Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "Add ansible remediation for audit_rules_unsuccessful_file_modification*" #4440

Conversation

shawndwells
Copy link
Member

Reverts #4420

@jan-cerny
Copy link
Collaborator

From #4420:

@jan-cerny This should be reverted. The ansible remediations fix more than what the XCCDF calls for.

Yes, but the Bash remediations do it as well.

@yuumasato
Copy link
Member

This should be reverted. The ansible remediations fix more than what the XCCDF calls for.

We are aware of the issue that it fixes more than one configuration item. This is an interim fix.
The proper fix for this requires checking order of audit rules and inserting audit rules in order if necessary. See also discussion in #4058 (comment)

@shawndwells
Copy link
Member Author

Bump - need to get these changes reverted, especially before next release. Results in the audit rules being added multiple times.

@jan-cerny
Copy link
Collaborator

@shawndwells

Results in the audit rules being added multiple times.

Ansible should ensure it's only once there. I can't reproduce them being added multiple times. What did you run that it resulted in rules added multiple times? Perhaps some other rule conflicts with these playbooks?

@jan-cerny
Copy link
Collaborator

I have applied again the Ansible playbook for RHEL 8 OSPP profile (build/ansible/rhel8-playbook-ospp.yml) built from current master (as of HEAD cf9862d2ad56f4d061713943a99c4c0af450c036) and I can see every rule only once in /etc/audit/rules.d`. Even after I executed the same playbook again it didn't duplicate.

@shawndwells
Copy link
Member Author

Works for me. Likely screwed something up on my end. Lets close this.

@shawndwells shawndwells deleted the revert-4420-ansible_audit_rules_unsuccessful_file_modification branch July 11, 2019 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants