New content has different text for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions'.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -12,18 +12,6 @@
 
     any non-root local partitions.
 
-[warning]:
-This rule checks only local partitions, identified as those backed by
-a device node in /dev. Network file systems such as NFS, CIFS,
-GlusterFS and others are excluded because they do not expose local
-device nodes. The /boot and /efi partitions are
-excluded because they are special partitions usually handled by a
-systemd mount unit, and enforcing nodev on them during
-operating system installation causes issues. Partitions with the
-vfat file system type are excluded because vfat does not
-support Unix device special files, so nodev enforcement on
-them is not meaningful.
-
 [reference]:
 11
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -31,7 +31,6 @@
     lustre
     davfs
     fuse.sshfs
-    vfat
 )
 
 for partition_record in "${partitions_records[@]}"; do
@@ -39,11 +38,6 @@
     mount_point="$(echo "${partition_record}" | cut -d " " -f1)"
     device="$(echo "${partition_record}" | cut -d " " -f2)"
     device_type="$(echo "${partition_record}" | cut -d " " -f3)"
-
-    # Skip /boot and /efi partitions
-    if [[ "$mount_point" =~ ^/(boot|efi) ]]; then
-        continue
-    fi
 
     # Skip polyinstantiated directories
     if printf '%s\0' "${polyinstantiated_dirs[@]}" | grep -qxzF "$mount_point"; then
@@ -86,8 +80,8 @@
     fi
 done
 
-# Remediate unmounted /etc/fstab entries, excluding /boot, /efi, and vfat partitions
-sed -i -E '/nodev/! { /^\s*(\/dev\/\S+|UUID=\S+)\s+\/(boot|efi)/! { /^\s*(\/dev\/\S+|UUID=\S+)\s+\/\w\S*\s+vfat\s/! s;^\s*(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(\S+)(.*)$;\1 \2 \3 \4,nodev \5; } }' /etc/fstab
+# Remediate unmounted /etc/fstab entries
+sed -i -E '/nodev/! s;^\s*(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(\S+)(.*)$;\1 \2 \3 \4,nodev \5;' /etc/fstab
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -64,7 +64,6 @@
     - lustre
     - davfs
     - fuse.sshfs
-    - vfat
   when: ( not ( "kernel-core" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
     and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
     and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
@@ -99,7 +98,6 @@
     and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
     ["docker", "lxc", "openvz", "podman", "container"] ) )
   - item.mount is match('/\w')
-  - item.mount is not match('/(boot|efi)')
   - item.options is not search('nodev')
   - item.fstype not in excluded_fstypes
   with_items:
@@ -124,7 +122,7 @@
     are present with nodev option in /etc/fstab'
   ansible.builtin.replace:
     path: /etc/fstab
-    regexp: ^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/(?!boot|efi)\w\S*)\s+(?!vfat\s)(\S+)\s+(?!.*\bnodev\b)(\S+)(.*)$
+    regexp: ^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/\w\S*)\s+(\S+)\s+(?!.*\bnodev\b)(\S+)(.*)$
     replace: \1 \2 \3 \4,nodev \5
   when: ( not ( "kernel-core" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
     and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages