Fix tests for file_permissions, file_owner, file_groupowner

[mpurg]

Description:

• Fixed tests for file_permissions, file_owner, file_groupowner templates

Rationale:

• Several tests did not fail when run on a compliant system because the permissions/ownership were not modified

[openshift-ci]

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11814
This image was built from commit: eda77ab

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11814

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11814 make deploy-local

[jan-cerny]

@mpurg

Do you have any rule that uses these templates with the file_regex parameter and where these templated scenarios aren't shadowed? I found multiple rules using these templates with the file_regex parameter but all of them shadow the templated test scenarios. Do you know where the changes are seen in practice? Also, do you plan to remove the shadowing files?

What about other templated test scenarios that also have the echo "Create specific tests for this rule because of regex" part? Can they be also changed?

[mpurg]

Hm... I was implementing new rules for the Ubuntu 22.04 STIG (to be PR-ed) and noticed that these tests were failing. There weren't any custom tests in the rules I was using as a template (file_owner/groupowner/permissions_system_journal), and I didn't quite understand why this can't be solved by applying the solution from the remediation, so I adapted the tests.
I can implement the shadow tests if that's considered the correct approach.

Regarding the other test scenarios, I guess I didn't trip over them because they are pass tests and will thus succeed on a system where ownership/permissions are already compliant.

[dodys]

/packit retest-failed

[jan-cerny]

@mpurg thanks for explanation!

[marcusburghardt]

@mpurg , could you rebase the PR so the sssd_enable_pam_services no longer fails in testing-farm tests, please?

[mpurg]

@marcusburghardt done

[dodys]

/packit build

[dodys]

lgtm, thanks!

[codeclimate]

Code Climate has analyzed commit eda77ab and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

[dodys]

/packit retest-failed