Sle16 dropin hipaa fixes - #14954
Conversation
If the file does not exist use the vendor provided configuration as base
…g in case /etc/pam.d/login file does not exist in etc
|
Skipping CI for Draft Pull Request. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
teacup-on-rockingchair
added
SLES
|
@teacup-on-rockingchair: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
Pull request overview
This PR updates SLE16/SLMicro6 HIPAA-related remediations to better handle “vendor default in /usr” layouts by ensuring required configuration files/directories exist before enforcing settings.
Changes:
- For SLE16/SLMicro6, bootstrap the package manager config path for
ensure_gpgcheck_globally_activatedby creating the destination directory and copying/usr/etc/zypp/zypp.confdefaults when missing. - For SLE16/SLMicro6, update
restrict_serial_port_loginsremediations to copy the vendor PAMloginconfig into/etc/pam.d/loginwhen the local file is absent.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/bash/shared.sh | Creates config directory and seeds /etc/zypp/zypp.conf from vendor defaults on SLE16/SLMicro6 before enforcing gpgcheck=1. |
| linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/shared.yml | Adds SLE16/SLMicro6 tasks to ensure the config directory exists and copies vendor defaults before applying the INI setting. |
| linux_os/guide/system/accounts/accounts-restrictions/root_logins/restrict_serial_port_logins/bash/shared.sh | Extends SLE-specific PAM handling to SLMicro6 and seeds /etc/pam.d/login from vendor defaults when missing. |
| linux_os/guide/system/accounts/accounts-restrictions/root_logins/restrict_serial_port_logins/ansible/shared.yml | Mirrors the PAM vendor-default seeding behavior for SLE16/SLMicro6 in Ansible. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| {{% if product in ['sle16', 'slmicro6'] %}} | ||
| mkdir -p "$(dirname '{{{ pkg_manager_config_file }}}')" | ||
| {{{ bash_copy_distro_defaults("/usr/etc/zypp/zypp.conf", pkg_manager_config_file) }}} | ||
| {{% endif %}} |
Description:
Rationale:
Make sure to have existing pkg_manager_config_file and containing dir for ensure_gpgcheck_globally_activated rule
Fix remediations for restrict_serial_port_logins to copy vendor config in case /etc/pam.d/login file does not exist in etc