Fix Service Applicability for RHEL 9 Profiles

[Mab879]

Description:

See each commit for details.

Rationale:

Fixes #11341

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q autofs ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'autofs.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-80873-3
+  - DISA-STIG-RHEL-08-040070
+  - NIST-800-171-3.4.6
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - NIST-800-53-MP-7
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - service_autofs_disabled
+
 - name: Block Disable service autofs
   block:
 
@@ -15,7 +33,8 @@
     - name: Intentionally ignored previous 'Disable service autofs' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "autofs" in ansible_facts.packages )
   tags:
   - CCE-80873-3
   - DISA-STIG-RHEL-08-040070
@@ -37,7 +56,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "autofs" in ansible_facts.packages )
   tags:
   - CCE-80873-3
   - DISA-STIG-RHEL-08-040070
@@ -60,7 +80,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "autofs" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("autofs.socket",multiline=True)
   tags:
   - CCE-80873-3

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled'
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_autofs:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q avahi ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'avahi-daemon.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,3 +1,19 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82188-4
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - PCI-DSSv4-2.2.4
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - service_avahi-daemon_disabled
+
 - name: Block Disable service avahi-daemon
   block:
 
@@ -15,7 +31,8 @@
     - name: Intentionally ignored previous 'Disable service avahi-daemon' failure,
         service was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "avahi" in ansible_facts.packages )
   tags:
   - CCE-82188-4
   - NIST-800-53-CM-6(a)
@@ -35,7 +52,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "avahi" in ansible_facts.packages )
   tags:
   - CCE-82188-4
   - NIST-800-53-CM-6(a)
@@ -56,7 +74,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "avahi" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("avahi-daemon.socket",multiline=True)
   tags:
   - CCE-82188-4

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled'
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_avahi:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q telnet-server ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'telnet.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-80887-3
+  - NIST-800-171-3.1.13
+  - NIST-800-171-3.4.7
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - NIST-800-53-IA-5(1)(c)
+  - disable_strategy
+  - high_severity
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed
+  - service_telnet_disabled
+
 - name: Block Disable service telnet
   block:
 
@@ -15,7 +33,8 @@
     - name: Intentionally ignored previous 'Disable service telnet' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "telnet-server" in ansible_facts.packages )
   tags:
   - CCE-80887-3
   - NIST-800-171-3.1.13
@@ -37,7 +56,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "telnet-server" in ansible_facts.packages )
   tags:
   - CCE-80887-3
   - NIST-800-171-3.1.13
@@ -60,7 +80,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "telnet-server" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("telnet.socket",multiline=True)
   tags:
   - CCE-80887-3

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled'
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_telnet-server:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q squid ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'squid.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82190-0
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed
+  - service_squid_disabled
+  - unknown_severity
+
 - name: Block Disable service squid
   block:
 
@@ -15,7 +27,8 @@
     - name: Intentionally ignored previous 'Disable service squid' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "squid" in ansible_facts.packages )
   tags:
   - CCE-82190-0
   - disable_strategy
@@ -31,7 +44,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "squid" in ansible_facts.packages )
   tags:
   - CCE-82190-0
   - disable_strategy
@@ -48,7 +62,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "squid" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("squid.socket",multiline=True)
   tags:
   - CCE-82190-0

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled'
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_squid:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q net-snmp ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'snmpd.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82758-4
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - service_snmpd_disabled
+
 - name: Block Disable service snmpd
   block:
 
@@ -15,7 +27,8 @@
     - name: Intentionally ignored previous 'Disable service snmpd' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "net-snmp" in ansible_facts.packages )
   tags:
   - CCE-82758-4
   - disable_strategy
@@ -31,7 +44,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "net-snmp" in ansible_facts.packages )
   tags:
   - CCE-82758-4
   - disable_strategy
@@ -48,7 +62,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "net-snmp" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("snmpd.socket",multiline=True)
   tags:
   - CCE-82758-4

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled'
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_snmpd:def:1

[codeclimate]

Code Climate has analyzed commit 6a59faf and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

[marcusburghardt]

Thanks