Fix no_empty_passwords remediation for RHCOS 9

On RHCOS 9, /usr/bin/authselect exists but PAM files are not managed
by authselect. Using authselect rewrites the PAM stack with RHEL 8
era templates (including pam_fprintd.so and a 2018 authselect header)
that don't match the actual RHCOS 9 PAM configuration.

After applying the authselect-based remediation, the compliance scan
still reports FAIL because the OVAL check doesn't recognize the
RHEL 8 PAM template as a valid remediated state.

Fix: Add an rhcos-specific branch that uses direct sed (via
bash_remove_pam_module_option) to surgically remove nullok from the
existing PAM files, preserving the RHCOS 9 PAM stack.

Verified on OCP 4.22 (RHCOS 9.8): no_empty_passwords flips from
FAIL to PASS with the direct sed approach.

Author: sebrandon1

linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/bash/shared.sh

@@ -1,4 +1,4 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_rhcos
 # reboot = false
 # strategy = configure
 # complexity = low
@@ -38,6 +38,17 @@ sed -i -E '/^Auth-Initial:/,/^[^[:space:]]/ {
 }' "$config_file"
 
 DEBIAN_FRONTEND=noninteractive pam-auth-update
+{{% elif 'rhcos' in product %}}
+# RHCOS uses static PAM files not managed by authselect.
+# Although /usr/bin/authselect exists on RHCOS 9, using it rewrites
+# the PAM stack with RHEL 8 era templates (pam_fprintd.so, etc.)
+# that don't match the actual RHCOS 9 PAM configuration, causing
+# the compliance scan to still report FAIL after remediation.
+# Use direct sed to surgically remove nullok instead.
+{{{ bash_remove_pam_module_option('/etc/pam.d/system-auth', 'auth', 'sufficient', 'pam_unix.so', 'nullok') }}}
+{{{ bash_remove_pam_module_option('/etc/pam.d/system-auth', 'password', 'sufficient', 'pam_unix.so', 'nullok') }}}
+{{{ bash_remove_pam_module_option('/etc/pam.d/password-auth', 'auth', 'sufficient', 'pam_unix.so', 'nullok') }}}
+{{{ bash_remove_pam_module_option('/etc/pam.d/password-auth', 'password', 'sufficient', 'pam_unix.so', 'nullok') }}}
 {{% else %}}
 if [ -f /usr/bin/authselect ]; then
     {{{ bash_enable_authselect_feature('without-nullok') }}}