Merge pull request #1 from matejak/service_mask

Improved masking support.
ComplianceAsCode · Jul 22, 2019 · 626fee4 · 626fee4
2 parents f69f4d4 + 8145bf8
commit 626fee4
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/shared/templates/template_BASH_service_disabled b/shared/templates/template_BASH_service_disabled
@@ -14,6 +14,7 @@ SYSTEMCTL_EXEC='/usr/bin/systemctl'
 {{%- endif %}}
 # Disable socket activation if we have a unit file for it
 if "$SYSTEMCTL_EXEC" list-unit-files | grep -q '^{{{ DAEMONNAME }}}.socket'; then
+    "$SYSTEMCTL_EXEC" stop '{{{ DAEMONNAME }}}.socket'
     "$SYSTEMCTL_EXEC" disable '{{{ DAEMONNAME }}}.socket'
 {{%- if MASK_SERVICE %}}
     "$SYSTEMCTL_EXEC" mask '{{{ DAEMONNAME }}}.socket'

diff --git a/shared/templates/template_OVAL_service_disabled b/shared/templates/template_OVAL_service_disabled
@@ -15,12 +15,13 @@
     <criteria comment="package {{{ PACKAGENAME }}} removed or service {{{ SERVICENAME }}} is not configured to start" operator="OR">
       <extend_definition comment="{{{ PACKAGENAME }}} removed" definition_ref="package_{{{ PACKAGENAME }}}_removed" />
       <criteria operator="AND" comment="service {{{ SERVICENAME }}} is not configured to start">
-        <criterion comment="{{{ SERVICENAME }}} not wanted by multi-user.target" test_ref="test_{{{ SERVICENAME }}}_not_wanted_by_multi_user_target" />
-        <criterion comment="{{{ SERVICENAME }}} socket not wanted by multi-user.target" test_ref="test_{{{ SERVICENAME }}}_socket_not_wanted_by_multi_user_target" />
         <criterion comment="{{{ SERVICENAME }}} is not running" test_ref="test_service_not_running_{{{ SERVICENAME }}}" />
         {{%- if MASK_SERVICE %}}
         <criterion comment="Property LoadState of service {{{ SERVICENAME }}} is masked" test_ref="test_service_loadstate_is_masked_{{{ SERVICENAME }}}" />
         <criterion comment="Property UnitFileState of service {{{ SERVICENAME }}} is masked" test_ref="test_service_unitfilestate_is_masked_{{{ SERVICENAME }}}" />
+        {{%- else %}}
+        <criterion comment="{{{ SERVICENAME }}} not wanted by multi-user.target" test_ref="test_{{{ SERVICENAME }}}_not_wanted_by_multi_user_target" />
+        <criterion comment="{{{ SERVICENAME }}} socket not wanted by multi-user.target" test_ref="test_{{{ SERVICENAME }}}_socket_not_wanted_by_multi_user_target" />
         {{%- endif %}}
       </criteria>
     </criteria>

diff --git a/...ahi/group_disable_avahi_group/rule_service_avahi-daemon_disabled/service_disabled.pass.sh b/...ahi/group_disable_avahi_group/rule_service_avahi-daemon_disabled/service_disabled.pass.sh
@@ -4,6 +4,9 @@
 
 yum -y install avahi
 
+systemctl stop avahi-daemon.service
 systemctl disable avahi-daemon.service
+systemctl mask avahi-daemon.service
+
+systemctl stop avahi-daemon.socket
 systemctl disable avahi-daemon.socket
-systemctl mask avahi-daemon