Rule service_dnsmasq_disabled fails after installation

[jan-cerny]

Description of problem:

In the pre-release stabilization of the 0.1.81 release, the rule service_dnsmasq_disabled fails in these tests:

• /hardening/kickstart/with-gui/cis_workstation_l1 on RHEL 10
• /hardening/kickstart/with-gui/cis_workstation_l2 on RHEL 10
• /hardening/anaconda/with-gui/cis_workstation_l1 on RHEL 8 and RHEL 9
• /hardening/anaconda/with-gui/cis_workstation_l2 on RHEL 8 and 9

SCAP Security Guide Version:

Current stabilization branch as of 2025-05-19 as of HEAD 3af66f7

Operating System Version:

10.0 RHEL-10.0-updates-20260518.1
10.2 RHEL-10.2-20260507.1
8.10 RHEL-8.10.0-updates-20260517.2
9.2 RHEL-9.2.0-updates-20260517.1
9.4 RHEL-9.4.0-updates-20260517.1
9.6 RHEL-9.6.0-updates-20260517.1
9.8 RHEL-9.8.0-20260409.3

Steps to Reproduce:

1. Run the aforementioned tests

Actual Results:

The dnsmasq service is enabled

Expected Results:

The dnsmasq service is masked

Additional Information/Debugging Steps:

• this can be somehow related to the change that we did in the stabilization of the previous release: Move to service_dnsmasq_disabled for CIS in RHEL #14525
• generally, we have problems with systemd services and kickstart/anaconda hardening, see Some systemd rules fail after kickstart installation #12282, https://bugzilla.redhat.com/show_bug.cgi?id=1834716, https://bugzilla.redhat.com/show_bug.cgi?id=1999587