Return condition to test firewalld service state in firewalld_loopback_traffic rules

[marcusburghardt]

Description:

After the #11868 the condition to test the firewalld service state before trying to run firewalld-cmd was removed, causing the remediation to report error when the service is stopped.
This change also created a misalignment with Ansible remediation.
This commit returns the condition to keep the alignment and better report the case to users.

Rationale:

• Ensure alignment between Ansible and Bash remediation
• Clear information to users

Review Hints:

automatus tests should be enough.
Some CI tests using containers are expected to fail.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted' differs.
--- xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted
+++ xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted
@@ -11,10 +11,15 @@
 if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)"; then
     firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv4_rule}"
     firewall-offline-cmd --zone=trusted --add-rich-rule="${ipv6_rule}"
-else
+elif systemctl is-active firewalld; then
     firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv4_rule}"
     firewall-cmd --permanent --zone=trusted --add-rich-rule="${ipv6_rule}"
     firewall-cmd --reload
+else
+    echo "
+    firewalld service is not active. Remediation aborted!
+    This remediation could not be applied because it depends on firewalld service running.
+    The service is not started by this remediation in order to prevent connection issues."
 fi
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted' differs.
--- xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted
+++ xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted
@@ -7,9 +7,14 @@
 
 if test "$(stat -c %d:%i /)" != "$(stat -c %d:%i /proc/1/root/.)"; then
     firewall-offline-cmd --zone=trusted --add-interface=lo
-else
+elif systemctl is-active firewalld; then
     firewall-cmd --permanent --zone=trusted --add-interface=lo
     firewall-cmd --reload
+else
+    echo "
+    firewalld service is not active. Remediation aborted!
+    This remediation could not be applied because it depends on firewalld service running.
+    The service is not started by this remediation in order to prevent connection issues."
 fi
 
 else

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11894
This image was built from commit: 7bb12ce

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11894

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11894 make deploy-local

[codeclimate]

Code Climate has analyzed commit 7bb12ce and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.2% (0.0% change).

View more on Code Climate.

[vojtapolasek]

LGTM, thank you.
I ran Automatus tests locally and they pass.