Ubuntu: Add missing nftables variables and improve remediation and checks

[dodys]

Description:

• Basically title

Rationale:

• Bug fix

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

sle15 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_nftables_loopback_traffic' differs.
--- xccdf_org.ssgproject.content_rule_set_nftables_loopback_traffic
+++ xccdf_org.ssgproject.content_rule_set_nftables_loopback_traffic
@@ -1,13 +1,15 @@
 # Remediation is applicable only in certain platforms
 if ( rpm --quiet -q nftables ); then
+
+grubfile="/boot/grub2/grub.cfg"
 
 # Implement the loopback rules:
 nft add rule inet filter input iif lo accept
 nft insert rule inet filter input ip saddr 127.0.0.0/8 counter drop
 
 # Check IPv6 is disabled, if false implement IPv6 loopback rules
-[ -n "$passing" ] && passing=""
-[ -z "$(grep "^\s*linux" /boot/grub2/grub.cfg | grep -v ipv6.disabled=1)" ] && passing="true"
+disabled="false"
+[ -f "$grubfile" ] && ! grep "^\s*linux" "$grubfile" | grep -vq "ipv6.disable=1" && disabled="true"
 
 grep -Eq "^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" \
 /etc/sysctl.conf /etc/sysctl.d/*.conf && \
@@ -15,10 +17,10 @@
 /etc/sysctl.conf /etc/sysctl.d/*.conf && sysctl net.ipv6.conf.all.disable_ipv6 | \
 grep -Eq "^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" && \
 sysctl net.ipv6.conf.default.disable_ipv6 | \
-grep -Eq "^\s*net\.ipv6\.conf\.default\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" && passing="true"
+grep -Eq "^\s*net\.ipv6\.conf\.default\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" && disabled="true"
 
 # Is IPv6 Disabled? (true/false)
-if [ "$passing" = false ] ; then
+if [ "$disabled" = false ] ; then
     nft add rule inet filter input ip6 saddr ::1 counter drop
 fi
 

[codeclimate]

Code Climate has analyzed commit bea5920 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 56.8% (0.0% change).

View more on Code Climate.

[Mab879]

/test images

[Mab879]

Thanks for the PR!

Overriding the CODEOWNERS was @dodys cannot approve his own PRs.

[Mab879]

The Automatus failures are expected, waving.