Comments (6)
jan-cerny
commented on June 6, 2024
From the Ansible output above we can see that only one task of the tasks was skipped and that was the one where the mount_info Ansible fact is created manually if it doesn't exist. But as we can see from the task right above the skipped task the mount_info fact exists in this case, and we can see that the task that actually contains the mount module invocation which is the last task in the output has been executed and ended in the changed state. So I think the remediation actually isn't skipped and even could be performed correctly.
We need to investigate if there is any interference of other tasks with this rules's tasks or anything happening between the time of remediation and a new scan.
from content.
jan-cerny
commented on June 6, 2024
I thinkt that the Ansible Tasks for the rule mount_option_boot_nosuid are in conflict with Ansible Task remediating rule mount_option_nodev_nonroot_local_partitions which is executed after them.
I have done an experiment in which I have removed mount_option_nodev_nonroot_local_partitions from the anssi controls file and rebuild content and executed the given contest test in a lab environment using this command:
tmt -c distro=rhel-9 run -vvva -e CONTEST_CONTENT=/root/content plans -n /plans/default provision -h connect -k ~/.ssh/id_rsa -u root -g $HOSTNAME discover -h fmf -t /hardening/host-os/ansible/anssi_bp28_high report
In this experiment the rule mount_option_boot_nosuid is passing in the final scan.
Could it be that the Ansible Task for mount_option_nodev_nonroot_local_partitions reinserts the originally gathered ansible_facts but the reality changed meanwhile so it reinserts the original options?
Look to the beaker output in the original run:
TASK [Ensure non-root local partitions are mounted with nodev option] **********
skipping: [localhost] => (item={'mount': '/', 'device': '/dev/mapper/rhel_scap--t9-root', 'fstype': 'xfs', 'options': 'rw,seclabel,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota', 'size_total': 37558423552, 'size_available': 34363658240, 'block_size': 4096, 'block_total': 9169537, 'block_available': 8389565, 'block_used': 779972, 'inode_total': 18348032, 'inode_available': 18298009, 'inode_used': 50023, 'uuid': 'e293e634-45dd-4d94-b7b4-39592fdcf8d0'}) => {"ansible_loop_var": "item", "changed": false, "false_condition": "item.mount is match('/\\w')", "item": {"block_available": 8389565, "block_size": 4096, "block_total": 9169537, "block_used": 779972, "device": "/dev/mapper/rhel_scap--t9-root", "fstype": "xfs", "inode_available": 18298009, "inode_total": 18348032, "inode_used": 50023, "mount": "/", "options": "rw,seclabel,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota", "size_available": 34363658240, "size_total": 37558423552, "uuid": "e293e634-45dd-4d94-b7b4-39592fdcf8d0"}, "skip_reason": "Conditional result was False"}
changed: [localhost] => (item={'mount': '/boot', 'device': '/dev/vda1', 'fstype': 'xfs', 'options': 'rw,seclabel,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota', 'size_total': 1063256064, 'size_available': 824438784, 'block_size': 4096, 'block_total': 259584, 'block_available': 201279, 'block_used': 58305, 'inode_total': 524288, 'inode_available': 523978, 'inode_used': 310, 'uuid': '6ff757af-96dd-4022-aa8a-a5c79ca8dad0'}) => {"ansible_loop_var": "item", "backup_file": "", "boot": "yes", "changed": true, "dump": "0", "fstab": "/etc/fstab", "fstype": "xfs", "item": {"block_available": 201279, "block_size": 4096, "block_total": 259584, "block_used": 58305, "device": "/dev/vda1", "fstype": "xfs", "inode_available": 523978, "inode_total": 524288, "inode_used": 310, "mount": "/boot", "options": "rw,seclabel,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota", "size_available": 824438784, "size_total": 1063256064, "uuid": "6ff757af-96dd-4022-aa8a-a5c79ca8dad0"}, "name": "/boot", "opts": "rw,seclabel,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota,nodev", "passno": "0", "src": "/dev/vda1"}
from content.
Mab879
commented on June 6, 2024
In the latest runs, this still seems to be an issue.
from content.
Mab879
commented on June 6, 2024
There is a similar issue with image builder on this rule as well.
Is there a possibility they are related?
from content.
vojtapolasek
commented on June 6, 2024
I can confirm the issue with the rule appears now in Imagebuilder tests during daily productization.
from content.
vojtapolasek
commented on June 6, 2024
I created a different issue to track the problem with Imagebuilder. This issue was originally about Ansible remediation of the rule, Imagebuilder uses Bash remediation.
The new issue is https://github.com/ComplianceAsCode/content/issues/11996I can confirm the issue with the rule appears now in Imagebuilder tests during daily productization.
from content.
Related Issues (20)
- chronyd_or_ntpd_set_maxpoll is not remediated by Ansible HOT 2
- firewalld_sshd_port_enabled fails to remediate on aarch64 HOT 5
- accounts_umask_etc_bashrc is misaligned with RHEL 9 STIG HOT 4
- `audit_rules_networkconfig_modification_network_scripts` is broken in Automatus
- zipl_bootmap_is_up_to_date is failing after Ansible remediation HOT 2
- test scenarios for firewalld_sshd_port_enabled are failing on RHEL 8.6 HOT 4
- test scenario for service_bluetooth_disabled is not causing expected fail HOT 3
- Should files in /tmp be checked for permissions when using tmpfs?
- OpenSCAP Ubuntu 20.04 STIG Profile Issue with Banner Test HOT 2
- mount_option_nodev_nonroot_local_partitions reported as failing after scan of IB created image HOT 1
- Fedora Workstation 40 Remediations
- aide_use_fips_hashes fails after remediation HOT 1
- Failed on "Set SELinux boolean ssh_sysadm_login accordingly" HOT 2
- Automatus rule-based testing fails when no profile is specified HOT 2
- Multiple formats used in NIST 800-53 control ID references HOT 2
- Test scenarios fail for SCE-only rules if built without SCE HOT 1
- Playbook stops at TASK [Ensure NetworkManager is installed] HOT 2
- chronyd_or_ntpd_set_maxpoll fails after RHEL 7 STIG remediation HOT 2
- [Product Removal Request] RHEL7 HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from content.