Align networkmanager_dns_mode to the RHEL 9 STIG #11745
Conversation
Mab879
added
bugfix
|
Start a new ephemeral environment with changes proposed in this pull request: ol9 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
|
The problem is that the Ansible remediation still adds or doesn't remove the spaces. Ansible has an option that could be used https://docs.ansible.com/ansible/latest/collections/community/general/ini_file_module.html#parameter-no_extra_spaces. OTOH Bash remediation is OK. |
I have updated the Ansible remediation. |
| @@ -733,6 +733,7 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul | |||
| value: "{{{ value }}}" | |||
| create: yes | |||
| mode: 0644 | |||
| ignore_spaces: false | |||
There was a problem hiding this comment.
The tests still fail.
If we do this they should stop failing:
| ignore_spaces: false | |
| ignore_spaces: false | |
| no_extra_spaces: true |
Mab879
force-pushed
the
adjust_networkmanager_dns_mode_for_stig
branch
from
81e63be
to
a53e09c
Compare
| @@ -6,7 +6,7 @@ | |||
|
|
|||
| {{{ ansible_instantiate_variables("var_networkmanager_dns_mode") }}} | |||
|
|
|||
| {{{ ansible_ini_file_set("/etc/NetworkManager/NetworkManager.conf", "main", "dns", "{{ var_networkmanager_dns_mode }}") }}} | |||
| {{{ ansible_ini_file_set("/etc/NetworkManager/NetworkManager.conf", "main", "dns", "{{ var_networkmanager_dns_mode }}", true) }}} | |||
There was a problem hiding this comment.
I'm sorry I was wrong, this isn't sufficient, they still fail. We need also to update the macro here.
| {{{ ansible_ini_file_set("/etc/NetworkManager/NetworkManager.conf", "main", "dns", "{{ var_networkmanager_dns_mode }}", true) }}} | |
| {{{ ansible_ini_file_set("/etc/NetworkManager/NetworkManager.conf", "main", "dns", "{{ var_networkmanager_dns_mode }}", description=None, ignore_spaces=True) }}} | |
Mab879
force-pushed
the
adjust_networkmanager_dns_mode_for_stig
branch
from
a53e09c
to
95eadcc
Compare
|
Code Climate has analyzed commit 95eadcc and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.3% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
The Automatus CI jobs fail because it isn't possible to start the networkmanager service in a container environment that we use in the CI. I have executed the tests locally using a RHEL 9 virtual machine backed and they all passed:
jcerny@fedora:~/work/git/scap-security-guide (pr/11745)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 networkmanager_dns_mode
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-03-27-1640/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_networkmanager_dns_mode
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script correct_default.pass.sh using profile (all) OK
INFO - Script missing.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script space.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/11745)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible networkmanager_dns_mode
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-03-27-1642/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_networkmanager_dns_mode
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script correct_default.pass.sh using profile (all) OK
INFO - Script missing.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script space.fail.sh using profile (all) OK
Description:
Removes the ability to add space around the
dns=noneper the STIG SCAP content.Rationale:
Fixes #11702