Bug 1834716
| Summary: | Remediating rules using service_disabled template during kickstart installation does not work as expected | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Matěj Týč <matyc> | |
| Component: | oscap-anaconda-addon | Assignee: | Matěj Týč <matyc> | |
| Status: | CLOSED WONTFIX | QA Contact: | Release Test Team <release-test-team-automation> | |
| Severity: | high | Docs Contact: | Jan Fiala <jafiala> | |
| Priority: | high | |||
| Version: | 8.0 | CC: | ggasparb, jafiala, jstodola, kborole, lmanasko, matyc, mhaicman, qe-baseos-security, vpolasek, wsato | |
| Target Milestone: | rc | Keywords: | Reopened, Triaged | |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | oscap-anaconda-addon-1.2.1-6.el8 | Doc Type: | Known Issue | |
| Doc Text: |
.Remediating service-related rules during kickstart installations might fail
During a kickstart installation, the OpenSCAP utility sometimes incorrectly shows that a service `enable` or `disable` state remediation is not needed. Consequently, OpenSCAP might set the services on the installed system to a non-compliant state. As a workaround, you can scan and remediate the system after the kickstart installation. This will fix the service-related issues.
|
Story Points: | --- | |
| Clone Of: | 1828871 | |||
| : | 1999587 (view as bug list) | Environment: | ||
| Last Closed: | 2022-07-25 07:28:05 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2041781 | |||
| Bug Blocks: | 1999587 | |||
|
Description
Matěj Týč
2020-05-12 09:38:01 UTC
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. Mateji, I built updates.img using https://github.com/OpenSCAP/oscap-anaconda-addon/blob/rhel8-branch/create_update_image.sh, applied the image during the installation and selected the ANSSI-BP-028 (minimal) profile during manual installation. During the first boot there was the following error and the system restarted: .... [ OK ] Reached target Offline System Update (Pre). Starting Scan and remediate the ope…dance with the selected profile... Starting Update the operating system whilst offline... [ OK ] Started Update the operating system whilst offline. OpenSCAP is checking the system for compliance using ANSSI-BP-028 (minimal) Evaluating... [ *** ] A start job is running for Scan and…e selected profile (7s / no limit)OpenSCAP has failed to evaluate or remediate the system, please check the journal for the details. The system will now restart... [ OK ] Started D-Bus System Message Bus. [ OK ] Created slice User and Session Slice. .... I used RHEL-8.6.0-20220305.2. Could you please check where the problem is? Your output suggests that the firstboot remediation was indeed executed as requested, but not everything went according to the expectations. This raises the first concern - it is not an issue when e.g. one doesn't pass, but the message is unsettling, and the whole start-scan-restart sequence can surprise and disturb customers. The concrete cause of problems has to be investigated on a case-by-case basis, but as a rule of thumb, the /root/openscap_data/eval_remediate_report.html contains a human-readable output of the last finished scan. Pre-verified using development compose (testing compose was not found):
http://download.eng.bos.redhat.com/rhel-8/development/RHEL-8/RHEL-8.7.0-20220421.d.0/compose
Cases executed:
ARCH MODE remediation=
===================================
x86_64 kickstart (default)
x86_64 kickstart both
x86_64 kickstart firstboot
x86_64 manual ~
x86_64 kickstart none
x86_64 kickstart post
aarch64 kickstart (default)
aarch64 kickstart none
aarch64 kickstart post
ppc64 manual ~
All cases behaved as expected.
Thanks for the bug text, it looks fine. Checked that oscap-anaconda-addon-1.2.1-6.el8 is in nightly compose RHEL-8.7.0-20220424.1. Moving to VERIFIED. As there will be no firstboot, this issue remains to be solved again. The KI doc text is accurate. After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |