-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Simplify output of ip link show command #11657
Simplify output of ip link show command #11657
Conversation
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_network_sniffer_disabled' differs.
--- xccdf_org.ssgproject.content_rule_network_sniffer_disabled
+++ xccdf_org.ssgproject.content_rule_network_sniffer_disabled
@@ -1,7 +1,7 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
-for interface in $(ip link show | grep -E '^[0-9]' | cut -d ":" -f 2); do
+for interface in $(ip -o link show | cut -d ":" -f 2); do
ip link set dev $interface multicast off promisc off
done
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_network_sniffer_disabled' differs.
--- xccdf_org.ssgproject.content_rule_network_sniffer_disabled
+++ xccdf_org.ssgproject.content_rule_network_sniffer_disabled
@@ -1,6 +1,6 @@
- name: Ensure System is Not Acting as a Network Sniffer - Gather network interfaces
ansible.builtin.command:
- cmd: ip link show
+ cmd: ip -o link show
register: network_interfaces
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
@@ -25,7 +25,7 @@
loop: '{{ network_interfaces.stdout_lines }}'
when:
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- - item.split(':') | length == 3
+ - item.split(':')
tags:
- CCE-82283-3
- DISA-STIG-RHEL-08-040330 |
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
Automatus tests are expected to fail because the containers used in these tests are not allowing to set an interface in promisc mode:
This could probably be solved managing the container capabilities. However, for the scope of this PR, testin-farm and automatus tests in local VMs should be enough. |
In network_sniffer_disabled rule this command is used to collect the interface names. This can be simplified using the -o (oneline) option from ip command instead of filtering the output with other commands.
833800c
to
d0724ed
Compare
Code Climate has analyzed commit d0724ed and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.8% (0.0% change). View more on Code Climate. |
Agreed. Tests pass locally in a VM. |
Description:
In
network_sniffer_disabled
rule this command is used to collect the interface names.This can be simplified using the -o (oneline) option from
ip
command instead of filtering the output with other commands.This was noticed when investigating failures in CI tests for #11248
Rationale:
Simplify command output so Bash and Ansible remediation are more robust.
Less is more. : )