Description of problem:

When I remediate using an Anaconda addon (might be unrelated) with the RHEL-8.4 version of SSG, ospp profile, I see this when I boot into the installed system:

Jun 25 08:19:32 ospp systemd[1]: File /usr/lib/systemd/system/usbguard.service:11 configures an IP firewall (IPAddressDeny=any), but the local system does not support BPF/cgroup based firewalling.

Jun 25 08:19:32 ospp systemd[1]: Proceeding WITHOUT firewalling in effect! (This warning is only shown for the first loaded unit using IP firewalling.)

That's systemd (second message) saying it didn't detect any firewall running and thus it ignored (first message) usbguard's request to have a specific socket firewalled.

Firewalld is however running and has loaded a ruleset, as can be seen from "nft list ruleset":


        chain filter_IN_public_allow {
                tcp dport 22 ct state { new, untracked } accept
                ip6 daddr fe80::/64 udp dport 546 ct state { new, untracked } accept

                tcp dport 9090 ct state { new, untracked } accept
        }

It would seem that something in the profile is breaking systemd's ability to detect an active firewall.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.54-5.el8.noarch


Steps to Reproduce:
1. journalctl -b | grep firewall