Prevent duplicate keys in YAML files

[jan-cerny]

Description:

The build system will detect duplicate keys during YAML parsing. If a duplicate key is found, it raises a ValueError with information about the duplicate key and its location in the file.

Existing duplicate key occurrences from rule.yml files are also removed in this PR.

Rationale:

This prevents the silent overwriting behavior of standard YAML parsers where the last value for a duplicate key wins.

Review Hints:

Add a duplicate key to your favorite rule.yml file. Then, build the content and observe that the build fails and the error message is emitted.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty' differs.
--- xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
+++ xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q kernel-core; then
+if ( ( rpm --quiet -q pam && rpm --quiet -q kernel-core ) ); then
 
 var_pam_wheel_group_for_su=''
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty' differs.
--- xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
+++ xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
@@ -22,7 +22,8 @@
   ansible.builtin.group:
     name: '{{ var_pam_wheel_group_for_su }}'
     state: present
-  when: '"kernel-core" in ansible_facts.packages'
+  when: ( "pam" in ansible_facts.packages and "kernel-core" in ansible_facts.packages
+    )
   tags:
   - CCE-86071-8
   - PCI-DSSv4-2.2
@@ -41,7 +42,8 @@
     regexp: ^({{ var_pam_wheel_group_for_su }}:[^:]+:[0-9]+:).*$
     line: \1
     backrefs: true
-  when: '"kernel-core" in ansible_facts.packages'
+  when: ( "pam" in ansible_facts.packages and "kernel-core" in ansible_facts.packages
+    )
   tags:
   - CCE-86071-8
   - PCI-DSSv4-2.2

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty'
--- xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
+++ xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty
@@ -1 +1,2 @@
+oval:ssg-package_pam:def:1
 oval:ssg-system_with_kernel:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_ip6tables_enabled' differs.
--- xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
+++ xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q kernel-core; then
+if ( ( rpm --quiet -q iptables && rpm --quiet -q kernel-core ) ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" unmask 'ip6tables.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_ip6tables_enabled' differs.
--- xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
+++ xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
@@ -44,4 +44,5 @@
   - no_reboot_needed
   - service_ip6tables_enabled
   - special_service_block
-  when: '"kernel-core" in ansible_facts.packages'
+  when: ( "iptables" in ansible_facts.packages and "kernel-core" in ansible_facts.packages
+    )

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_ip6tables_enabled'
--- xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
+++ xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
@@ -1 +1,2 @@
+oval:ssg-package_iptables:def:1
 oval:ssg-system_with_kernel:def:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces'.
--- xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces
+++ xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces
@@ -14,6 +14,11 @@
 user.max_user_namespaces = 0
 When containers are deployed on the machine, the value should be set
 to large non-zero value.
+
+[warning]:
+This configuration baseline was created to deploy the base operating system for general purpose
+workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
+it is expected that user.max_user_namespaces will be enabled.
 
 [warning]:
 Remediation of this rule might impair or prevent functionality of certain applications.

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions'
--- xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions
+++ xccdf_org.ssgproject.content_rule_bios_enable_execution_restrictions
@@ -1 +1,3 @@
+oval:ssg-proc_sys_kernel_osrelease_arch_aarch64:def:1
+oval:ssg-proc_sys_kernel_osrelease_arch_ppc64le:def:1
 oval:ssg-installed_env_is_a_machine:def:1

[openshift-ci]

@jan-cerny: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	6bc092e	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Mab879]

We have no more support for Python 2 in this project, no need for this.