Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix missing content in datastreams generated by new templating system #4883

Merged
merged 6 commits into from
Oct 2, 2019
Merged

Fix missing content in datastreams generated by new templating system #4883

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c1f965c
Add RHEL 6 to service_pcscd_enabled prodtype
jan-cerny Sep 30, 2019
db34aeb
Add RHEL6 to audit_rules_login_events_* rules
jan-cerny Oct 1, 2019
2add4e2
Change prodtype in audit_rules_file_deletion_events_*
jan-cerny Oct 1, 2019
8ded36b
Add Fedora and SLE12 to rule pacakge_vsftpd_removed
jan-cerny Oct 1, 2019
6ddd026
Do not generate Anaconda remediation only on RHEL 7 and 8
jan-cerny Oct 1, 2019
8b160cd
Add WRLinux 10.19 to some rules
jan-cerny Oct 1, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,5 @@ template:
type@rhel7: tmpfs
type@rhel8: tmpfs
backends:
anaconda: 'off'
anaconda@rhel7: 'off'
anaconda@rhel8: 'off'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fedora and Oracle also had anaconda remediation for /dev/shm mount points disabled.

To get the same result using both old and new templating system,
we need to change the backends list.

But why do we want same results from old and new templating system?

In this case I think the content is better with anaconda disabled for all products.

The reason this is disabled is because /dev/shmdoesn't exist at the moment of installation, they are managed by systemd and created during first boot.
So any product using systemd should have anaconda remediation disabled.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find any resource documenting management of /dev/shm by systemd.

Copy link
Member

@matejak matejak Oct 2, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Content equivalence between the old and new systems makes it easy to evaluate the new system's state.
Let's keep changes to minimum, so we don't have to think too much whether the new system generates incomplete content due to some bug, or whether the old content was broken, which is why it is omitted by the new system.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Content equivalence between the old and new systems makes it easy to evaluate the new system's state.

I understand this reasoning, but I disagree with hindering generation of content with new templating system.

How about upping the CSV so that it generates the same content as the new system would?

3 changes: 2 additions & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,4 +50,5 @@ template:
type@rhel7: tmpfs
type@rhel8: tmpfs
backends:
anaconda: 'off'
anaconda@rhel7: 'off'
anaconda@rhel8: 'off'
3 changes: 2 additions & 1 deletion linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,5 @@ template:
type@rhel7: tmpfs
type@rhel8: tmpfs
backends:
anaconda: 'off'
anaconda@rhel7: 'off'
anaconda@rhel8: 'off'