Turn off remedations for /dev/shm

[Mab879]

Description:

• Disable anaconda and blueprint on mount_option_dev_shm_noexec
• Disable blueprint (anaconda is already disabled) on mount_option_dev_shm_*

Rationale:

Fixes #11344
Fixes RHEL-16801 and RHEL-17386

It should be fine since default this will be tmpfs partition managed by systemd.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'.
--- xccdf_org.ssgproject.content_rule_partition_for_dev_shm
+++ xccdf_org.ssgproject.content_rule_partition_for_dev_shm
@@ -3,19 +3,23 @@
 Ensure /dev/shm is configured
 
 [description]:
-The /dev/shm is a traditional shared memory concept. 
-One program will create a memory portion, which other processes 
-(if permitted) can access. If /dev/shm is not configured, 
+The /dev/shm is a traditional shared memory concept.
+One program will create a memory portion, which other processes
+(if permitted) can access. If /dev/shm is not configured,
 tmpfs will be mounted to /dev/shm by systemd.
 
+[warning]:
+This rule does not have a remedation.
+It is expected that this will be managed by systemd and will be a tmpfs partition.
+
 [rationale]:
-Any user can upload and execute files inside the /dev/shm similar to 
-the /tmp partition. Configuring /dev/shm allows an administrator 
-to set the noexec option on the mount, making /dev/shm useless for an attacker to 
-install executable code. It would also prevent an attacker from establishing a 
-hardlink to a system setuid program and wait for it to be updated. Once the program 
-was updated, the hardlink would be broken and the attacker would have his own copy 
-of the program. If the program happened to have a security vulnerability, the attacker 
+Any user can upload and execute files inside the /dev/shm similar to
+the /tmp partition. Configuring /dev/shm allows an administrator
+to set the noexec option on the mount, making /dev/shm useless for an attacker to
+install executable code. It would also prevent an attacker from establishing a
+hardlink to a system setuid program and wait for it to be updated. Once the program
+was updated, the hardlink would be broken and the attacker would have his own copy
+of the program. If the program happened to have a security vulnerability, the attacker
 could continue to exploit the known flaw.
 
 [ident]:

New data stream is missing blueprint remediation for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'.
New data stream is missing anaconda remediation for rule 'xccdf_org.ssgproject.content_rule_partition_for_dev_shm'.

[codeclimate]

Code Climate has analyzed commit 490f4c0 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

[marcusburghardt]

LGTM