Add remediation for RHEL-08-040090

[ferricoxide]

It appears that the OSCAP content already takes care of this, but this will still show up on some hardening-scans. Adding this state to make it easier to point auditors to a block of code that easily tells them, "yes, watchmaker is setting this, appropriately"

Closes #422

[lorengordon]

Curious about the choice of onchanges...? Seems the states ought to be safe to use just requires, due to unless for module.run and firewalld.present already being stateful?

[ferricoxide]

Modifications to firewalld can happen to either the running (in memory) or on-disk changes. The two conditionals are meant to account for both:

• the onchanges detects that the on-disk has been changed
• the unless detects the in-memory (i.e., "active") configuration-status

Basically, tried to implement a "update the running configuration IFF there was a change on disk and the current running-configuration is not the target state."

tests not passing

[ferricoxide]

Yeah. I saw the failure:

----------
          ID: Set Minimum Ports
    Function: firewalld.present
        Name: drop
      Result: False
     Comment: State 'firewalld.present' was not found in SLS 'ash-linux.el8.STIGbyID.cat2.RHEL-08-040090'
              Reason: 'firewalld' __virtual__ returned False: firewall-cmd is not available, firewalld is probably not installed.

But was tied up with other task to figure out why it didn't like that. I mean, firewalld.present looks to be a valid module?

I'll get to it next week.

[ferricoxide]

Ah. Ok. Not so much:

State 'firewalld.present' was not found in SLS 'ash-linux.el8.STIGbyID.cat2.RHEL-08-040090'

As:

Reason: 'firewalld' virtual returned False: firewall-cmd is not available, firewalld is probably not installed.

Guessing the VM-setup for the testing-container is missing the setup tasks that were in the EL7-based testing-containers.

[ferricoxide]

Looks like firewalld was in the EL7-specific test-setup file but not EL8's. Since it needs to be in both – and will likely need to be in any future ELx platforms we need to support, I cut it from the EL7-specific test-setup and moved it to the common setup file.