Add grub2_systemd_debug-shell_argument_absent #9100
Conversation
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
Mab879
added
New Rule
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
| Make sure that debug-shell service is not enabled with the following | ||
| command: | ||
| <pre>grep systemd\.debug-shell=1 /boot/grub2/grubenv /etc/default/grub</pre> | ||
| If the command returns a line, it means that debug-shell service is being enabled. |
There was a problem hiding this comment.
To be useful in the STIG this should line be in the OCIL clause.
There was a problem hiding this comment.
I don't get your suggestion here.
There was a problem hiding this comment.
I believe he is trying to suggest that the line 36 should be something like:
ocil_clause: the command returns a line or something
which will translate into this in the RHEL9 STIG spreadsheet for example:
If the command returns a line, then this is a finding.
There was a problem hiding this comment.
Correct. This line is duplicative of the OCIL clause.
There was a problem hiding this comment.
And how does the the ocil_clause and RHEL9 STIG spreadsheet stack with the ocil question Is it the case that ...?
Is it better if the ocil question is Is it the case that the command returns a line?;
rather than Is it the case that debug-shell service is enabled?
There was a problem hiding this comment.
Is the OCIL text ever used without the clause? If it's not I think we can go with We have been moving forwards with things like "Is it the case that the command returns a line" to help with the STIG.
There was a problem hiding this comment.
No, I don't think it it is used anywhere else.
I think I have adjusted the line as you wanted
linux_os/guide/system/bootloader-grub2/grub2_systemd_debug-shell_argument_absent/rule.yml
Outdated
Show resolved
Hide resolved
yuumasato
force-pushed
the
grub_debug_shell
branch
from
eaf56c5
to
fcfcf1d
Compare
yuumasato
force-pushed
the
grub_debug_shell
branch
2 times, most recently
from
3f9fccf
to
a5ab6f5
Compare
Create rule that ensure that systemd.debug-shell=1 is not defined for the kernel command line.
Create rule that ensures systemd.debug-shell=1 is not defined for the kernel command line in zIPL.
yuumasato
force-pushed
the
grub_debug_shell
branch
from
a5ab6f5
to
2af504b
Compare
|
Code Climate has analyzed commit 2af504b and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 42.7% (0.0% change). View more on Code Climate. |
|
@yuumasato: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
The failures in Automatus are due to inability to test grub2 rules in containers. |
|
The Ansible lint issues are fixed in #9123 |
|
Tests pass locally. |
Description:
systemd.debug-shell=1is not defined for the kernel command line.Rationale: