Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update sebool_secure_mode_insmod OL remediations #9979

Merged
merged 3 commits into from
Feb 10, 2023
Merged

Update sebool_secure_mode_insmod OL remediations #9979

merged 3 commits into from
Feb 10, 2023

Conversation

Xeicker
Copy link
Contributor

@Xeicker Xeicker commented Dec 15, 2022

Description:

  • Add commands to preload vfat in initramfs

Rationale:

  • After setting secure_mode_insmod to true, Oracle Linux wasn't able to boot. Preload vfat in initramfs so that the system has no issues booting

Review Hints:

  • The issue it fixes can be reproduced by setting secure_mode_insmod to true and reboot. This probably occurs also in RHEL systems

@Xeicker Xeicker requested a review from a team as a code owner December 15, 2022 19:44
@openshift-ci
Copy link

openshift-ci bot commented Dec 15, 2022

Hi @Xeicker. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Dec 15, 2022
@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@jan-cerny
Copy link
Collaborator

@freddieRv Can you please take a look on this?

freddieRv
freddieRv approved these changes Jan 27, 2023
View reviewed changes
Copy link
Contributor

@freddieRv freddieRv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM

@marcusburghardt marcusburghardt added Ansible Ansible remediation update. Bash Bash remediation update. Oracle Linux Oracle Linux product related. labels Jan 31, 2023
@marcusburghardt marcusburghardt added this to the 0.1.67 milestone Jan 31, 2023
Xeicker and others added 2 commits February 2, 2023 15:35
@Xeicker
Update sebool_secure_mode_insmod OL remediations
46a06ae 
After setting secure_mode_insmod to true, Oracle Linux wasn't able to
boot. Preload vfat in initramfs so that the system has no issues
booting

Signed-off-by: Edgar Aguilar <edgar.aguilar@oracle.com>
@Xeicker @marcusburghardt
Apply suggestions from code review
5176fad 
Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
@marcusburghardt marcusburghardt self-assigned this Feb 8, 2023
@Xeicker
Rename remediations to ol instead of shared
60c8b08 
For ansible and bash only applicable to ol products

Signed-off-by: Edgar Aguilar <edgar.aguilar@oracle.com>
@codeclimate
Copy link

codeclimate bot commented Feb 8, 2023

Code Climate has analyzed commit 60c8b08 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.7% (2.2% change).

View more on Code Climate.

marcusburghardt
marcusburghardt approved these changes Feb 10, 2023
View reviewed changes
Copy link
Member

@marcusburghardt marcusburghardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@marcusburghardt
Copy link
Member

Automatus CS9, CS9 and Fedora are failing because there is no SELinux commands in the containers used for these tests.

@marcusburghardt marcusburghardt merged commit 0641c34 into ComplianceAsCode:master Feb 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marcusburghardt marcusburghardt marcusburghardt approved these changes

@freddieRv freddieRv freddieRv approved these changes

Assignees

@marcusburghardt marcusburghardt

Labels
Ansible Ansible remediation update. Bash Bash remediation update. needs-ok-to-test Used by openshift-ci bot. Oracle Linux Oracle Linux product related.
Projects
None yet
Milestone
0.1.67
Development

Successfully merging this pull request may close these issues.
4 participants
@Xeicker @jan-cerny @marcusburghardt @freddieRv