Merge pull request #11367 from Mab879/fix_11341

Fix Service Applicability for RHEL 9 Profiles
ComplianceAsCode · Dec 11, 2023 · 481d874 · 481d874
2 parents af19b67 + 6a59faf
commit 481d874
Show file tree

Hide file tree

Showing 8 changed files with 28 additions and 15 deletions.
diff --git a/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml b/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml
@@ -45,7 +45,7 @@ ocil_clause: |-
 ocil: |-
     {{{ ocil_service_disabled(service="avahi-daemon") }}}
 
-platform: machine
+platform: machine and package[avahi]
 
 template:
     name: service_disabled

diff --git a/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml b/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml
@@ -37,7 +37,7 @@ references:
 
 {{{ complete_ocil_entry_socket_and_service_disabled("telnet") }}}
 
-platform: machine
+platform: machine and package[telnet-server]
 
 warnings:
     - general: |-

diff --git a/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml b/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml
@@ -33,7 +33,7 @@ ocil_clause: |-
 ocil: |-
     {{{ ocil_service_disabled(service="squid") }}}
 
-platform: machine
+platform: machine and package[squid]
 
 template:
     name: service_disabled

diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml
@@ -34,12 +34,13 @@ ocil_clause: |-
 ocil: |-
     {{{ ocil_service_disabled(service="snmpd") }}}
 
-platform: machine
+platform: machine and package[snmpd]
 
 template:
     name: service_disabled
     vars:
         servicename: snmpd
         packagename@debian10: snmpd
         packagename@debian11: snmpd
+        packagename@debian12: snmpd
         packagename: net-snmp
diff --git a/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml
@@ -67,7 +67,7 @@ ocil_clause: |-
 ocil: |-
     {{{ ocil_service_disabled(service="autofs") }}}
 
-platform: machine
+platform: machine and package[autofs]
 
 template:
     name: service_disabled

diff --git a/products/rhel9/profiles/e8.profile b/products/rhel9/profiles/e8.profile
@@ -23,8 +23,6 @@ selections:
   ### Remove obsolete packages
   - package_talk_removed
   - package_talk-server_removed
-  - package_xinetd_removed
-  - service_xinetd_disabled
   - package_ypbind_removed
   - package_telnet_removed
   - service_telnet_disabled

diff --git a/products/rhel9/profiles/hipaa.profile b/products/rhel9/profiles/hipaa.profile
@@ -42,16 +42,12 @@ selections:
     - sshd_disable_root_login
     - libreswan_approved_tunnels
     - no_rsh_trust_files
-    - package_rsh-server_removed
     - package_talk_removed
     - package_talk-server_removed
     - package_telnet_removed
     - package_telnet-server_removed
-    - package_xinetd_removed
     - service_crond_enabled
-    - service_rlogin_disabled
     - service_telnet_disabled
-    - service_xinetd_disabled
     - use_kerberos_security_all_exports
     - var_authselect_profile=sssd
     - enable_authselect

diff --git a/shared/applicability/package.yml b/shared/applicability/package.yml
@@ -14,6 +14,14 @@ args:
     {{% else %}}
     pkgname: auditd
     {{% endif %}}
+  autofs:
+    pkgname: autofs
+  avahi:
+    {{% if 'ubuntu' in product %}}
+    pkgname: avahi-daemon
+    {{% else %}}
+    pkgname: avahi
+    {{% endif %}}
   bash:
     pkgname: bash
   chrony:
@@ -38,6 +46,8 @@ args:
     {{% else %}}
       pkgname: snmp
     {{% endif %}}
+  networkmanager:
+    pkgname: NetworkManager
   nftables:
       pkgname: nftables
   nss-pam-ldapd:
@@ -49,6 +59,8 @@ args:
   ntp:
     pkgname: ntp
     title: NTP daemon and utilities
+  openssh:
+    pkgname: openssh
   pam:
     {{% if pkg_system == "rpm" %}}
       pkgname: pam
@@ -73,6 +85,14 @@ args:
     {{% else %}}
       pkgname: login
     {{% endif %}}
+  snmpd:
+    {{% if 'debian' in product %}}
+    pkgname: snmpd
+    {{% else %}}
+    pkgname: net-snmp
+    {{% endif %}}
+  squid:
+    pkgname: squid
   sssd:
     {{% if product in ["sle12", "sle15"] %}}
       pkgname: sssd
@@ -83,6 +103,8 @@ args:
     pkgname: sudo
   systemd:
     pkgname: systemd
+  telnet-server:
+    pkgname: telnet-server
   tftp-server:
     pkgname: tftp-server
   tmux:
@@ -95,7 +117,3 @@ args:
     pkgname: yum
   zypper:
     pkgname: zypper
-  openssh:
-    pkgname: openssh
-  networkmanager:
-    pkgname: NetworkManager