Update tftpd_uses_secure_mode

[vojtapolasek]

Description:

• add xccdf variable

• update description, check and remediation appropriately

• add tests

• adding ansible remediation

Rationale:

STIG effort

reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-72305?version=v2r7

[redhatrises]

Description:

• add warning that rule has no remdiation
• add tests

Rationale:

STIG effort

reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-72305?version=v2r7

Let's create the remediation instead of using a warning.

[ggbecker]

Suggested change

	line: '\1 -s {{ tftpd_secure_directory {{ \3'
	line: '\1 -s {{ tftpd_secure_directory }} \3'

[ggbecker]

usually we have variable files starting with prefix var_. What do you think about this?

[jan-cerny]

+1

[matejak]

I am impartial - those files end with var already, and you can't confuse a variable with something else just by accident. But if someone requires to prepend var_ in order for the PR to get merged, then I wouldn't object.

[vojtapolasek]

There are lots of inconsistent variables. I suggest that one day we unite it and document it somewhere, currently this works and I would like to move forward. So if you don't mind I would like to leav it as it is.

[redhatrises]

This should be called var_tftpd_secure_directory.var. This makes it easier to understand that it is a variable when the content is fully generated into SCAP. The older use of variables is a lot harder to change since they are used in production and would introduce some painful changes.

[mildas]

Changes identified:
Rule tftpd_uses_secure_mode:
 New node inserted to OVAL check.
 Bash remediation is newly added.
 Text changed in OVAL check.
 Ansible remediation newly added.

Recommended tests to execute:
 build_product ol7
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-ol7-ds.xml tftpd_uses_secure_mode
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-ol7-ds.xml tftpd_uses_secure_mode

[jan-cerny]

@vojtapolasek Thanks for updating the variable name. Now it looks fine.