Add missing tests for rules selected in RHEL 10 STIG profile - #14957
Conversation
The rule has only SCE check, no remediation. The testing VM needs `openscap-engine-sce` and `openscap-utils` packages to be installed for SCE check to work.
The OVAL check for the 64-bit ExecShield rule was looking at /boot/grub2/grub.cfg for noexec=off, but on RHEL 9+ and other BLS platforms kernel arguments are in /boot/loader/entries/*.conf. This caused the rule to always pass regardless of actual state. Update the OVAL to check BLS entries on products that use them, matching the grub2_bootloader_argument template's product list. Also add pass and fail test scenarios for RHEL.
| <ind:textfilecontent54_object id="object_nx_disabled_grub" version="1"> | ||
| {{% if product in ['ol9'] %}} | ||
| <ind:filepath>/etc/default/grub</ind:filepath> | ||
| {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9", "rhel10"] %}} |
There was a problem hiding this comment.
Should we change this to 'rhel' in product?
There was a problem hiding this comment.
I wanted to align with grub2_bootloader_argument template OVAL which uses this exact products list, see https://github.com/ComplianceAsCode/content/blob/master/shared/templates/grub2_bootloader_argument/oval.template#L276
Should I change both to rather use 'rhel' in product or product in ["fedora", "ol8", "ol9"] ?
There was a problem hiding this comment.
I believe 'rhel' in product is preferred because it will include future RHEL versions, removing the need to update the code when a new RHEL version arrives.
Update the grub2_bootloader_argument OVAL template and the sysctl_kernel_exec_shield OVAL to use `'rhel' in product` instead of listing individual RHEL versions. This avoids needing to update the product list when a new RHEL version is added.
|
@matusmarhefka: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Introducing test scenarios for the following rules:
Related to https://redhat.atlassian.net/browse/OPENSCAP-7022