Red Hat Bugzilla – Bug 1571312
Some rules in PCI-DSS, DISA STIG and USGCB Profile fail to remediate [rhel-7.5.z]
Last modified: 2018-05-14 12:13:56 EDT
This bug has been copied from bug #1570802 and has been proposed to be backported to 7.5 z-stream (EUS).
dpdk-17.11.2-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c965abb15
dpdk-17.11.2-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2c965abb15
This is not a dpdk bug, reverting status change.
Verified fixes in scap-security-guide-0.1.36-9.el7_5.noarch Following rules are failing after installation by design (as automated remediation would be either complex, or is not possible at all): xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata xccdf_org.ssgproject.content_rule_install_mcafee_antivirus xccdf_org.ssgproject.content_rule_bootloader_password xccdf_org.ssgproject.content_rule_set_firewalld_default_zone xccdf_org.ssgproject.content_rule_network_configure_name_resolution These rules has been fixed: xccdf_org.ssgproject.content_rule_partition_for_tmp xccdf_org.ssgproject.content_rule_partition_for_var xccdf_org.ssgproject.content_rule_partition_for_var_log_audit xccdf_org.ssgproject.content_rule_partition_for_home xccdf_org.ssgproject.content_rule_aide_scan_notification xccdf_org.ssgproject.content_rule_mount_option_home_nosuid xccdf_org.ssgproject.content_rule_sysctl_kernel_ipv6_disable xccdf_org.ssgproject.content_rule_network_ipv6_disable_rpc xccdf_org.ssgproject.content_rule_network_ipv6_privacy_extensions xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete xccdf_org.ssgproject.content_rule_ldap_client_start_tls xccdf_org.ssgproject.content_rule_ensure_logrotate_activated These are rules that are failing after installation, thus considered bugged: xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode * xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands xccdf_org.ssgproject.content_rule_audit_rules_login_events xccdf_org.ssgproject.content_rule_service_kdump_disabled * xccdf_org.ssgproject.content_rule_sssd_enable_pam_services xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll * xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled * these can be remedied after installation, just won't be hardened from the get go
Created attachment 1428736 [details] state of machine after selecting profile within anaconda
Created attachment 1428737 [details] state of machine after running remediation after boot
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1410