Enable CUI profile testing on RHEL-10

conf/waivers/productization

@@ -48,6 +48,7 @@
 /hardening/anaconda/with-gui/[^/]+/service_avahi-daemon_disabled
 /hardening/anaconda/with-gui/[^/]+/service_dnsmasq_disabled
 /hardening/anaconda(/with-gui)?/cis[^/]*/socket_systemd-journal-remote_disabled
+/hardening/anaconda/cui/socket_systemd-journal-remote_disabled
 # https://github.com/ComplianceAsCode/content/issues/11498
 /hardening/anaconda/with-gui/[^/]+/service_bluetooth_disabled
 # related to, but probably not caused by:
@@ -101,6 +102,13 @@
 /hardening/image-builder/uefi/ism_o_top_secret
     rhel == 10 and status == 'error'
 
+# Image builder needs to add the CUI profile to its allow list; osbuild-composer
+# rejects it with "unsupported profile xccdf_org.ssgproject.content_profile_cui"
+# https://redhat.atlassian.net/browse/HMS-11244
+/hardening/image-builder/cui
+/hardening/image-builder/uefi/cui
+    status == 'error'
+
 # https://github.com/ComplianceAsCode/content/issues/15002
 /hardening/host-os/ansible/.+/mount_option_tmp_noexec
     True

conf/waivers/test_specific

@@ -0,0 +1,28 @@
+# Waivers rooted in how a specific Contest test is built, rather than in the
+# scanned content or product itself. Grouped separately from conf/waivers/permanent
+# so the "content/product defect" and "test methodology" waivers aren't mixed.
+
+# /hardening/container/old-new/* simulates an Image Mode Day-2 upgrade: an old
+# image (hardened with the currently shipped content) is booted, then switched
+# ("bootc switch") to a new image (hardened with the tested CaC content), and
+# scanned post-switch. "bootc switch" does not re-run remediation and does not
+# re-provision /var, and only 3-way-merges /etc against the live system - it
+# does not simply replace guest state with the new image's state. So rules that
+# the *old* content didn't select can fail post-switch even though the new
+# image itself was hardened correctly, because whatever the new image's build
+# produced under /var (or a locally-diverged /etc) never reaches the running
+# guest.
+#
+# TODO: Remove these waivers when the "old" content contains the rules.
+# ---
+# aide_build_database: old CUI doesn't select this rule, so the AIDE db is never
+# seeded into /var on the old image. /var is never re-provisioned by "bootc
+# switch", so the db built into the new image never reaches the guest. Deterministic.
+/hardening/container/old-new/cui/aide_build_database
+# ensure_pam_wheel_group_empty: old CUI doesn't select this rule, so the empty-wheel
+# fix baked into the new image's /etc/group can be dropped by ostree's /etc 3-way
+# merge on "bootc switch" if the live copy looks locally modified. Confirmed flaky.
+/hardening/container/old-new/cui/ensure_pam_wheel_group_empty
+    True
+
+# vim: syntax=python

hardening/anaconda/main.fmf

@@ -60,12 +60,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/anaconda/with-gui.fmf

@@ -45,17 +45,9 @@ tag+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
     adjust+:
-      - when: distro == rhel-8 or distro == centos-stream-8
-        enabled: false
-        because: >
-            not supported on RHEL-8 according to RHEL documentation,
-            the "Profiles not compatible with Server with GUI" table
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
+      - enabled: false
+        because: CUI profile is not supported with GUI
 
 /e8:
 

hardening/ansible/main.fmf

@@ -64,12 +64,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/ansible/uefi.fmf

@@ -40,12 +40,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/ansible/with-gui.fmf

@@ -45,17 +45,9 @@ tag+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
     adjust+:
-      - when: distro == rhel-8 or distro == centos-stream-8
-        enabled: false
-        because: >
-            not supported on RHEL-8 according to RHEL documentation,
-            the "Profiles not compatible with Server with GUI" table
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
+      - enabled: false
+        because: CUI profile is not supported with GUI
 
 /e8:
 

hardening/container/anaconda-ostree/main.fmf

@@ -63,12 +63,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/container/bootc-image-builder/main.fmf

@@ -63,10 +63,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/container/old-new/main.fmf

@@ -70,10 +70,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/host-os/ansible/main.fmf

@@ -51,9 +51,6 @@ adjust+:
 
 /cui:
     adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
       - when: distro == rhel-8 or distro == centos-stream-8
         require+: [rng-tools]
         because: >

hardening/host-os/oscap/main.fmf

@@ -42,9 +42,6 @@ tag:
 
 /cui:
     adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
       - when: distro == rhel-8 or distro == centos-stream-8
         require+: [rng-tools]
         because: >

hardening/image-builder/main.fmf

@@ -68,10 +68,6 @@ extra-priority: 1
       - subset-profile
 
 /cui:
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/image-builder/uefi.fmf

@@ -40,10 +40,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/kickstart/main.fmf

@@ -62,12 +62,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/kickstart/uefi.fmf

@@ -40,12 +40,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/kickstart/with-gui.fmf

@@ -45,17 +45,9 @@ tag+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
     adjust+:
-      - when: distro == rhel-8 or distro == centos-stream-8
-        enabled: false
-        because: >
-            not supported on RHEL-8 according to RHEL documentation,
-            the "Profiles not compatible with Server with GUI" table
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
+      - enabled: false
+        because: CUI profile is not supported with GUI
 
 /e8:
 

hardening/oscap/main.fmf

@@ -59,12 +59,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/oscap/old-new/main.fmf

@@ -43,12 +43,6 @@ environment+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/oscap/uefi.fmf

@@ -40,12 +40,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

hardening/oscap/with-gui.fmf

@@ -45,17 +45,9 @@ tag+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
     adjust+:
-      - when: distro == rhel-8 or distro == centos-stream-8
-        enabled: false
-        because: >
-            not supported on RHEL-8 according to RHEL documentation,
-            the "Profiles not compatible with Server with GUI" table
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
+      - enabled: false
+        because: CUI profile is not supported with GUI
 
 /e8:
 

scanning/boot-errors/main.fmf

@@ -64,12 +64,6 @@ adjust+:
       - subset-profile
 
 /cui:
-    tag+:
-      - fips
-    adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
 
 /e8:
 

scanning/host-os/ansible-check/check-mode/main.fmf

@@ -52,9 +52,6 @@ adjust+:
 
 /cui:
     adjust+:
-      - when: distro >= rhel-10 or distro >= centos-stream-10
-        enabled: false
-        because: there is no CUI profile on RHEL-10+
       - when: distro == rhel-8 or distro == centos-stream-8
         require+: [rng-tools]
         because: >