Description of problem: When doing a scap remediation with the CIS L2 server profile, the two rules "Ensure journald is configured to compress large log files" and "Ensure journald is configured to write log files to persistent disk" set up the following 2 entries in /etc/systemd/journald.conf: Storage='persistent' Compress='yes' logs show ... systemd-journald[767]:/etc/systemd/journald.conf:18:Failed to parse storage setting, ignoring: 'persistent' ... systemd-journald[767]:/etc/systemd/journald.conf:20:Failed to parse Compress= value, ignoring: 'yes' journals are not stored persistently. Version-Release number of selected component (if applicable): RHEL9.1 How reproducible: always Steps to Reproduce: 1. run a oscap xccdf eval --remediate with CIS L2 server profile when the mentioned settings are not already configured Actual results: /etc/systemd/journald.conf contains Storage='persistent' Compress='yes' and journals are not stored persistently. Expected results: /etc/systemd/journald.conf contains Storage=persistent Compress=yes and journals are stored persistently.
analysis: Problem is present also in current upstream as of 2023-05-05 as of head 68e93c73061f4abdcbdc1f870d1b608d23239b9b. The problem is excess quotes in OVAL, Bash and Ansible in rules journald_storage and journald_compress. This BZ is related to https://bugzilla.redhat.com/show_bug.cgi?id=2169857 which is the same problem but only in rule journald_storage and is for RHEL 9. A possible fix can be to set "no_quotes: true" in the rule.yml in rules journald_storage and journald_compress. We need to examine all other similar rules that configure journald and/or use the shell_lineinfile template. Switching from openscap to correct component.
There exists an already merged PR https://github.com/ComplianceAsCode/content/pull/10790 which implements the proposed solution. A test for rule journald_storage has been submitted to upstream for a review in https://github.com/ComplianceAsCode/content/pull/10817. A test for rule journald_compress has been submitted to upstream for a review in https://github.com/ComplianceAsCode/content/pull/10818.
PRs https://github.com/ComplianceAsCode/content/pull/10790, https://github.com/ComplianceAsCode/content/pull/10817, and https://github.com/ComplianceAsCode/content/pull/10818 have been merged upstream.