RHCOS4: Enhance instructions to better reflect how to work with the platform

[JAORMX]

This changes various descriptions and macros in the case of rhcos4 to better
reflect what an admin would really need to do to check or remediate.

[openscap-ci]

Changes identified:
Macros:
 systemd_ocil_service_disabled
 systemd_ocil_service_enabled
 systemd_describe_service_disable
 systemd_describe_service_enable
 machineconfig_description_footer
 rhcos_node_login_instructions

Show details

Macro systemd_ocil_service_disabled:
 In rule description for service_ypbind_disabled.
 In rule description for service_messagebus_disabled.
 In rule description for service_quota_nld_disabled.
 In rule description for service_rsyncd_disabled.
 In rule description for service_rpcsvcgssd_disabled.
 In rule description for service_bluetooth_disabled.
 In rule description for service_squid_disabled.
 In rule description for service_httpd_disabled.
 In rule description for service_portreserve_disabled.
 In rule description for service_cpupower_disabled.
 In rule description for service_oddjobd_disabled.
 In rule description for service_sysstat_disabled.
 In rule description for service_debug-shell_disabled.
 In rule description for service_named_disabled.
 In rule description for service_xinetd_disabled.
 In rule description for service_saslauthd_disabled.
 In rule description for service_avahi-daemon_disabled.
 In rule description for service_rhnsd_disabled.
 In rule description for service_abrtd_disabled.
 In rule description for service_cgred_disabled.
 In rule description for service_acpid_disabled.
 In rule description for service_irqbalance_enabled.
 In rule description for service_vsftpd_disabled.
 In rule description for service_snmpd_disabled.
 In rule description for service_kdump_disabled.
 In rule description for service_nfs_disabled.
 In rule description for service_psacct_enabled.
 In rule description for service_netconsole_disabled.
 In rule description for service_cgconfig_disabled.
 In rule description for service_certmonger_disabled.
 In rule description for service_cups_disabled.
 In rule description for service_mdmonitor_disabled.
 In rule description for service_rhsmcertd_disabled.
 In rule description for service_dovecot_disabled.
 In rule description for service_zebra_disabled.
 In rule description for service_atd_disabled.
 In rule description for service_ntpdate_disabled.
 In rule description for service_dhcpd_disabled.
 In rule description for service_cockpit_disabled.
 In rule description for service_smartd_disabled.
 In rule description for service_smb_disabled.
 In rule description for service_qpidd_disabled.
 In rule description for service_tftp_disabled.
 In rule description for service_autofs_disabled.
 In rule description for service_rdisc_disabled.
Macro systemd_ocil_service_enabled:
 In rule description for service_chronyd_or_ntpd_enabled.
 In rule description for service_SuSEfirewall2_enabled.
 In rule description for susefirewall2_only_required_services.
 In rule description for service_rngd_enabled.
 In rule description for service_ntpd_enabled.
 In rule description for httpd_configure_remote_session_encryption.
 In rule description for service_nails_enabled.
 In rule description for service_pcscd_enabled.
 In rule description for service_crond_enabled.
 In rule description for service_auditd_enabled.
 In rule description for service_ntp_enabled.
 In rule description for service_fapolicyd_enabled.
 In rule description for service_iptables_enabled.
 In rule description for service_firewalld_enabled.
 In rule description for service_ip6tables_enabled.
 In rule description for service_rsyslog_enabled.
 In rule description for service_sshd_enabled.
 In rule description for service_usbguard_enabled.
 In rule description for service_syslogng_enabled.
 In rule description for service_cron_enabled.
 In rule description for service_docker_enabled.
 In rule description for susefirewall2_ddos_protection.
 In rule description for service_timesyncd_enabled.
 In rule description for service_postfix_enabled.
 In rule description for service_chronyd_enabled.
 In rule description for service_sssd_enabled.
Macro systemd_describe_service_disable:
 In rule description for service_ypbind_disabled.
 In rule description for service_messagebus_disabled.
 In rule description for service_quota_nld_disabled.
 In rule description for service_rsyncd_disabled.
 In rule description for service_rpcsvcgssd_disabled.
 In rule description for service_bluetooth_disabled.
 In rule description for service_oddjobd_disabled.
 In rule description for service_squid_disabled.
 In rule description for service_portreserve_disabled.
 In rule description for service_httpd_disabled.
 In rule description for service_cpupower_disabled.
 In rule description for service_sysstat_disabled.
 In rule description for service_apport_disabled.
 In rule description for service_debug-shell_disabled.
 In rule description for service_named_disabled.
 In rule description for service_xinetd_disabled.
 In rule description for service_saslauthd_disabled.
 In rule description for service_sshd_disabled.
 In rule description for service_avahi-daemon_disabled.
 In rule description for service_rhnsd_disabled.
 In rule description for service_rpcbind_disabled.
 In rule description for service_abrtd_disabled.
 In rule description for service_cgred_disabled.
 In rule description for service_rpcidmapd_disabled.
 In rule description for service_acpid_disabled.
 In rule description for service_netfs_disabled.
 In rule description for service_vsftpd_disabled.
 In rule description for service_snmpd_disabled.
 In rule description for service_rpcgssd_disabled.
 In rule description for service_kdump_disabled.
 In rule description for service_nfs_disabled.
 In rule description for service_nfslock_disabled.
 In rule description for service_netconsole_disabled.
 In rule description for service_cgconfig_disabled.
 In rule description for service_certmonger_disabled.
 In rule description for service_cups_disabled.
 In rule description for service_mdmonitor_disabled.
 In rule description for service_rhsmcertd_disabled.
 In rule description for service_dovecot_disabled.
 In rule description for service_zebra_disabled.
 In rule description for service_atd_disabled.
 In rule description for service_ntpdate_disabled.
 In rule description for service_dhcpd_disabled.
 In rule description for service_cockpit_disabled.
 In rule description for service_smartd_disabled.
 In rule description for service_smb_disabled.
 In rule description for service_qpidd_disabled.
 In rule description for service_tftp_disabled.
 In rule description for service_autofs_disabled.
 In rule description for service_rdisc_disabled.
Macro systemd_describe_service_enable:
 In rule description for service_SuSEfirewall2_enabled.
 In rule description for susefirewall2_only_required_services.
 In rule description for service_rngd_enabled.
 In rule description for service_ntpd_enabled.
 In rule description for httpd_configure_remote_session_encryption.
 In rule description for service_nails_enabled.
 In rule description for service_pcscd_enabled.
 In rule description for service_crond_enabled.
 In rule description for service_auditd_enabled.
 In rule description for service_ntp_enabled.
 In rule description for service_irqbalance_enabled.
 In rule description for service_fapolicyd_enabled.
 In rule description for service_iptables_enabled.
 In rule description for service_firewalld_enabled.
 In rule description for service_psacct_enabled.
 In rule description for service_ip6tables_enabled.
 In rule description for service_rsyslog_enabled.
 In rule description for service_sshd_enabled.
 In rule description for service_usbguard_enabled.
 In rule description for service_syslogng_enabled.
 In rule description for service_cron_enabled.
 In rule description for service_docker_enabled.
 In rule description for susefirewall2_ddos_protection.
 In rule description for service_timesyncd_enabled.
 In rule description for service_postfix_enabled.
 In rule description for service_sssd_enabled.
Macro machineconfig_description_footer:
 In rule description for service_quota_nld_disabled.
 In rule description for service_httpd_disabled.
 In rule description for service_apport_disabled.
 In rule description for service_saslauthd_disabled.
 In rule description for service_sshd_disabled.
 In rule description for httpd_configure_remote_session_encryption.
 In rule description for service_rhnsd_disabled.
 In rule description for service_rpcidmapd_disabled.
 In rule description for service_acpid_disabled.
 In rule description for service_firewalld_enabled.
 In rule description for service_kdump_disabled.
 In rule description for service_certmonger_disabled.
 In rule description for service_sshd_enabled.
 In rule description for service_cups_disabled.
 In rule description for disable_ctrlaltdel_burstaction.
 In rule description for service_atd_disabled.
 In rule description for susefirewall2_ddos_protection.
 In rule description for service_sssd_enabled.
 In rule description for service_messagebus_disabled.
 In rule description for service_rpcsvcgssd_disabled.
 In rule description for service_rsyncd_disabled.
 In rule description for service_cpupower_disabled.
 In rule description for service_squid_disabled.
 In rule description for service_sysstat_disabled.
 In rule description for service_avahi-daemon_disabled.
 In rule description for service_crond_enabled.
 In rule description for service_auditd_enabled.
 In rule description for service_fapolicyd_enabled.
 In rule description for service_snmpd_disabled.
 In rule description for service_nfs_disabled.
 In rule description for service_ntpdate_disabled.
 In rule description for service_cron_enabled.
 In rule description for service_cockpit_disabled.
 In rule description for service_docker_enabled.
 In rule description for service_timesyncd_enabled.
 In rule description for service_ypbind_disabled.
 In rule description for service_bluetooth_disabled.
 In rule description for service_oddjobd_disabled.
 In rule description for susefirewall2_only_required_services.
 In rule description for service_xinetd_disabled.
 In rule description for service_rngd_enabled.
 In rule description for service_ntpd_enabled.
 In rule description for service_nails_enabled.
 In rule description for service_rpcbind_disabled.
 In rule description for service_iptables_enabled.
 In rule description for service_vsftpd_disabled.
 In rule description for service_psacct_enabled.
 In rule description for service_nfslock_disabled.
 In rule description for service_rsyslog_enabled.
 In rule description for service_netconsole_disabled.
 In rule description for service_dovecot_disabled.
 In rule description for service_qpidd_disabled.
 In rule description for service_tftp_disabled.
 In rule description for service_postfix_enabled.
 In rule description for service_rdisc_disabled.
 In rule description for service_SuSEfirewall2_enabled.
 In rule description for service_portreserve_disabled.
 In rule description for service_debug-shell_disabled.
 In rule description for service_named_disabled.
 In rule description for disable_ctrlaltdel_reboot.
 In rule description for service_pcscd_enabled.
 In rule description for service_abrtd_disabled.
 In rule description for service_cgred_disabled.
 In rule description for service_ntp_enabled.
 In rule description for service_irqbalance_enabled.
 In rule description for service_netfs_disabled.
 In rule description for service_rpcgssd_disabled.
 In rule description for configure_crypto_policy.
 In rule description for service_ip6tables_enabled.
 In rule description for package_usbguard_installed.
 In rule description for service_cgconfig_disabled.
 In rule description for service_mdmonitor_disabled.
 In rule description for service_usbguard_enabled.
 In rule description for service_rhsmcertd_disabled.
 In rule description for service_syslogng_enabled.
 In rule description for service_zebra_disabled.
 In rule description for service_dhcpd_disabled.
 In rule description for service_smartd_disabled.
 In rule description for service_smb_disabled.
 In rule description for service_autofs_disabled.
Macro rhcos_node_login_instructions:
 In rule description for service_ypbind_disabled.
 In rule description for service_chronyd_or_ntpd_enabled.
 In rule description for service_messagebus_disabled.
 In rule description for service_quota_nld_disabled.
 In rule description for service_rpcsvcgssd_disabled.
 In rule description for service_SuSEfirewall2_enabled.
 In rule description for service_rsyncd_disabled.
 In rule description for service_squid_disabled.
 In rule description for service_httpd_disabled.
 In rule description for service_portreserve_disabled.
 In rule description for service_bluetooth_disabled.
 In rule description for service_cpupower_disabled.
 In rule description for susefirewall2_only_required_services.
 In rule description for service_sysstat_disabled.
 In rule description for service_debug-shell_disabled.
 In rule description for service_oddjobd_disabled.
 In rule description for service_named_disabled.
 In rule description for service_rngd_enabled.
 In rule description for service_xinetd_disabled.
 In rule description for service_ntpd_enabled.
 In rule description for service_saslauthd_disabled.
 In rule description for httpd_configure_remote_session_encryption.
 In rule description for service_nails_enabled.
 In rule description for service_avahi-daemon_disabled.
 In rule description for service_rhnsd_disabled.
 In rule description for service_pcscd_enabled.
 In rule description for service_crond_enabled.
 In rule description for service_abrtd_disabled.
 In rule description for service_cgred_disabled.
 In rule description for service_auditd_enabled.
 In rule description for service_ntp_enabled.
 In rule description for service_acpid_disabled.
 In rule description for service_irqbalance_enabled.
 In rule description for service_fapolicyd_enabled.
 In rule description for service_firewalld_enabled.
 In rule description for service_vsftpd_disabled.
 In rule description for service_snmpd_disabled.
 In rule description for service_iptables_enabled.
 In rule description for service_kdump_disabled.
 In rule description for service_nfs_disabled.
 In rule description for service_psacct_enabled.
 In rule description for service_ip6tables_enabled.
 In rule description for service_netconsole_disabled.
 In rule description for service_rsyslog_enabled.
 In rule description for service_cups_disabled.
 In rule description for service_certmonger_disabled.
 In rule description for service_sshd_enabled.
 In rule description for service_cgconfig_disabled.
 In rule description for service_mdmonitor_disabled.
 In rule description for service_usbguard_enabled.
 In rule description for service_rhsmcertd_disabled.
 In rule description for service_syslogng_enabled.
 In rule description for service_dovecot_disabled.
 In rule description for service_zebra_disabled.
 In rule description for service_atd_disabled.
 In rule description for service_ntpdate_disabled.
 In rule description for service_dhcpd_disabled.
 In rule description for service_cron_enabled.
 In rule description for service_cockpit_disabled.
 In rule description for susefirewall2_ddos_protection.
 In rule description for service_docker_enabled.
 In rule description for service_smartd_disabled.
 In rule description for service_smb_disabled.
 In rule description for service_qpidd_disabled.
 In rule description for service_timesyncd_enabled.
 In rule description for service_tftp_disabled.
 In rule description for service_postfix_enabled.
 In rule description for service_autofs_disabled.
 In rule description for service_chronyd_enabled.
 In rule description for service_sssd_enabled.
 In rule description for service_rdisc_disabled.

[JAORMX]

@yuumasato @ggbecker could you take a look at this? I'm starting to change instructions for RHCOS4 to better guide users reading the content. this is a bit bigger change since I'm modifying the macros, and before going forward, I want to know what you folks think of this approach.

[JAORMX]

/test all

[yuumasato]

I think you'll want to add similar text to the OCIL as well.

[JAORMX]

Yeah, that makes sense. I'll get to that.

[yuumasato]

Side comment: The Jinja conditionals in between the text make things tricky to read...

One way to increase readability, would be to make it possible to split the description in two parts, one which pertains to description of the setting and its behavior, and another about product specific configuration steps. For example, description and configuration.

Another approach would be to allow entire product specific descriptions, e.g. description@rhcos4

[JAORMX]

maybe the former approach is better, (having description@<product>

[JAORMX]

@yuumasato, thanks for the review! I'll continue adding changes then! I'll target the ocil macros and service_disabled next.

[JAORMX]

Pull-request updated, HEAD is now 8636b28

[JAORMX]

@yuumasato added changes to both descriptions and ocil, WDYT?

[JAORMX]

/retest

[JAORMX]

/retest

[mrogers950]

one nit, looks good to me otherwise

[yuumasato]

LGTM

[mrogers950]

/retest