Enable the RHEL9 prodtype for rules that are expected to work the same on that system

[matejak]

The utils/mod_prodtype.py has been used to insert the RHEL9 prodtype, and it reorders the list by the lexicographical order.

Individual commits contain additional information regarding why a set of rules got enabled.

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[cipherboy]

@matejak Are you building a RHEL-9 profile and adding the rules to that or do you work the other way (add prodtype to rules and then collect relevant rules into a profile)? I have a utility I use to parse a profile (mentioned on #6889) that then automatically adds the prodtype to all rules mentioned in the profile --- I could look into upstreaming it if it'd be useful.

[matejak]

Right now, we proceed by components - whenever we think a component is RHEL9-ready, we flip its rules to be applicable. As more rules get enabled, we will go in the opposite direction as well - making sure that a profile is rule-complete.

[cipherboy]

Cool, thanks @matejak :) Always interested to see how different people use it :)

[jan-cerny]

The Jenkins CI and other CIs don't build the RHEL 9 content.

When I build it locally (./build_product rhel9) I get this error:

Traceback (most recent call last):
  File "/home/jcerny/work/git/scap-security-guide/build-scripts/relabel_ids.py", line 65, in <module>
    main()
  File "/home/jcerny/work/git/scap-security-guide/build-scripts/relabel_ids.py", line 49, in main
    oval_linker.link()
  File "/home/jcerny/work/git/scap-security-guide/ssg/build_renumber.py", line 126, in link
    self._link_oval_tree()
  File "/home/jcerny/work/git/scap-security-guide/ssg/build_renumber.py", line 150, in _link_oval_tree
    raise RuntimeError("\n".join(msg))
RuntimeError: Following extending definitions are missing:
	'package_bind_removed' needed by: ['configure_bind_crypto_policy']
	'package_libreswan_installed' needed by: ['configure_libreswan_crypto_policy']
make[2]: *** [rhel9/CMakeFiles/generate-internal-rhel9-linked-xccdf-oval-ocil.xml.dir/build.make:85: rhel9/xccdf-linked.xml] Error 1
make[1]: *** [CMakeFiles/Makefile2:1454: rhel9/CMakeFiles/generate-internal-rhel9-linked-xccdf-oval-ocil.xml.dir/all] Error 2
make: *** [Makefile:170: all] Error 2

[cipherboy]

(Just to follow up, #6906 was the utility I mentioned above).

[matejak]

I have added more rules from wider areas, and it should build reliably.

[JAORMX]

/retest

AWS infra issue

[openshift-ci]

@matejak: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-rhcos4-e8	0eaecfd	link	/test e2e-aws-rhcos4-e8

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[jan-cerny]

It builds the rhel9 content now.