-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support drop-in config in journald rules on RHEL #11440
Support drop-in config in journald rules on RHEL #11440
Conversation
This patch adds support for the drop-in configuration files in directory /etc/systemd/journald.conf.d/ to these rules configuring journald: - journald_compress - journald_forward_to_syslog - journald_storage This patch levarages the systemd_dropin_configuration template that is already in use on SLES 15. This patch also adds some test scenarios for the systemd_dropin_configuration template and fixes issues revealed by these test scenarios. Resolves: https://issues.redhat.com/browse/RHEL-14484
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- oval:ssg-journald_compress:def:1
+++ oval:ssg-journald_compress:def:1
@@ -1,2 +1,3 @@
criteria OR
criterion oval:ssg-test_journald_compress:tst:1
+criterion oval:ssg-test_journald_compress_dropin_file:tst:1
OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- ocil:ssg-journald_compress_ocil:questionnaire:1
+++ ocil:ssg-journald_compress_ocil:questionnaire:1
@@ -1,7 +1,8 @@
Storing logs with compression can help avoid filling the system disk.
Run the following command to verify that journald is compressing logs.
-grep "^\sCompress" /etc/systemd/journald.conf
+grep "^\sCompress" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
and it should return
bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- xccdf_org.ssgproject.content_rule_journald_compress
+++ xccdf_org.ssgproject.content_rule_journald_compress
@@ -1,29 +1,46 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-if [ -e "/etc/systemd/journald.conf" ] ; then
-
- LC_ALL=C sed -i "/^\s*Compress\s*=\s*/d" "/etc/systemd/journald.conf"
-else
- touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_Compress_configuration {
+ local COMPONENT_PARAM_CONFIG
+ mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+ COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*Compress'.
-line_number="$(LC_ALL=C grep -n "^#\s*Compress" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
- # There was no match of '^#\s*Compress', insert at
- # the end of the file.
- printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
-else
- head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
- printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
- tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+ for f in "${COMPONENT_PARAM_CONFIG[@]}"
+ do
+ sed -i "/^\s*Compress\s*=\s*/d" "$f"
+ # make sure file has newline at the end
+ sed -i -e '$a\' "$f"
+ done
+ sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_Compress_add_configuration {
+ local COMPONENT_PARAM_REMEDY_CFG
+ mkdir -p "/etc/systemd/journald.conf.d"
+ COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+ if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+ touch "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+ # Insert before the line matching the regex '^#\s*Compress'.
+ line_number="$(LC_ALL=C grep -n "^#\s*Compress" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+ if [ -z "$line_number" ]; then
+ # There was no match of '^#\s*Compress', insert at
+ # the end of the file.
+ printf '%s\n' "Compress=yes" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ else
+ head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+ printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
+ tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ # Clean up after ourselves.
+ rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_Compress_configuration
+journald_Compress_add_configuration
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- xccdf_org.ssgproject.content_rule_journald_compress
+++ xccdf_org.ssgproject.content_rule_journald_compress
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'Compress' to 'yes' in '/etc/systemd/journald.conf'
- block:
-
- - name: Check for duplicate values
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Compress=
- state: absent
- check_mode: true
- changed_when: false
- register: dupes
-
- - name: Deduplicate values from /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Compress=
- state: absent
- when: dupes.found is defined and dupes.found > 1
-
- - name: Insert correct line to /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Compress=
- line: Compress=yes
- state: present
- insertbefore: ^# Compress
- validate: /usr/bin/bash -n %s
+- name: Check for duplicate Compress values in master journald configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*Compress=
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: dupes_master
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-85930-6
@@ -37,3 +16,73 @@
- medium_severity
- no_reboot_needed
- restrict_strategy
+
+- name: Deduplicate Compress values from journald master configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*Compress=
+ state: absent
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - dupes_master.found is defined and dupes_master.found > 1
+ tags:
+ - CCE-85930-6
+ - journald_compress
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Collect all config journald files which configure Compress
+ ansible.builtin.find:
+ paths: /etc/systemd/journald.conf.d
+ contains: ^[\s]*Compress=.*$
+ patterns: '*.conf'
+ register: journald_Compress_dropin_config_files
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85930-6
+ - journald_compress
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Deduplicate values from journald Compress dropin configuration
+ ansible.builtin.lineinfile:
+ path: '{{ item.path }}'
+ create: false
+ regexp: ^\s*Compress=
+ state: absent
+ loop: '{{ journald_Compress_dropin_config_files.files }}'
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85930-6
+ - journald_compress
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Insert correct line to journald Compress configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+ create: true
+ regexp: ^\s*Compress=
+ line: Compress=yes
+ state: present
+ insertbefore: ^# Compress
+ validate: bash -n %s
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85930-6
+ - journald_compress
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
OVAL for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- oval:ssg-journald_forward_to_syslog:def:1
+++ oval:ssg-journald_forward_to_syslog:def:1
@@ -1,2 +1,3 @@
criteria OR
criterion oval:ssg-test_journald_forward_to_syslog:tst:1
+criterion oval:ssg-test_journald_forward_to_syslog_dropin_file:tst:1
OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- ocil:ssg-journald_forward_to_syslog_ocil:questionnaire:1
+++ ocil:ssg-journald_forward_to_syslog_ocil:questionnaire:1
@@ -1,7 +1,8 @@
Storing logs remotely protects the integrity of the data from local attacks.
Run the following command to verify that journald is forwarding logs to a remote host.
-grep "^\sForwardToSyslog" /etc/systemd/journald.conf
+grep "^\sForwardToSyslog" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
and it should return
bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
+++ xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
@@ -1,29 +1,46 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-if [ -e "/etc/systemd/journald.conf" ] ; then
-
- LC_ALL=C sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "/etc/systemd/journald.conf"
-else
- touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_ForwardToSyslog_configuration {
+ local COMPONENT_PARAM_CONFIG
+ mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+ COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*ForwardToSyslog'.
-line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
- # There was no match of '^#\s*ForwardToSyslog', insert at
- # the end of the file.
- printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
-else
- head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
- printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
- tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+ for f in "${COMPONENT_PARAM_CONFIG[@]}"
+ do
+ sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "$f"
+ # make sure file has newline at the end
+ sed -i -e '$a\' "$f"
+ done
+ sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_ForwardToSyslog_add_configuration {
+ local COMPONENT_PARAM_REMEDY_CFG
+ mkdir -p "/etc/systemd/journald.conf.d"
+ COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+ if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+ touch "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+ # Insert before the line matching the regex '^#\s*Compress'.
+ line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+ if [ -z "$line_number" ]; then
+ # There was no match of '^#\s*ForwardToSyslog', insert at
+ # the end of the file.
+ printf '%s\n' "ForwardToSyslog=yes" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ else
+ head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+ printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
+ tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ # Clean up after ourselves.
+ rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_ForwardToSyslog_configuration
+journald_ForwardToSyslog_add_configuration
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
+++ xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'ForwardToSyslog' to 'yes' in '/etc/systemd/journald.conf'
- block:
-
- - name: Check for duplicate values
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*ForwardToSyslog=
- state: absent
- check_mode: true
- changed_when: false
- register: dupes
-
- - name: Deduplicate values from /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*ForwardToSyslog=
- state: absent
- when: dupes.found is defined and dupes.found > 1
-
- - name: Insert correct line to /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*ForwardToSyslog=
- line: ForwardToSyslog=yes
- state: present
- insertbefore: ^# ForwardToSyslog
- validate: /usr/bin/bash -n %s
+- name: Check for duplicate ForwardToSyslog values in master journald configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*ForwardToSyslog=
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: dupes_master
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-85995-9
@@ -37,3 +16,73 @@
- medium_severity
- no_reboot_needed
- restrict_strategy
+
+- name: Deduplicate ForwardToSyslog values from journald master configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*ForwardToSyslog=
+ state: absent
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - dupes_master.found is defined and dupes_master.found > 1
+ tags:
+ - CCE-85995-9
+ - journald_forward_to_syslog
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Collect all config journald files which configure ForwardToSyslog
+ ansible.builtin.find:
+ paths: /etc/systemd/journald.conf.d
+ contains: ^[\s]*ForwardToSyslog=.*$
+ patterns: '*.conf'
+ register: journald_ForwardToSyslog_dropin_config_files
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85995-9
+ - journald_forward_to_syslog
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Deduplicate values from journald ForwardToSyslog dropin configuration
+ ansible.builtin.lineinfile:
+ path: '{{ item.path }}'
+ create: false
+ regexp: ^\s*ForwardToSyslog=
+ state: absent
+ loop: '{{ journald_ForwardToSyslog_dropin_config_files.files }}'
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85995-9
+ - journald_forward_to_syslog
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Insert correct line to journald ForwardToSyslog configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+ create: true
+ regexp: ^\s*ForwardToSyslog=
+ line: ForwardToSyslog=yes
+ state: present
+ insertbefore: ^# ForwardToSyslog
+ validate: bash -n %s
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-85995-9
+ - journald_forward_to_syslog
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
OVAL for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- oval:ssg-journald_storage:def:1
+++ oval:ssg-journald_storage:def:1
@@ -1,2 +1,3 @@
criteria OR
criterion oval:ssg-test_journald_storage:tst:1
+criterion oval:ssg-test_journald_storage_dropin_file:tst:1
OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- ocil:ssg-journald_storage_ocil:questionnaire:1
+++ ocil:ssg-journald_storage_ocil:questionnaire:1
@@ -1,7 +1,8 @@
Storing logs with persistent storage ensures they are available after a reboot or system crash.
Run the command below to verify that logs are being persistently stored to disk.
-grep "^\sStorage" /etc/systemd/journald.conf
+grep "^\sStorage" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
and it should return
bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- xccdf_org.ssgproject.content_rule_journald_storage
+++ xccdf_org.ssgproject.content_rule_journald_storage
@@ -1,29 +1,46 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-if [ -e "/etc/systemd/journald.conf" ] ; then
-
- LC_ALL=C sed -i "/^\s*Storage\s*=\s*/d" "/etc/systemd/journald.conf"
-else
- touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_Storage_configuration {
+ local COMPONENT_PARAM_CONFIG
+ mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+ COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*Storage'.
-line_number="$(LC_ALL=C grep -n "^#\s*Storage" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
- # There was no match of '^#\s*Storage', insert at
- # the end of the file.
- printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
-else
- head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
- printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
- tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+ for f in "${COMPONENT_PARAM_CONFIG[@]}"
+ do
+ sed -i "/^\s*Storage\s*=\s*/d" "$f"
+ # make sure file has newline at the end
+ sed -i -e '$a\' "$f"
+ done
+ sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_Storage_add_configuration {
+ local COMPONENT_PARAM_REMEDY_CFG
+ mkdir -p "/etc/systemd/journald.conf.d"
+ COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+ if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+ touch "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+ # Insert before the line matching the regex '^#\s*Compress'.
+ line_number="$(LC_ALL=C grep -n "^#\s*Storage" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+ if [ -z "$line_number" ]; then
+ # There was no match of '^#\s*Storage', insert at
+ # the end of the file.
+ printf '%s\n' "Storage=persistent" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ else
+ head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+ printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
+ tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+ fi
+ # Clean up after ourselves.
+ rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_Storage_configuration
+journald_Storage_add_configuration
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- xccdf_org.ssgproject.content_rule_journald_storage
+++ xccdf_org.ssgproject.content_rule_journald_storage
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'Storage' to 'persistent' in '/etc/systemd/journald.conf'
- block:
-
- - name: Check for duplicate values
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Storage=
- state: absent
- check_mode: true
- changed_when: false
- register: dupes
-
- - name: Deduplicate values from /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Storage=
- state: absent
- when: dupes.found is defined and dupes.found > 1
-
- - name: Insert correct line to /etc/systemd/journald.conf
- lineinfile:
- path: /etc/systemd/journald.conf
- create: true
- regexp: ^\s*Storage=
- line: Storage=persistent
- state: present
- insertbefore: ^# Storage
- validate: /usr/bin/bash -n %s
+- name: Check for duplicate Storage values in master journald configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*Storage=
+ state: absent
+ check_mode: true
+ changed_when: false
+ register: dupes_master
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-86045-2
@@ -37,3 +16,73 @@
- medium_severity
- no_reboot_needed
- restrict_strategy
+
+- name: Deduplicate Storage values from journald master configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf
+ create: false
+ regexp: ^\s*Storage=
+ state: absent
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - dupes_master.found is defined and dupes_master.found > 1
+ tags:
+ - CCE-86045-2
+ - journald_storage
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Collect all config journald files which configure Storage
+ ansible.builtin.find:
+ paths: /etc/systemd/journald.conf.d
+ contains: ^[\s]*Storage=.*$
+ patterns: '*.conf'
+ register: journald_Storage_dropin_config_files
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-86045-2
+ - journald_storage
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Deduplicate values from journald Storage dropin configuration
+ ansible.builtin.lineinfile:
+ path: '{{ item.path }}'
+ create: false
+ regexp: ^\s*Storage=
+ state: absent
+ loop: '{{ journald_Storage_dropin_config_files.files }}'
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-86045-2
+ - journald_storage
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Insert correct line to journald Storage configuration
+ ansible.builtin.lineinfile:
+ path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+ create: true
+ regexp: ^\s*Storage=
+ line: Storage=persistent
+ state: present
+ insertbefore: ^# Storage
+ validate: bash -n %s
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-86045-2
+ - journald_storage
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy |
Code Climate has analyzed commit 06d6189 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thank you very much.
@teacup-on-rockingchair please take a look into this one |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice improvement 👍
4dca425
into
ComplianceAsCode:master
This patch adds support for the drop-in configuration files in directory /etc/systemd/journald.conf.d/ to these rules configuring journald:
This patch levarages the systemd_dropin_configuration template that is already in use on SLES 15.
This patch also adds some test scenarios for the
systemd_dropin_configuration template and fixes issues revealed by these test scenarios.
Resolves: https://issues.redhat.com/browse/RHEL-14484
This PR is a replacement of #11431. I have created a new PR to avoid unnecessary requests to review from CODEOWNERS which would complicate the review process.