Bug 2101353

Description of problem:

Customer is showing this commands in the nodes:

sh-4.4# chroot /host
sh-4.4# grep -r '^\s*kernel.core_pattern\s*=' /etc/sysctl.conf /etc/sysctl.d
/etc/sysctl.d/75-sysctl_kernel_core_pattern.conf:kernel.core_pattern = |/bin/false
sh-4.4# cat /etc/sysctl.d/75-sysctl_kernel_yama_ptrace_scope.conf 
kernel.yama.ptrace_scope=1

These rules are failing:


Title^M Disable storing core dumps
Rule^M  xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern
Ident^M CCE-82527-3
W: oscap:       Requested offline mode is not supported by sysctl probe.
Result^M        fail

Title^M Restrict usage of ptrace to descendant processes
Rule^M  xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope
Ident^M CCE-82501-8
W: oscap:       Requested offline mode is not supported by sysctl probe.
Result^M        fail


When we check the rules:

oc get -n openshift-compliance -oyaml rules.compliance rhcos4-sysctl-kernel-core-pattern
description: |-
  To set the runtime status of the kernel.core_pattern kernel parameter, run the following command:

  $ sudo sysctl -w kernel.core_pattern=|/bin/false

  To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d :

  kernel.core_pattern = |/bin/false

  If any assignments other than
  kernel.core_pattern = |/bin/false
  are found, or the correct assignment is duplicated, remove those offending lines from respective files,
  and make sure that exactly one file in
  /etc/sysctl.d contains kernel.core_pattern = |/bin/false, and that one assignment
  is returned when
  $ grep -r kernel.core_pattern /etc/sysctl.conf /etc/sysctl.d
  is executed.

 oc get -n openshift-compliance -oyaml rules.compliance rhcos4-sysctl-kernel-yama-ptrace-scope

description: |-
  To set the runtime status of the kernel.yama.ptrace_scope kernel parameter, run the following command:

  $ sudo sysctl -w kernel.yama.ptrace_scope=1

  To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d :

  kernel.yama.ptrace_scope = 1

So, it seems the rules are failing where at customer site we have the right lines/values.