Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move kernel_module_disabled use more genric RHEL in conditionals #9450

Merged
merged 2 commits into from
Sep 20, 2022

Conversation

Mab879
Copy link
Member

@Mab879 Mab879 commented Aug 31, 2022

Description:

This PR changes the conditions in kernel_module_disabled to use product in 'rhel' vs if product in ['rhel7, 'rhel8'].

Rationale:

Listing versions causes issues when we release a new version of RHEL.
Fixes #9192

Listing versions causes issues when we release a new version of RHEL.
@Mab879 Mab879 added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. labels Aug 31, 2022
@Mab879 Mab879 added this to the 0.1.64 milestone Aug 31, 2022
@github-actions
Copy link

github-actions bot commented Aug 31, 2022

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@jan-cerny jan-cerny self-assigned this Sep 5, 2022
@jan-cerny
Copy link
Collaborator

You say that it fixes #9192 . It fixes for me the problem with kernel_module_can_disabled on RHEL 9, but it doesn't fix the problem with kernel_module_dccp_disabled on RHEL 7. Is it an omission or do the test for RHEL 7 pass on your system?

[jcerny@thinkpad scap-security-guide{pr/9450}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel7 --datastream build/ssg-rhel7-ds.xml --dontclean --scenario missing_blacklist.fail.sh kernel_module_dccp_disabled
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2022-09-05-1204/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled
ERROR - Script missing_blacklist.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in pass, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled'.

@codeclimate
Copy link

codeclimate bot commented Sep 9, 2022

Code Climate has analyzed commit 2bd830e and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 40.4% (-1.8% change).

View more on Code Climate.

@vojtapolasek vojtapolasek modified the milestones: 0.1.64, 0.1.65 Sep 19, 2022
Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now, it works for me on both rhel 7 and 9.

@jan-cerny jan-cerny merged commit d38fdbd into ComplianceAsCode:master Sep 20, 2022
@Mab879 Mab879 deleted the fix_9192_2 branch September 20, 2022 11:38
@Mab879 Mab879 restored the fix_9192_2 branch September 28, 2022 12:29
@Mab879 Mab879 deleted the fix_9192_2 branch September 29, 2022 22:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Ansible Ansible remediation update. Bash Bash remediation update. OVAL OVAL update. Related to the systems assessments.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Test scenario missing_blacklist.fail.sh fails for kernel_module_dccp_disabled
3 participants