From 4fea6d218a1634d579998254ef1e8c76ee99ed64 Mon Sep 17 00:00:00 2001
From: Cory Francis Myers <cory@freedom.press>
Date: Wed, 22 Sep 2021 18:06:52 -0700
Subject: [PATCH] silences fwupd OSSEC alerts from FuEngine and
 FuPluginLinuxSwap

---
 .../var/ossec/rules/local_rules.xml              | 12 ++++++++++++
 molecule/testinfra/vars/staging.yml              | 16 ++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml b/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml
index 26eeab6958..84b8fe72b2 100644
--- a/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml
+++ b/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml
@@ -90,6 +90,18 @@
     <description>fwupd error for auto updates</description>
     <options>no_email_alert</options>
   </rule>
+  <rule id="100113" level="0">
+    <decoded_as>fwupd</decoded_as>
+    <match>The name org.freedesktop.UDisks2 was not provided by any .service files</match>
+    <description>fwupd error missing UDisks2</description>
+    <options>no_email_alert</options>
+  </rule>
+  <rule id="100114" level="0">
+    <decoded_as>fwupd</decoded_as>
+    <match>failed to get chassis type: no structure with type 03</match>
+    <description>fwupd error missing structure</description>
+    <options>no_email_alert</options>
+  </rule>
 </group>
 
 <!--
diff --git a/molecule/testinfra/vars/staging.yml b/molecule/testinfra/vars/staging.yml
index 489ac3d32b..aef5f5c36b 100644
--- a/molecule/testinfra/vars/staging.yml
+++ b/molecule/testinfra/vars/staging.yml
@@ -128,6 +128,22 @@ log_events_without_ossec_alerts:
     level: "0"
     rule_id: "100112"
 
+  - name: test_ossec_fwupd_udisks2_does_not_produce_alert
+    alert: >
+      Aug 10 14:30:51 mon fwupd[134620]: 14:30:51:0528 FuPluginLinuxSwap    could
+      not parse /proc/swaps: failed to call
+      org.freedesktop.UDisks2.Manager.GetBlockDevices(): The name
+      org.freedesktop.UDisks2 was not provided by any .service files
+    level: "0"
+    rule_id: "100113"
+
+  - name: test_ossec_fwupd_chassis_type_does_not_produce_alert
+    alert: >
+      Sep 18 13:32:22 mon fwupd[134454]: 13:32:22:0632 FuEngine             failed
+      to get chassis type: no structure with type 03
+    level: "0"
+    rule_id: "100114"
+
 # Log events we expect an OSSEC alert to occur for
 log_events_with_ossec_alerts:
   # Check that a denied RWX mmaping would produce an OSSEC alert