Rule chronyd_or_ntpd_set_maxpoll fails to remediate

[jan-cerny]

Description of problem:

If there is no server or pool setting in /etc/chrony.conf, the remediation for rule chronyd_or_ntpd_set_maxpoll doesn't add maxpoll to anywhere and the rule fails in the scan after remediation.

In our weekly productization runs this happens on ppc64le systems. The ppc64le systems in Testing Farm use chrony-dhcp to get the NTP server address. They don't have any server or pool in /etc/chrony.conf, but they contain this in /etc/chrony.conf:

# Use NTP servers from DHCP.
sourcedir /run/chrony-dhcp

SCAP Security Guide Version:

Current upstream master branch as of 2026-03-08 as of HEAD c4ab25f

Operating System Version:

RHEL-9.2.0-updates-20260306.0
RHEL-9.4.0-updates-20260306.1
RHEL-9.6.0-updates-20260306.0
RHEL-9.7.0-updates-20260306.0

Steps to Reproduce:

1. /hardening/host-os/oscap/stig
2. /hardening/host-os/ansible/stig

Actual Results:

chronyd_or_ntpd_set_maxpoll fails after remediation

Expected Results:

chronyd_or_ntpd_set_maxpoll passes after remediation

Additional Information/Debugging Steps:

no

[comps]

This is a rather obvious problem (seen today on RHEL-9.0 s390x).

It's not because of rule ordering, service_chronyd_enabled:pass is PASSed from the start.

Other chronyd rules that PASS modify just /etc/chrony.conf, ie.

    LC_ALL=C sed -i --follow-symlinks "s/^cmdport\\>.*/$escaped_formatted_output/gi" "/etc/chrony.conf"

which works just fine.

But then chronyd_or_ntpd_set_maxpoll tries to be fancy with

CONFIG_FILES="/etc/ntp.conf"
$pof ntpd || {
    CHRONY_D_PATH=/etc/chrony.d/
    
    mapfile -t CONFIG_FILES < <(find ${CHRONY_D_PATH}.* -type f -name '*.conf')
    
    CONFIG_FILES+=(/etc/chrony.conf)
}

and fails on

find: ‘/etc/chrony.d/.*’: No such file or directory

because it doesn't exist by default.

The obvious fix is to check if /etc/chrony.d exists before trying to find anything inside it. Also note that find with * expansion doesn't make sense - either use find to find files, or use bash wildcard expansion to find files, not both.