Add Rule,Remediation and Test for SLES-15-030760

[yarunachalam]

Description:

• Add Rule,Remediation and Test for SLES-15-030760

Rationale:

• Add SLE15 rule to 'Record Attempts to Alter Process and Session Initiation Information utmp'

[openshift-ci-robot]

Hi @yarunachalam. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openscap-ci]

Changes identified:
Rules:
 audit_rules_session_events_utmp
Profiles:
 stig on sle15

Show details

Rule audit_rules_session_events_utmp:
 Ansible remediation newly added.
 Bash remediation is newly added.
Profile stig on sle15:
 Rule audit_rules_session_events_utmp added to stig profile.

Recommended tests to execute:
 build_product sle15
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-sle15-ds.xml audit_rules_session_events_utmp
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-sle15-ds.xml audit_rules_session_events_utmp
 tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-sle15-ds.xml stig

[vojtapolasek]

/ok-to-test

[vojtapolasek]

Thank you for the rule, please see comments.

[yarunachalam]

Making rule WIP while I re-work to address comments.

[yarunachalam]

@vojtapolasek - this PR is ready for re-review. I don't have the privilege to remove the "do-not-merge/work-in-progress' label.
Thank you.

[vojtapolasek]

Hello, thank you for changes. Please see review comments, srg and nist also are product independent.
Also you changed the path to the file from /var/run/utmp to /run/utmp in rule description, remediations and checks. But you did not change it in tests, please make them aligned. Thank you.

[vojtapolasek]

/retest

[openshift-ci]

@yarunachalam: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-ocp4-moderate	4d0ef6c	link	/test e2e-aws-ocp4-moderate

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[vojtapolasek]

Thank you, merging. The OCP check is failing but this rule is not affecting OCP.