Ensure that all rules in RHEL ANSSI have references - #13867
Merged
Conversation
jan-cerny
requested changes
Sep 5, 2025
| - package_audit_installed | ||
|
|
||
| - audit_rules_mac_modification_etc_selinux | ||
|
|
Member
There was a problem hiding this comment.
You need to add ldap_client_tls_cacertpath and ldap_client_start_tls to the control file.
| - '!accounts_password_pam_retry' | ||
| - '!file_groupowner_etc_chrony_keys' | ||
| - accounts_password_pam_pwhistory_remember | ||
| - '!ldap_client_start_tls' |
Member
There was a problem hiding this comment.
You will also need to remove the additional selections from the RHEL 8 and RHEL 10 profiles.
jan-cerny
requested changes
Sep 8, 2025
| - sssd_ldap_configure_tls_reqcert | ||
| - sssd_ldap_start_tls | ||
| - ldap_client_start_tls | ||
| - ldap_client_tls_cacertpath |
Member
There was a problem hiding this comment.
You need to add service_chronyd_enabled, audit_rules_mac_modification_etc_selinux and no_nis_in_nsswitch to the control file as well.
Member
|
/packit build |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
All rules that were only in RHEL profile files were added control then excluded from all other products. In theory the only change in the XCCDF should adding references.
Rationale:
Ensure that all rules have references.
Fixes #13857
Review Hints:
Script for Copying the needed files
cd buildctest -j$(nproc) -R stable --output-on-failureandstable-profilesshould pass.