From 7bffcc14bae536c7a5922c4dbe0d836d298452b1 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Wed, 9 Sep 2026 11:33:47 +0100
Subject: [PATCH 1/2] Enforce upper bound for unlock_time

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../accounts_passwords_pam_faillock_unlock_time/rule.yml       | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
index faa85597accf..43d2bcf8c0c6 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
@@ -108,3 +108,6 @@ template:
     ext_variable: var_accounts_passwords_pam_faillock_unlock_time
     description: The unlock time after number of failed logins should be set correctly.
     variable_lower_bound: use_ext_variable
+{{% if product == 'ubuntu2404' %}}
+    variable_upper_bound: use_ext_variable
+{{% endif %}}

From 360fd42ab66a40ff4124f8ed89f3544b23c8d618 Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Fri, 11 Sep 2026 12:08:04 +0100
Subject: [PATCH 2/2] Update description too

Signed-off-by: Alan Moore <alan.moore@canonical.com>
---
 .../accounts_passwords_pam_faillock_unlock_time/rule.yml      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
index 43d2bcf8c0c6..24cf2dec6172 100644
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml
@@ -9,7 +9,11 @@ description: |-
 
     Ensure that the file <tt>/etc/security/faillock.conf</tt> contains the following entry:
     <tt>unlock_time=&lt;interval-in-seconds&gt;</tt> where
+{{% if product == 'ubuntu2404' %}}
+    <tt>interval-in-seconds</tt> is <tt>{{{xccdf_value("var_accounts_passwords_pam_faillock_unlock_time") }}}</tt>.
+{{% else %}}
     <tt>interval-in-seconds</tt> is <tt>{{{xccdf_value("var_accounts_passwords_pam_faillock_unlock_time") }}}</tt> or greater.
+{{% endif %}}
 
     pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
     defined to work as expected. In order to avoid any errors when manually editing these files,