Bug 2172555

Description of problem:

The firewalld_sshd_port_enabled rule was recently refactored[1] to ensure the SSH access is properly enabled in alignment to NetworkManager and Firewalld standards.

Part of the rule check is to ensure that all existing NICs are assigned to a Firewalld zone. This is accomplished by checking the NIC configuration files.

In RHEL8 the NIC settings are stored by default in "/etc/sysconfig/network-scripts". In RHEL9 the NIC settings are stored by default in "/etc/NetworkManager/system-connections". The check is consistent with this, looking in different directories according to the RHEL version.

For compatibility purposes, NetworkManager can work with both directories depending on how the NetworkManager plugins are defined in NetworkManager.conf file.

Therefore, in case a NIC is configured in both directories, one will have precedence over the other according to the order they are defined. This makes it hard to ensure the correct file is properly configured.

The issue in this BZ is specific for a scenario where the RHEL8, which uses ifcfg files, is upgraded to a RHEL9, which prefers NetworkManager keyfiles. During the upgrade, the ifcfg files are not migrated to keyfiles and this causes a false negative during the check because the check expects to find the keyfiles in a RHEL9 system.

- [1] https://github.com/ComplianceAsCode/content/pull/9712

Version-Release number of selected component (if applicable):
RHEL9
scap-security-guide-0.1.66

How reproducible:
Always

Steps to Reproduce:
1. Install a clean RHEL8 system
2. Upgrade the RHEL8 system to RHEL9
3. Scan the system for the firewalld_sshd_port_enabled rule, choosing to remediate if necessary:
4. oscap xccdf eval --remediate --profile stig --rule xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Actual results:
The scan after remediation fail.

Expected results:
The scan after remediation pass.

Additional info:

The initial scan will report fail because the expected NetworkManager keyfile is not found in RHEL9, then the remediation will be executed and the ifcfg file will be properly fixed honoring existing ifcfg file.
However, the scan after the remediation will return error because the keyfile was not found.

There is a NetworkManager command used to migrate legacy ifcfg files to keyfile format:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_and_managing_networking/assembly_manually-creating-networkmanager-profiles-in-keyfile-format_configuring-and-managing-networking#proc_migrating-networkmanager-profiles-from-ifcfg-to-keyfile-format_assembly_manually-creating-networkmanager-profiles-in-keyfile-format

However, this migration is not automatic during the system Upgrade neither during the remediation. On the remediation side, although recommended the migration to keyfile format in RHEL9, it is intentional to preserve desired standards defined by the administrators.