Remove zIPL rule for PTI bootloader option

This setting is to mitigate a problem specific for intel archs. Also returns the CCE to the pool.
ComplianceAsCode · Sep 21, 2020 · 2cb09a3 · 2cb09a3
1 parent fb3c660
commit 2cb09a3
Show file tree

Hide file tree

Showing 5 changed files with 1 addition and 41 deletions.
diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml
diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
@@ -426,4 +426,3 @@ selections:
     - zipl_vsyscall_argument
     - zipl_vsyscall_argument.role=unscored
     - zipl_vsyscall_argument.severity=info
-    - zipl_pti_argument
diff --git a/rhel8/profiles/stig.profile b/rhel8/profiles/stig.profile
@@ -52,7 +52,6 @@ selections:
     - "!zipl_audit_argument"
     - "!zipl_audit_backlog_limit_argument"
     - "!zipl_page_poison_argument"
-    - "!zipl_pti_argument"
     - "!zipl_slub_debug_argument"
     - "!zipl_vsyscall_argument"
     - "!zipl_vsyscall_argument.role=unscored"

diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
@@ -360,6 +360,7 @@ CCE-83749-2
 CCE-83750-0
 CCE-83751-8
 CCE-83752-6
+CCE-83361-6
 CCE-83753-4
 CCE-83754-2
 CCE-83755-9

diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
@@ -219,7 +219,6 @@ selections:
 - zipl_bls_entries_only
 - zipl_bootmap_is_up_to_date
 - zipl_page_poison_argument
-- zipl_pti_argument
 - zipl_slub_debug_argument
 - zipl_vsyscall_argument
 - var_sshd_set_keepalive=0