Bug 2117192

+++ This bug was initially created as a clone of Bug #2114979 +++

The RHEL8 OSPP profile also needs to select authselect minimal profile.

Description of problem:

The scap-security-guide-0.1.63-1.el9 build seems to bring new SCAP rule enable_authselect to the OSPP profile, with var_authselect_profile=sssd.

However, the rule does not have any ospp references, and sssd is not even installed on the OSPP TOE based on @core group, so that rule will fail to remediate.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.63-1.el9

How reproducible:

Deterministic.

Steps to Reproduce:
1. Have RHEL 9 with @core group installed.
2. Run oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_enable_authselect --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Actual results:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   Enable authselect
Rule    xccdf_org.ssgproject.content_rule_enable_authselect
Ident   CCE-89732-2
Result  fail

--- Starting Remediation ---

WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title   Enable authselect
Rule    xccdf_org.ssgproject.content_rule_enable_authselect
Ident   CCE-89732-2
Result  error

Expected results:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL9.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   Enable authselect
Rule    xccdf_org.ssgproject.content_rule_enable_authselect
Ident   CCE-89732-2
Result  fail

--- Starting Remediation ---

WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL9.xml.bz2 file which is referenced from XCCDF content
Title   Enable authselect
Rule    xccdf_org.ssgproject.content_rule_enable_authselect
Ident   CCE-89732-2
Result  fixed

Additional info:

Since without authselect configured, rules

   no_empty_passwords
   accounts_passwords_pam_faillock_deny
   accounts_passwords_pam_faillock_interval
   accounts_passwords_pam_faillock_unlock_time

fail to remediate as well, please also add their ospp references (FIA_UAU.1, FIA_AFL.1) to rule enable_authselect.

--- Additional comment from Jan Pazdziora on 2022-08-03 18:10:49 CEST ---

I forgot to mention, the authselect selection that we are looking for for OSPP is minimal.

--- Additional comment from Vojtech Polasek on 2022-08-05 12:21:21 CEST ---

Analysis:
* change var_authselect_profile to minimal in rhel9 ospp profile.
* put FIA_UAU.1, FIA_AFL.1 references to enable_authselect.

--- Additional comment from Watson Yuuma Sato on 2022-08-08 16:09:49 CEST ---

Patch upstream: https://github.com/ComplianceAsCode/content/pull/9298

--- Additional comment from RHEL Program Management on 2022-08-10 09:28:34 CEST ---

DevMissed

The Current Deadline for this BZ has passed. Please discuss with your PO & QE Contact and revise the Current Deadline in one of the following ways:

1. Update the Devel Target Milestone (DTM) to when you think the work will be ready for verification.
2. Set a Custom Deadline Type and Date to when you think the work will be ready for verification. 
3. Update the Internal Target Milestone (ITM) according to QE guidance.  In the absence of 1 and 2 above, the Current Deadline is automatically set to 6 days before the ITM date.

Note that BZs that miss their due date by more than 2 weeks will automatically lose their ITM and thus their release+. 
 Resetting ITM will cause release+ to be restored.

More details about deadline management are available at https://one.redhat.com/rhel-developer-guide/#proc_using-deadlines-to-prioritize-work_assembly_development