Bug 2092809

Description of problem:

The grub2_disable_interactive_boot rule in the OSPP profile checks for

   systemd.confirm_spawn not being set
   GRUB_DISABLE_RECOVERY being set

We'd like the check for systemd.confirm_spawn to be removed from the OSPP profile. While booting the system with some services not started can affect security functionality of the system, such system can hardly be considered matching the Target of Evaluation. The admin has to get system into such state knowingly, it's very hard to change the kernel command-line parameters either persistently or via grub's interactive menu by accident.

Therefore, we'd like to remove such check from the OSPP profile.

The rule however has second part which checks that GRUB_DISABLE_RECOVERY is set. We'd like that check to stay in the OSPP profile, so the easiest way forward is likely an additional SCAP rule which would be added to the OSPP profile, with the same ospp reference FIA_UAU.1.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.60-6.el9_0.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Actual results:

Rule xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot is listed.

No rule specific to GRUB_DISABLE_RECOVERY listed.

Expected results:

Rule xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot not listed.

New rule about GRUB_DISABLE_RECOVERY listed.

Additional info:

While looking at the grub2_disable_interactive_boot rule, I've noticed that both linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml and the OVAL checks focus on

  systemd.confirm_spawn=(1|yes|true|on)

However, https://www.freedesktop.org/software/systemd/man/systemd.html#systemd.confirm_spawn says

  Can be also specified without an argument, with the same effect as a positive boolean.

which means that the check and regexps should also look at parameter-less variants.

I've also noticed that shared/checks/oval/bootloader_disable_recovery_set_to_true.xml has a regexp

  ^true|"true"$

which likely is not what is desired -- it should be either (something like)

  ^(true|"true")$

or just plain 

  true|"true"

to cater to situatiosn when there might be an extra space somewhere.