Hide Forgot
When installing RHEL 7.3 using SCAP security profile, "CCE-80258-7 - Disable KDump Kernel Crash Analyzer (kdump)" fails to take effect.
upstream BZ https://github.com/OpenSCAP/scap-security-guide/issues/1547
Shawn, Since you were testing this with anaconda, is this because kdump is configured/enabled/disabled on firstboot?
To be able to disable services through anaconda remediation we need add support for 'service' fix element in oscap-anaconda-addon.
There is also another approach using an Anaconda addon (com_redhat_kdump) that can disable kdump, but oscap-anaconda-addon doesn't support this fix element too.
I say that we should add both 'service' and 'com_redhat_kdump' to the oscap-anaconda-addon to better support kickstart builds.
Created attachment 1270865 [details] Anaconda oscap and kdump addon logs
Although there is no anaconda remediation, I did not understand why the post-install evaluation and remediation would not fix it, if there is script remediation for this. After some investigation I found out that com_redhat_kdump addon runs right after oscap-anaconda-addon and applies its configuration, and default configuration is kdump enabled. See attached log snippet from anaconda.
With latest version of oscap-anaconda-addon (0.9), and following patches to SSG, we can disable kdump at install time. https://github.com/OpenSCAP/scap-security-guide/pull/2764 https://github.com/OpenSCAP/scap-security-guide/pull/2827
Created attachment 1478985 [details] failed anaconda hardening run Hi, it looks like this is still somehow buggy - the anaconda has been properly informed to disable kdump (the spoke has updated to kdump disable by profile selection).
My finding in Comment 11 was manifestation of Bug 1629490. Kdump is truly disabled by the profile after reboot of the machine in version scap-security-guide-0.1.40-5.el7. Verified manually.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3308