"Failed to find a valid sub check, check your constraints"

[NoRePercussions]

Problem

The following tests are failing with "Failed to find a valid sub check, check your constraints". A skim seems to indicate that all tests with sub_checks are failing.

• 1.1.1.6.a
• 1.1.1.6.b
• 1.1.1.8.a
• 1.1.1.8.b
• 1.1.1.8.c
• 1.1.22
• 1.2.1
• 1.2.2
• 1.3.1
• 1.4.4
• 1.5.4
• 1.6.1.1
• 1.6.2.1
• 1.6.2.2.a
• 1.6.2.2.b
• 1.6.2.3.a
• 1.6.2.3.b
• 1.6.2.4
• 1.6.2.5
• 1.6.3.1
• 1.6.3.2
• 2.1.10
• 2.2.1.1.a
• 2.2.1.1.b
• 2.2.1.2.c
• 2.2.1.2.d
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7.a
• 2.2.7.b
• 2.2.8
• 2.2.9
• 2.2.10
• 2.2.11
• 2.2.12
• 2.2.13
• 2.2.14
• 2.2.16
• 2.2.17
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 4.2.1.1
• 4.2.1.2

Platform

NixOS 25.05.20241209.a73246e (Warbler) x86_64 linux-bench built from source at ce03975

[NoRePercussions]

Looking at 1.1.1.6.a/b in particular: these tests are filtered to only rhel7 platforms. This was added in a massive "Improved configuration for version 1.1.0": a2c4b70f08701375e5346a8d480fe3ccea2d4df5

I have two questions after reviewing this:

• Why is this in particular gated to only rhel7, when CIS 1.1.1.6 applies in general (just under different names, e.g. 1.1.1.7 in Debian 12)? Does this use the RHEL subset of requirements specifically?
• Can the empty case be resolved to not cause warnings? I'm happy to contribute the labor with direction on how this should be resolved.