Update RHEL 9 STIG to V2R5 #13795
Update RHEL 9 STIG to V2R5 #13795
Conversation
|
Skipping CI for Draft Pull Request. |
Signed-off-by: Matthew Burket <mburket@redhat.com>
Signed-off-by: Matthew Burket <mburket@redhat.com>
292ab32 to
165868d
Compare
vojtapolasek
left a comment
There was a problem hiding this comment.
Thank you @Mab879 for analyzing changes and submiting this PR.
I am missing the Ansible remediation for the new rule which deals with custom stig subpolicy. Is this intentional?
Also please see my other comments.
| # strategy = configure | ||
| # complexity = low | ||
| # disruption = low | ||
|
|
There was a problem hiding this comment.
Please can you explain what is this good for?
There was a problem hiding this comment.
This was to match other uses of this macro, but I have adjust this.
| @@ -0,0 +1,27 @@ | |||
| documentation_complete: true | |||
|
|
|||
| title: 'Implement STIG Sub Crypto Policy' | |||
There was a problem hiding this comment.
Do you plan on expanding the description and rationale? Or adding fixtest / checktext?
|
Ansible remediation has been added. Fix and check text is in the policy file. |
| - name: "{{{ rule_title }}} - Create custom crypto policy - cipher" | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/crypto-policies/policies/modules/STIG.pmod | ||
| owner: root |
There was a problem hiding this comment.
| # disruption = low | ||
|
|
||
| - name: "{{{ rule_title }}} - Create custom crypto policy - cipher" | ||
| ansible.builtin.lineinfile: |
There was a problem hiding this comment.
Also @Mab879 I think we will need a regex parameter for this task. Currently, it appends the line, but it leaves existing (potentially incorrect) lines in tact.
The update-crypto-policies command then fails.
vojtapolasek
left a comment
There was a problem hiding this comment.
Looks good now.
I rerun ctest on all products locally and it passes, it seems that Testingfarm has some problems with provisioning of machines.
I also waive the Automatus Fedora test as new rules are not present in fedora product.
I verified that new rules work by running Automatus tests on RHEL 9.
a4ed5a7
into
ComplianceAsCode:master
Description:
Rationale:
Keeping the STIG up-to-date.