-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Service Applicability for RHEL 9 Profiles #11367
Conversation
This package doesn't exist on RHEL 9 so it should be removed.
These packages are not on RHEL 9.
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,5 +1,5 @@
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q autofs ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'autofs.service'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+ package_facts:
+ manager: auto
+ tags:
+ - CCE-80873-3
+ - DISA-STIG-RHEL-08-040070
+ - NIST-800-171-3.4.6
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - NIST-800-53-MP-7
+ - disable_strategy
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - service_autofs_disabled
+
- name: Block Disable service autofs
block:
@@ -15,7 +33,8 @@
- name: Intentionally ignored previous 'Disable service autofs' failure, service
was already disabled
meta: noop
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "autofs" in ansible_facts.packages )
tags:
- CCE-80873-3
- DISA-STIG-RHEL-08-040070
@@ -37,7 +56,8 @@
changed_when: false
failed_when: socket_file_exists.rc not in [0, 1]
check_mode: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "autofs" in ansible_facts.packages )
tags:
- CCE-80873-3
- DISA-STIG-RHEL-08-040070
@@ -60,7 +80,8 @@
state: stopped
masked: 'yes'
when:
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ and "autofs" in ansible_facts.packages )
- socket_file_exists.stdout_lines is search("autofs.socket",multiline=True)
tags:
- CCE-80873-3
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled'
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1 +1,2 @@
oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_autofs:def:1
bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,5 +1,5 @@
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q avahi ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'avahi-daemon.service'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,3 +1,19 @@
+- name: Gather the package facts
+ package_facts:
+ manager: auto
+ tags:
+ - CCE-82188-4
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - PCI-DSSv4-2.2.4
+ - disable_strategy
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - service_avahi-daemon_disabled
+
- name: Block Disable service avahi-daemon
block:
@@ -15,7 +31,8 @@
- name: Intentionally ignored previous 'Disable service avahi-daemon' failure,
service was already disabled
meta: noop
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "avahi" in ansible_facts.packages )
tags:
- CCE-82188-4
- NIST-800-53-CM-6(a)
@@ -35,7 +52,8 @@
changed_when: false
failed_when: socket_file_exists.rc not in [0, 1]
check_mode: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "avahi" in ansible_facts.packages )
tags:
- CCE-82188-4
- NIST-800-53-CM-6(a)
@@ -56,7 +74,8 @@
state: stopped
masked: 'yes'
when:
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ and "avahi" in ansible_facts.packages )
- socket_file_exists.stdout_lines is search("avahi-daemon.socket",multiline=True)
tags:
- CCE-82188-4
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled'
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1 +1,2 @@
oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_avahi:def:1
bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,5 +1,5 @@
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q telnet-server ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'telnet.service'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+ package_facts:
+ manager: auto
+ tags:
+ - CCE-80887-3
+ - NIST-800-171-3.1.13
+ - NIST-800-171-3.4.7
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - NIST-800-53-IA-5(1)(c)
+ - disable_strategy
+ - high_severity
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+ - service_telnet_disabled
+
- name: Block Disable service telnet
block:
@@ -15,7 +33,8 @@
- name: Intentionally ignored previous 'Disable service telnet' failure, service
was already disabled
meta: noop
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "telnet-server" in ansible_facts.packages )
tags:
- CCE-80887-3
- NIST-800-171-3.1.13
@@ -37,7 +56,8 @@
changed_when: false
failed_when: socket_file_exists.rc not in [0, 1]
check_mode: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "telnet-server" in ansible_facts.packages )
tags:
- CCE-80887-3
- NIST-800-171-3.1.13
@@ -60,7 +80,8 @@
state: stopped
masked: 'yes'
when:
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ and "telnet-server" in ansible_facts.packages )
- socket_file_exists.stdout_lines is search("telnet.socket",multiline=True)
tags:
- CCE-80887-3
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled'
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1 +1,2 @@
oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_telnet-server:def:1
bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,5 +1,5 @@
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q squid ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'squid.service'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+ package_facts:
+ manager: auto
+ tags:
+ - CCE-82190-0
+ - disable_strategy
+ - low_complexity
+ - low_disruption
+ - no_reboot_needed
+ - service_squid_disabled
+ - unknown_severity
+
- name: Block Disable service squid
block:
@@ -15,7 +27,8 @@
- name: Intentionally ignored previous 'Disable service squid' failure, service
was already disabled
meta: noop
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "squid" in ansible_facts.packages )
tags:
- CCE-82190-0
- disable_strategy
@@ -31,7 +44,8 @@
changed_when: false
failed_when: socket_file_exists.rc not in [0, 1]
check_mode: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "squid" in ansible_facts.packages )
tags:
- CCE-82190-0
- disable_strategy
@@ -48,7 +62,8 @@
state: stopped
masked: 'yes'
when:
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ and "squid" in ansible_facts.packages )
- socket_file_exists.stdout_lines is search("squid.socket",multiline=True)
tags:
- CCE-82190-0
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled'
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1 +1,2 @@
oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_squid:def:1
bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,5 +1,5 @@
# Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q net-snmp ); then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'snmpd.service'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+ package_facts:
+ manager: auto
+ tags:
+ - CCE-82758-4
+ - disable_strategy
+ - low_complexity
+ - low_disruption
+ - low_severity
+ - no_reboot_needed
+ - service_snmpd_disabled
+
- name: Block Disable service snmpd
block:
@@ -15,7 +27,8 @@
- name: Intentionally ignored previous 'Disable service snmpd' failure, service
was already disabled
meta: noop
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "net-snmp" in ansible_facts.packages )
tags:
- CCE-82758-4
- disable_strategy
@@ -31,7 +44,8 @@
changed_when: false
failed_when: socket_file_exists.rc not in [0, 1]
check_mode: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+ "container"] and "net-snmp" in ansible_facts.packages )
tags:
- CCE-82758-4
- disable_strategy
@@ -48,7 +62,8 @@
state: stopped
masked: 'yes'
when:
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ and "net-snmp" in ansible_facts.packages )
- socket_file_exists.stdout_lines is search("snmpd.socket",multiline=True)
tags:
- CCE-82758-4
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled'
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1 +1,2 @@
oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_snmpd:def:1 |
Code Climate has analyzed commit 6a59faf and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
Description:
See each commit for details.
Rationale:
Fixes #11341