Fix Service Applicability for RHEL 9 Profiles #11367

Mab879 · 2023-12-08T18:47:08Z

Description:

See each commit for details.

Rationale:

Fixes #11341

This package doesn't exist on RHEL 9 so it should be removed.

These packages are not on RHEL 9.

github-actions · 2023-12-08T18:49:21Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-12-08T18:51:24Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q autofs ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'autofs.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-80873-3
+  - DISA-STIG-RHEL-08-040070
+  - NIST-800-171-3.4.6
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - NIST-800-53-MP-7
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - service_autofs_disabled
+
 - name: Block Disable service autofs
   block:
 
@@ -15,7 +33,8 @@
     - name: Intentionally ignored previous 'Disable service autofs' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "autofs" in ansible_facts.packages )
   tags:
   - CCE-80873-3
   - DISA-STIG-RHEL-08-040070
@@ -37,7 +56,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "autofs" in ansible_facts.packages )
   tags:
   - CCE-80873-3
   - DISA-STIG-RHEL-08-040070
@@ -60,7 +80,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "autofs" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("autofs.socket",multiline=True)
   tags:
   - CCE-80873-3

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_autofs_disabled'
--- xccdf_org.ssgproject.content_rule_service_autofs_disabled
+++ xccdf_org.ssgproject.content_rule_service_autofs_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_autofs:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q avahi ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'avahi-daemon.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1,3 +1,19 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82188-4
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - PCI-DSSv4-2.2.4
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - service_avahi-daemon_disabled
+
 - name: Block Disable service avahi-daemon
   block:
 
@@ -15,7 +31,8 @@
     - name: Intentionally ignored previous 'Disable service avahi-daemon' failure,
         service was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "avahi" in ansible_facts.packages )
   tags:
   - CCE-82188-4
   - NIST-800-53-CM-6(a)
@@ -35,7 +52,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "avahi" in ansible_facts.packages )
   tags:
   - CCE-82188-4
   - NIST-800-53-CM-6(a)
@@ -56,7 +74,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "avahi" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("avahi-daemon.socket",multiline=True)
   tags:
   - CCE-82188-4

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled'
--- xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
+++ xccdf_org.ssgproject.content_rule_service_avahi-daemon_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_avahi:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q telnet-server ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'telnet.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1,3 +1,21 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-80887-3
+  - NIST-800-171-3.1.13
+  - NIST-800-171-3.4.7
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-CM-7(a)
+  - NIST-800-53-CM-7(b)
+  - NIST-800-53-IA-5(1)(c)
+  - disable_strategy
+  - high_severity
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed
+  - service_telnet_disabled
+
 - name: Block Disable service telnet
   block:
 
@@ -15,7 +33,8 @@
     - name: Intentionally ignored previous 'Disable service telnet' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "telnet-server" in ansible_facts.packages )
   tags:
   - CCE-80887-3
   - NIST-800-171-3.1.13
@@ -37,7 +56,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "telnet-server" in ansible_facts.packages )
   tags:
   - CCE-80887-3
   - NIST-800-171-3.1.13
@@ -60,7 +80,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "telnet-server" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("telnet.socket",multiline=True)
   tags:
   - CCE-80887-3

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled'
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_telnet-server:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q squid ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'squid.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82190-0
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - no_reboot_needed
+  - service_squid_disabled
+  - unknown_severity
+
 - name: Block Disable service squid
   block:
 
@@ -15,7 +27,8 @@
     - name: Intentionally ignored previous 'Disable service squid' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "squid" in ansible_facts.packages )
   tags:
   - CCE-82190-0
   - disable_strategy
@@ -31,7 +44,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "squid" in ansible_facts.packages )
   tags:
   - CCE-82190-0
   - disable_strategy
@@ -48,7 +62,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "squid" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("squid.socket",multiline=True)
   tags:
   - CCE-82190-0

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_squid_disabled'
--- xccdf_org.ssgproject.content_rule_service_squid_disabled
+++ xccdf_org.ssgproject.content_rule_service_squid_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_squid:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q net-snmp ); then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'snmpd.service'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled' differs.
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1,3 +1,15 @@
+- name: Gather the package facts
+  package_facts:
+    manager: auto
+  tags:
+  - CCE-82758-4
+  - disable_strategy
+  - low_complexity
+  - low_disruption
+  - low_severity
+  - no_reboot_needed
+  - service_snmpd_disabled
+
 - name: Block Disable service snmpd
   block:
 
@@ -15,7 +27,8 @@
     - name: Intentionally ignored previous 'Disable service snmpd' failure, service
         was already disabled
       meta: noop
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "net-snmp" in ansible_facts.packages )
   tags:
   - CCE-82758-4
   - disable_strategy
@@ -31,7 +44,8 @@
   changed_when: false
   failed_when: socket_file_exists.rc not in [0, 1]
   check_mode: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when: ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman",
+    "container"] and "net-snmp" in ansible_facts.packages )
   tags:
   - CCE-82758-4
   - disable_strategy
@@ -48,7 +62,8 @@
     state: stopped
     masked: 'yes'
   when:
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and "net-snmp" in ansible_facts.packages )
   - socket_file_exists.stdout_lines is search("snmpd.socket",multiline=True)
   tags:
   - CCE-82758-4

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_service_snmpd_disabled'
--- xccdf_org.ssgproject.content_rule_service_snmpd_disabled
+++ xccdf_org.ssgproject.content_rule_service_snmpd_disabled
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-package_snmpd:def:1

qlty-cloud-legacy · 2023-12-08T18:59:53Z

Code Climate has analyzed commit 6a59faf and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

marcusburghardt

Thanks

Mab879 added 8 commits December 8, 2023 11:56

Add squid package platform to service_squid_disabled

68031fa

Add package telnet-server platform to service_telnet_disabled

7b1dbca

Remove xinetd rules from HIPAA and e8 profiles on RHEL 9

13e8634

This package doesn't exist on RHEL 9 so it should be removed.

Add avahi package platform to service_avahi-daemon_disabled

dea12b2

Remove rlogin rules from RHEL9 HIPAA profile

0656548

These packages are not on RHEL 9.

Add autofs package platform to service_autofs_disabled

1ce0c75

Add snmpd package platform to service_snmpd_disabled

c723d80

Sort shared/applicability/package.yml

6a59faf

Mab879 added the Update Rule Issues or pull requests related to Rules updates. label Dec 8, 2023

Mab879 added this to the 0.1.72 milestone Dec 8, 2023

Mab879 requested a review from a team as a code owner December 8, 2023 18:47

Mab879 changed the title ~~Fix 11341~~ Dec 8, 2023

marcusburghardt approved these changes Dec 11, 2023

View reviewed changes

marcusburghardt self-assigned this Dec 11, 2023

marcusburghardt merged commit 481d874 into ComplianceAsCode:master Dec 11, 2023

Mab879 deleted the fix_11341 branch December 11, 2023 14:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix Service Applicability for RHEL 9 Profiles #11367

Fix Service Applicability for RHEL 9 Profiles #11367

Uh oh!

Mab879 commented Dec 8, 2023

github-actions bot commented Dec 8, 2023

github-actions bot commented Dec 8, 2023

qlty-cloud-legacy bot commented Dec 8, 2023

marcusburghardt left a comment

Labels

2 participants

Fix Service Applicability for RHEL 9 Profiles #11367

Fix Service Applicability for RHEL 9 Profiles #11367

Uh oh!

Conversation

Mab879 commented Dec 8, 2023

Description:

Rationale:

github-actions bot commented Dec 8, 2023

github-actions bot commented Dec 8, 2023

qlty-cloud-legacy bot commented Dec 8, 2023

marcusburghardt left a comment

Choose a reason for hiding this comment

Labels

2 participants