Split usr_mon_logins into three focused checks: failed local (console/
tty/greeter) logins, SSH logins (usr_mon_sshlogins), and sudo/SELinux/
AppArmor rights violations (usr_mon_rightsviolations) — plus a new
usr_mon_iploc check that flags public-IP geolocation country changes.
Add usr_ctl_dnshostfile, usr_ctl_netman, and usr_ctl_wifi policies that
grant members scoped, non-root capability (hosts file ACL, NetworkManager
connection permissions) resolved from IPA group membership and
re-applied every enforcer tick.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Amir Alexander Abdelbaki