-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix nmcli bug #9773
Fix nmcli bug #9773
Conversation
Hi @anivan-suse. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_wireless_disable_interfaces' differs.
--- xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
+++ xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
@@ -1,2 +1,8 @@
-nmcli radio all off
+if
+ rpm -q NetworkManager
+then
+ nmcli radio all off
+else
+ echo "NetworkManager package not installed" >&2
+fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_wireless_disable_interfaces' differs.
--- xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
+++ xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
@@ -1,5 +1,6 @@
-- name: Deactivate Wireless Network Interfaces
- command: nmcli radio wifi off
+- name: Gather the package facts
+ package_facts:
+ manager: auto
tags:
- CCE-83501-7
- DISA-STIG-RHEL-08-040110
@@ -17,3 +18,67 @@
- no_reboot_needed
- unknown_strategy
- wireless_disable_interfaces
+
+- name: Check if NetworkManager is installed
+ ansible.builtin.package_facts:
+ manager: auto
+ tags:
+ - CCE-83501-7
+ - DISA-STIG-RHEL-08-040110
+ - NIST-800-171-3.1.16
+ - NIST-800-53-AC-18(3)
+ - NIST-800-53-AC-18(a)
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - NIST-800-53-MP-7
+ - PCI-DSS-Req-1.3.3
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+ - wireless_disable_interfaces
+
+- name: Error message when NetworkManager not installed
+ fail:
+ msg: NetworkManager package not installed
+ when: '''NetworkManager'' not in ansible_facts.packages'
+ tags:
+ - CCE-83501-7
+ - DISA-STIG-RHEL-08-040110
+ - NIST-800-171-3.1.16
+ - NIST-800-53-AC-18(3)
+ - NIST-800-53-AC-18(a)
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - NIST-800-53-MP-7
+ - PCI-DSS-Req-1.3.3
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+ - wireless_disable_interfaces
+
+- name: Deactivate Wireless Network Interfaces
+ command: nmcli radio wifi off
+ when: '''NetworkManager'' in ansible_facts.packages'
+ tags:
+ - CCE-83501-7
+ - DISA-STIG-RHEL-08-040110
+ - NIST-800-171-3.1.16
+ - NIST-800-53-AC-18(3)
+ - NIST-800-53-AC-18(a)
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
+ - NIST-800-53-MP-7
+ - PCI-DSS-Req-1.3.3
+ - low_complexity
+ - medium_disruption
+ - medium_severity
+ - no_reboot_needed
+ - unknown_strategy
+ - wireless_disable_interfaces |
...system/network/network-wireless/wireless_software/wireless_disable_interfaces/bash/shared.sh
Show resolved
Hide resolved
The rule description explicitly mention |
That is a good question, and I'll make more questions to try to answer it. If |
I remember to work on this rule some months ago and I deeply researched about alternative ways to disable wireless interfaces. It is possible by manipulating files, but the logic would be "extremely" complex to precisely find the patterns and make the solution stable. My conclusion is that I just remembered the
What do you think @anivan-suse and @yuumasato ? |
Hey, so I'm pretty confident (not entirely) that we cannot require NetworkManager. Suse supports two networking set-up tools: wicked and networkmanager (which includes nmcli). Wicked is used it graphic-less servers while NetworkManager (nmcli) is used for systems with graphics displays. This is why we went the route of just checking for existence of NetworkManager rather than requiring it. |
Thanks for the information @anivan-suse. It is a fair point. In that case I would be fine to only warning the user in this rule. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Automatus failures are fine, the rule doesn't have tests and cannot actually be tested in containers.
...system/network/network-wireless/wireless_software/wireless_disable_interfaces/bash/shared.sh
Outdated
Show resolved
Hide resolved
Code Climate has analyzed commit 569b9f6 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 46.8% (0.0% change). View more on Code Climate. |
Description: