode, 8)
+        mode_str = ""
+        for field in fields:
+            if mode_int & 0x01 == 0:
+                mode_str = (
+                    "<unix:{field} datatype=\"boolean\">false</unix:{field}>\n{mode_str}".format(
+                        field=field, mode_str=mode_str))
+            mode_int = mode_int >> 1
+        data["statemode"] = mode_str.rstrip("\n")
+    return data
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh
deleted file mode 100755
index db7e5261eb..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_other.fail.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# non root user log from $IncludeConfig fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-ADDCOMMAND="useradd"
-CHATTR="chown"
-{{% else %}}
-ADDCOMMAND="groupadd"
-CHATTR="chgrp"
-{{% endif %}}
-
-USER_TEST=testssg
-$ADDCOMMAND $USER_TEST
-
-USER_ROOT=root
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files ownership
-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*      ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-\$IncludeConfig ${test_conf}
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh
deleted file mode 100755
index d79ae23cfc..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other.fail.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# non root user log from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-ADDCOMMAND="useradd"
-CHATTR="chown"
-{{% else %}}
-ADDCOMMAND="groupadd"
-CHATTR="chgrp"
-{{% endif %}}
-
-USER_TEST=testssg
-$ADDCOMMAND $USER_TEST
-
-USER_ROOT=root
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files ownership
-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*      ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh
deleted file mode 100644
index 7869a180a8..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_other_IncludeConfig_is_other_RainerLogClause.fail.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# root user log from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-ADDCOMMAND="useradd"
-CHATTR="chown"
-{{% else %}}
-ADDCOMMAND="groupadd"
-CHATTR="chgrp"
-{{% endif %}}
-
-USER_TEST=testssg
-$ADDCOMMAND $USER_TEST
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files ownership
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[1]}
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-{{% if ATTRIBUTE == "owner" %}}
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-
-*.*     action(type="omfile" FileCreateMode="0640" fileOwner="$USER_TEST" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}")
-EOF
-{{% else %}}
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-
-*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="$USER_TEST" File="${RSYSLOG_TEST_LOGS[2]}")
-EOF
-{{% endif %}}
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh
deleted file mode 100755
index e80395ca99..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root.pass.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# root user log from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-
-{{% if ATTRIBUTE == "owner" %}}
-CHATTR="chown"
-{{% else %}}
-CHATTR="chgrp"
-{{% endif %}}
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh
deleted file mode 100755
index e7b4905dc5..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_other.fail.sh
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# non root user log from include() fails.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-ADDCOMMAND="useradd"
-CHATTR="chown"
-{{% else %}}
-ADDCOMMAND="groupadd"
-CHATTR="chgrp"
-{{% endif %}}
-
-USER_ROOT=root
-
-USER_TEST=testssg
-$ADDCOMMAND $USER_TEST
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files ownership
-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER_ROOT ${RSYSLOG_TEST_LOGS[1]}
-$CHATTR $USER_TEST ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh
deleted file mode 100755
index 6389e6ea3b..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root.pass.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# root user log from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-CHATTR="chown"
-{{% else %}}
-CHATTR="chgrp"
-{{% endif %}}
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[2]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh
deleted file mode 100755
index 6b81a77c2f..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_is_root_IncludeConfig_is_root_RainerLogClause.pass.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# root user log from include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-CHATTR="chown"
-{{% else %}}
-CHATTR="chgrp"
-{{% endif %}}
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 3
-
-# setup test log files ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[2]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create test2 configuration file
-test_conf2=${RSYSLOG_TEST_DIR}/test2.conf
-cat << EOF > ${test_conf2}
-# rsyslog configuration file
-
-#### RULES ####
-
-
-*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="root" File="${RSYSLOG_TEST_LOGS[2]}")
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(file="${test_conf}")
-
-\$IncludeConfig ${test_conf2}
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh
deleted file mode 100755
index 78b105abf3..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/include_multiline_is_root.pass.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/bash
-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8,multi_platform_sle
-
-# Check rsyslog.conf with root user log from rules and
-# root user log from multiline include() passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-CHATTR="chown"
-{{% else %}}
-CHATTR="chgrp"
-{{% endif %}}
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 2
-
-# setup test log files ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]}
-
-# create test configuration file
-test_conf=${RSYSLOG_TEST_DIR}/test1.conf
-cat << EOF > ${test_conf}
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[1]}
-EOF
-
-# create rsyslog.conf configuration file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*     ${RSYSLOG_TEST_LOGS[0]}
-
-#### MODULES ####
-
-include(
-   file="${test_conf}"
-)
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh
deleted file mode 100755
index afce21fa27..0000000000
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_root.pass.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
-
-# Check if log file with root user in rsyslog.conf passes.
-
-source $SHARED/rsyslog_log_utils.sh
-
-{{% if ATTRIBUTE == "owner" %}}
-CHATTR="chown"
-{{% else %}}
-CHATTR="chgrp"
-{{% endif %}}
-
-USER=root
-
-# setup test data
-create_rsyslog_test_logs 1
-
-# setup test log file ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-
-# add rule with root user owned log file
-cat << EOF > $RSYSLOG_CONF
-# rsyslog configuration file
-
-#### RULES ####
-
-*.*        ${RSYSLOG_TEST_LOGS[0]}
-
-EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh
similarity index 53%
rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh
rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh
index 1afe20823c..dc362ae003 100755
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/is_other.fail.sh
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_correct_attr.pass.sh
@@ -1,33 +1,31 @@
 #!/bin/bash
 # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
 
-# Check if log file with non root user in rsyslog.conf fails.
-
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
 source $SHARED/rsyslog_log_utils.sh
 
 {{% if ATTRIBUTE == "owner" %}}
-ADDCOMMAND="useradd"
 CHATTR="chown"
-{{% else %}}
-ADDCOMMAND="groupadd"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
 CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
 {{% endif %}}
 
-USER=testssg
-
-$ADDCOMMAND $USER
-
-# setup test data
+# create one test log file
 create_rsyslog_test_logs 1
 
-# setup test log file ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
 
-# add rule with non-root user owned log file
+# add rule with test log file
 cat << EOF > $RSYSLOG_CONF
 # rsyslog configuration file
 
 #### RULES ####
-
 *.*     ${RSYSLOG_TEST_LOGS[0]}
+
 EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh
similarity index 51%
rename from shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh
rename to shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh
index b03268fe3e..c742f41039 100755
--- a/shared/templates/rsyslog_logfiles_attributes_modify/tests/IncludeConfig_is_root.pass.sh
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_correct_attr.pass.sh
@@ -1,45 +1,45 @@
 #!/bin/bash
 # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
 
-# Check rsyslog.conf with root user log from rules and
-# root user log from $IncludeConfig passes.
-
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
 source $SHARED/rsyslog_log_utils.sh
 
 {{% if ATTRIBUTE == "owner" %}}
 CHATTR="chown"
-{{% else %}}
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
 CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
 {{% endif %}}
 
-USER=root
-
-# setup test data
+# create two test log file
 create_rsyslog_test_logs 2
 
-# setup test log files ownership
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[0]}
-$CHATTR $USER ${RSYSLOG_TEST_LOGS[1]}
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
 
-# create test configuration file
+# create test configuration file with rule for second test log file
 test_conf=${RSYSLOG_TEST_DIR}/test1.conf
 cat << EOF > ${test_conf}
-# rsyslog configuration file
+# rsyslog test configuration file
 
 #### RULES ####
-
 *.*     ${RSYSLOG_TEST_LOGS[1]}
+
 EOF
 
-# create rsyslog.conf configuration file
+# add rule with first test log file plus an include statement
 cat << EOF > $RSYSLOG_CONF
 # rsyslog configuration file
 
 #### RULES ####
-
 *.*     ${RSYSLOG_TEST_LOGS[0]}
 
 #### MODULES ####
-
 \$IncludeConfig ${test_conf}
+
 EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh
new file mode 100755
index 0000000000..a12d0bc653
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_include_incorrect_attr.fail.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create two test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# create test configuration file with rule for second test log file
+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
+cat << EOF > ${test_conf}
+# rsyslog test configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[1]}
+
+EOF
+
+# add rule with first test log file plus an include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*        ${RSYSLOG_TEST_LOGS[0]}
+
+#### MODULES ####
+\$IncludeConfig ${test_conf}
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh
new file mode 100755
index 0000000000..25430db033
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/legacy_incorrect_attr.fail.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create one test log file
+create_rsyslog_test_logs 1
+
+# setup test log file property
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]}
+
+# add rule with non-root user owned log file
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh
new file mode 100755
index 0000000000..c1c5758d80
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_correct_attr.pass.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh
new file mode 100755
index 0000000000..0235130534
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_correct_attr.pass.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 3
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]}
+
+# create first test configuration file with legacy rule for second test log file
+test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf
+cat << EOF > ${test_conf1}
+# rsyslog test configuration file with legacy syntax
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[1]}
+
+EOF
+
+# create second test configuration file with RainerScript rule for third test log file
+test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf
+cat << EOF > ${test_conf2}
+# rsyslog test configuration file with RainerScript syntax
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}")
+
+EOF
+
+# add rule with first test log file plus two mixed include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+
+#### MODULES ####
+\$IncludeConfig ${test_conf1}
+
+include(file="${test_conf2}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh
new file mode 100755
index 0000000000..bed0afaf5e
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_legacy.fail.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 3
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[2]}
+
+# create first test configuration file with legacy rule for second test log file
+test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf
+cat << EOF > ${test_conf1}
+# rsyslog test configuration file with legacy syntax
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[1]}
+
+EOF
+
+# create second test configuration file with RainerScript rule for third test log file
+test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf
+cat << EOF > ${test_conf2}
+# rsyslog test configuration file with RainerScript syntax
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}")
+
+EOF
+
+# add rule with first test log file plus two mixed include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+
+#### MODULES ####
+\$IncludeConfig ${test_conf1}
+
+include(file="${test_conf2}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh
new file mode 100755
index 0000000000..83c69b3a17
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_include_incorrect_attr_rainer.fail.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 3
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[2]}
+
+# create first test configuration file with legacy rule for second test log file
+test_conf1=${RSYSLOG_TEST_DIR}/legacy.conf
+cat << EOF > ${test_conf1}
+# rsyslog test configuration file with legacy syntax
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[1]}
+
+EOF
+
+# create second test configuration file with RainerScript rule for third test log file
+test_conf2=${RSYSLOG_TEST_DIR}/rainerscript.conf
+cat << EOF > ${test_conf2}
+# rsyslog test configuration file with RainerScript syntax
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[2]}")
+
+EOF
+
+# add rule with first test log file plus two mixed include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+
+#### MODULES ####
+\$IncludeConfig ${test_conf1}
+
+include(file="${test_conf2}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh
new file mode 100755
index 0000000000..43a6f2648d
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_cloudinit.fail.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+:syslogtag, isequal, "[CLOUDINIT]" ${RSYSLOG_TEST_LOGS[1]}
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh
new file mode 100755
index 0000000000..f459e7377b
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_legacy.fail.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh
new file mode 100755
index 0000000000..67193b69d8
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/mixed_incorrect_attr_rainer.fail.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create three test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# add rules with both syntax for different test log files
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     ${RSYSLOG_TEST_LOGS[0]}
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh
new file mode 100755
index 0000000000..abdb09c485
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_correct_attr.pass.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+{{% endif %}}
+
+# create one test log file
+create_rsyslog_test_logs 1
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+
+# add rule with test log file
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh
new file mode 100755
index 0000000000..8b73578e39
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_correct_attr.pass.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+{{% endif %}}
+
+# create two test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# create test configuration file with rule for second test log file
+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
+cat << EOF > ${test_conf}
+# rsyslog test configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
+
+# add rule with first test log file plus an include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+#### MODULES ####
+include(file="${test_conf}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh
new file mode 100755
index 0000000000..4c25c09e2e
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_incorrect_attr.fail.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create two test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# create test configuration file with rule for second test log file
+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
+cat << EOF > ${test_conf}
+# rsyslog test configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
+
+# add rule with first test log file plus an include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+#### MODULES ####
+include(file="${test_conf}")
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh
new file mode 100755
index 0000000000..508a5cf6eb
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_correct_attr.pass.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+{{% endif %}}
+
+# create two test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# create test configuration file with rule for second test log file
+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
+cat << EOF > ${test_conf}
+# rsyslog test configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
+
+# add rule with first test log file plus an include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+#### MODULES ####
+include(
+   file="${test_conf}"
+)
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh
new file mode 100755
index 0000000000..49fada4cd4
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_include_multiline_incorrect_attr.fail.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_VALUE="root"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_VALUE="0600"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create two test log file
+create_rsyslog_test_logs 2
+
+# setup test log file property
+$CHATTR $ATTR_VALUE ${RSYSLOG_TEST_LOGS[0]}
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[1]}
+
+# create test configuration file with rule for second test log file
+test_conf=${RSYSLOG_TEST_DIR}/test1.conf
+cat << EOF > ${test_conf}
+# rsyslog test configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[1]}")
+
+EOF
+
+# add rule with first test log file plus an include statement
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+#### MODULES ####
+include(
+   file="${test_conf}"
+)
+
+EOF
diff --git a/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh
new file mode 100755
index 0000000000..b17eb6b744
--- /dev/null
+++ b/shared/templates/rsyslog_logfiles_attributes_modify/tests/rainer_incorrect_attr.fail.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle
+
+# Declare variables used for the tests and define the create_rsyslog_test_logs function
+source $SHARED/rsyslog_log_utils.sh
+
+{{% if ATTRIBUTE == "owner" %}}
+CHATTR="chown"
+ATTR_INCORRECT_VALUE="cac_testuser"
+useradd $ATTR_INCORRECT_VALUE
+{{% elif ATTRIBUTE == "groupowner" %}}
+CHATTR="chgrp"
+ATTR_INCORRECT_VALUE="cac_testgroup"
+groupadd $ATTR_INCORRECT_VALUE
+{{% else %}}
+CHATTR="chmod"
+ATTR_INCORRECT_VALUE="0666"
+{{% endif %}}
+
+# create one test log file
+create_rsyslog_test_logs 1
+
+# setup test log file property
+$CHATTR $ATTR_INCORRECT_VALUE ${RSYSLOG_TEST_LOGS[0]}
+
+# add rule with non-root user owned log file
+cat << EOF > $RSYSLOG_CONF
+# rsyslog configuration file
+
+#### RULES ####
+*.*     action(type="omfile" FileCreateMode="0640" fileOwner="root" fileGroup="hoiadm" File="${RSYSLOG_TEST_LOGS[0]}")
+
+EOF
-- 
2.39.1