diff --git a/conf/waivers/productization b/conf/waivers/productization index 898f73c9..9fb5de18 100644 --- a/conf/waivers/productization +++ b/conf/waivers/productization @@ -48,6 +48,7 @@ /hardening/anaconda/with-gui/[^/]+/service_avahi-daemon_disabled /hardening/anaconda/with-gui/[^/]+/service_dnsmasq_disabled /hardening/anaconda(/with-gui)?/cis[^/]*/socket_systemd-journal-remote_disabled +/hardening/anaconda/cui/socket_systemd-journal-remote_disabled # https://github.com/ComplianceAsCode/content/issues/11498 /hardening/anaconda/with-gui/[^/]+/service_bluetooth_disabled # related to, but probably not caused by: @@ -101,6 +102,13 @@ /hardening/image-builder/uefi/ism_o_top_secret rhel == 10 and status == 'error' +# Image builder needs to add the CUI profile to its allow list; osbuild-composer +# rejects it with "unsupported profile xccdf_org.ssgproject.content_profile_cui" +# https://redhat.atlassian.net/browse/HMS-11244 +/hardening/image-builder/cui +/hardening/image-builder/uefi/cui + status == 'error' + # https://github.com/ComplianceAsCode/content/issues/15002 /hardening/host-os/ansible/.+/mount_option_tmp_noexec True diff --git a/conf/waivers/test_specific b/conf/waivers/test_specific new file mode 100644 index 00000000..c999091d --- /dev/null +++ b/conf/waivers/test_specific @@ -0,0 +1,28 @@ +# Waivers rooted in how a specific Contest test is built, rather than in the +# scanned content or product itself. Grouped separately from conf/waivers/permanent +# so the "content/product defect" and "test methodology" waivers aren't mixed. + +# /hardening/container/old-new/* simulates an Image Mode Day-2 upgrade: an old +# image (hardened with the currently shipped content) is booted, then switched +# ("bootc switch") to a new image (hardened with the tested CaC content), and +# scanned post-switch. "bootc switch" does not re-run remediation and does not +# re-provision /var, and only 3-way-merges /etc against the live system - it +# does not simply replace guest state with the new image's state. So rules that +# the *old* content didn't select can fail post-switch even though the new +# image itself was hardened correctly, because whatever the new image's build +# produced under /var (or a locally-diverged /etc) never reaches the running +# guest. +# +# TODO: Remove these waivers when the "old" content contains the rules. +# --- +# aide_build_database: old CUI doesn't select this rule, so the AIDE db is never +# seeded into /var on the old image. /var is never re-provisioned by "bootc +# switch", so the db built into the new image never reaches the guest. Deterministic. +/hardening/container/old-new/cui/aide_build_database +# ensure_pam_wheel_group_empty: old CUI doesn't select this rule, so the empty-wheel +# fix baked into the new image's /etc/group can be dropped by ostree's /etc 3-way +# merge on "bootc switch" if the live copy looks locally modified. Confirmed flaky. +/hardening/container/old-new/cui/ensure_pam_wheel_group_empty + True + +# vim: syntax=python diff --git a/hardening/anaconda/main.fmf b/hardening/anaconda/main.fmf index 5cf5858a..12e09dde 100644 --- a/hardening/anaconda/main.fmf +++ b/hardening/anaconda/main.fmf @@ -60,12 +60,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/anaconda/with-gui.fmf b/hardening/anaconda/with-gui.fmf index e269035e..7572e9aa 100644 --- a/hardening/anaconda/with-gui.fmf +++ b/hardening/anaconda/with-gui.fmf @@ -45,17 +45,9 @@ tag+: - subset-profile /cui: - tag+: - - fips adjust+: - - when: distro == rhel-8 or distro == centos-stream-8 - enabled: false - because: > - not supported on RHEL-8 according to RHEL documentation, - the "Profiles not compatible with Server with GUI" table - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ + - enabled: false + because: CUI profile is not supported with GUI /e8: diff --git a/hardening/ansible/main.fmf b/hardening/ansible/main.fmf index 98d4f2bb..ecdbff4d 100644 --- a/hardening/ansible/main.fmf +++ b/hardening/ansible/main.fmf @@ -64,12 +64,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/ansible/uefi.fmf b/hardening/ansible/uefi.fmf index 5465a6a0..24cba9e0 100644 --- a/hardening/ansible/uefi.fmf +++ b/hardening/ansible/uefi.fmf @@ -40,12 +40,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/ansible/with-gui.fmf b/hardening/ansible/with-gui.fmf index c0c0bd70..92933435 100644 --- a/hardening/ansible/with-gui.fmf +++ b/hardening/ansible/with-gui.fmf @@ -45,17 +45,9 @@ tag+: - subset-profile /cui: - tag+: - - fips adjust+: - - when: distro == rhel-8 or distro == centos-stream-8 - enabled: false - because: > - not supported on RHEL-8 according to RHEL documentation, - the "Profiles not compatible with Server with GUI" table - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ + - enabled: false + because: CUI profile is not supported with GUI /e8: diff --git a/hardening/container/anaconda-ostree/main.fmf b/hardening/container/anaconda-ostree/main.fmf index a0f9f115..380ac3e9 100644 --- a/hardening/container/anaconda-ostree/main.fmf +++ b/hardening/container/anaconda-ostree/main.fmf @@ -63,12 +63,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/container/bootc-image-builder/main.fmf b/hardening/container/bootc-image-builder/main.fmf index 57545d20..19f0ad1e 100644 --- a/hardening/container/bootc-image-builder/main.fmf +++ b/hardening/container/bootc-image-builder/main.fmf @@ -63,10 +63,6 @@ adjust+: - subset-profile /cui: - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/container/old-new/main.fmf b/hardening/container/old-new/main.fmf index 656a8dfc..d81f6d8b 100644 --- a/hardening/container/old-new/main.fmf +++ b/hardening/container/old-new/main.fmf @@ -70,10 +70,6 @@ adjust+: - subset-profile /cui: - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/host-os/ansible/main.fmf b/hardening/host-os/ansible/main.fmf index d3ed1951..55cf2912 100644 --- a/hardening/host-os/ansible/main.fmf +++ b/hardening/host-os/ansible/main.fmf @@ -51,9 +51,6 @@ adjust+: /cui: adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ - when: distro == rhel-8 or distro == centos-stream-8 require+: [rng-tools] because: > diff --git a/hardening/host-os/oscap/main.fmf b/hardening/host-os/oscap/main.fmf index 7acbf5d8..251ad3c3 100644 --- a/hardening/host-os/oscap/main.fmf +++ b/hardening/host-os/oscap/main.fmf @@ -42,9 +42,6 @@ tag: /cui: adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ - when: distro == rhel-8 or distro == centos-stream-8 require+: [rng-tools] because: > diff --git a/hardening/image-builder/main.fmf b/hardening/image-builder/main.fmf index 5aeb80d9..9656e9cd 100644 --- a/hardening/image-builder/main.fmf +++ b/hardening/image-builder/main.fmf @@ -68,10 +68,6 @@ extra-priority: 1 - subset-profile /cui: - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/image-builder/uefi.fmf b/hardening/image-builder/uefi.fmf index c0e33145..263539f2 100644 --- a/hardening/image-builder/uefi.fmf +++ b/hardening/image-builder/uefi.fmf @@ -40,10 +40,6 @@ adjust+: - subset-profile /cui: - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/kickstart/main.fmf b/hardening/kickstart/main.fmf index 7c276926..1f1ce653 100644 --- a/hardening/kickstart/main.fmf +++ b/hardening/kickstart/main.fmf @@ -62,12 +62,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/kickstart/uefi.fmf b/hardening/kickstart/uefi.fmf index ec5dc28a..06bed68a 100644 --- a/hardening/kickstart/uefi.fmf +++ b/hardening/kickstart/uefi.fmf @@ -40,12 +40,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/kickstart/with-gui.fmf b/hardening/kickstart/with-gui.fmf index e269035e..7572e9aa 100644 --- a/hardening/kickstart/with-gui.fmf +++ b/hardening/kickstart/with-gui.fmf @@ -45,17 +45,9 @@ tag+: - subset-profile /cui: - tag+: - - fips adjust+: - - when: distro == rhel-8 or distro == centos-stream-8 - enabled: false - because: > - not supported on RHEL-8 according to RHEL documentation, - the "Profiles not compatible with Server with GUI" table - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ + - enabled: false + because: CUI profile is not supported with GUI /e8: diff --git a/hardening/oscap/main.fmf b/hardening/oscap/main.fmf index 777cf581..021c8c3e 100644 --- a/hardening/oscap/main.fmf +++ b/hardening/oscap/main.fmf @@ -59,12 +59,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/oscap/old-new/main.fmf b/hardening/oscap/old-new/main.fmf index c88a20bf..e739b6bd 100644 --- a/hardening/oscap/old-new/main.fmf +++ b/hardening/oscap/old-new/main.fmf @@ -43,12 +43,6 @@ environment+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/oscap/uefi.fmf b/hardening/oscap/uefi.fmf index 5465a6a0..24cba9e0 100644 --- a/hardening/oscap/uefi.fmf +++ b/hardening/oscap/uefi.fmf @@ -40,12 +40,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/hardening/oscap/with-gui.fmf b/hardening/oscap/with-gui.fmf index 7d4bbae0..4b4b8b5a 100644 --- a/hardening/oscap/with-gui.fmf +++ b/hardening/oscap/with-gui.fmf @@ -45,17 +45,9 @@ tag+: - subset-profile /cui: - tag+: - - fips adjust+: - - when: distro == rhel-8 or distro == centos-stream-8 - enabled: false - because: > - not supported on RHEL-8 according to RHEL documentation, - the "Profiles not compatible with Server with GUI" table - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ + - enabled: false + because: CUI profile is not supported with GUI /e8: diff --git a/scanning/boot-errors/main.fmf b/scanning/boot-errors/main.fmf index 671677e7..d9fee7be 100644 --- a/scanning/boot-errors/main.fmf +++ b/scanning/boot-errors/main.fmf @@ -64,12 +64,6 @@ adjust+: - subset-profile /cui: - tag+: - - fips - adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ /e8: diff --git a/scanning/host-os/ansible-check/check-mode/main.fmf b/scanning/host-os/ansible-check/check-mode/main.fmf index b82eb6bb..cc01faed 100644 --- a/scanning/host-os/ansible-check/check-mode/main.fmf +++ b/scanning/host-os/ansible-check/check-mode/main.fmf @@ -52,9 +52,6 @@ adjust+: /cui: adjust+: - - when: distro >= rhel-10 or distro >= centos-stream-10 - enabled: false - because: there is no CUI profile on RHEL-10+ - when: distro == rhel-8 or distro == centos-stream-8 require+: [rng-tools] because: >