Switch to _guard_var templates for timesync rules on Ubuntu 24.04

[mpurg]

Description:

• Modify timesync package/service install/enable rules to use _guard_var templates on Ubuntu 24.04
• Introduce variable var_timesync_service
• Adapt Ubuntu 24.04 CIS controls

Rationale:

• _guard_var templates allow the user to select the desired timesync service via an XCCDF variable instead of having to enable/disable the actual rules (analogous to Switch to _guard_var templates for firewall rules on Ubuntu 24.04 #12902)

[openshift-ci]

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codeclimate]

Code Climate has analyzed commit 13f6dbc and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

[mpurg]

All automatus tests (except missing rule package_timesyncd_removed) pass locally in KVM:

INFO - xccdf_org.ssgproject.content_rule_service_chronyd_disabled                                                              
INFO - Script service_enabled-var_not_value.fail.sh using profile (all) OK                                               
INFO - Script service_enabled-var_is_value.pass.sh using profile (all) OK                                                
INFO - Script service_disabled.pass.sh using profile (all) OK                                                            

INFO - xccdf_org.ssgproject.content_rule_service_chronyd_enabled                                                         
INFO - Script service_disabled-var_not_value.pass.sh using profile (all) OK                                              
INFO - Script service_disabled.fail.sh using profile (all) OK                                                            
INFO - Script service_enabled.pass.sh using profile (all) OK                                                             

INFO - xccdf_org.ssgproject.content_rule_service_timesyncd_disabled                                                      
INFO - Script service_enabled-var_is_value.pass.sh using profile (all) OK                                                
INFO - Script service_enabled-var_not_value.fail.sh using profile (all) OK                                               
INFO - Script service_disabled.pass.sh using profile (all) OK                                                            

INFO - xccdf_org.ssgproject.content_rule_service_timesyncd_enabled                                                       
INFO - Script service_disabled.fail.sh using profile (all) OK                                
INFO - Script service_disabled-var_not_value.pass.sh using profile (all) OK                                              
INFO - Script service_enabled.pass.sh using profile (all) OK                                                             

INFO - xccdf_org.ssgproject.content_rule_package_chrony_installed                                                        
INFO - Script package-removed-wrong-var.pass.sh using profile (all) OK                                             
INFO - Script package-installed.pass.sh using profile (all) OK                                                                 
INFO - Script package-installed-removed.fail.sh using profile (all) OK                                                   
INFO - Script package-removed.fail.sh using profile (all) OK                                                             

INFO - xccdf_org.ssgproject.content_rule_package_timesyncd_installed                                                     
INFO - Script package-installed-removed.fail.sh using profile (all) OK                                                   
INFO - Script package-removed.fail.sh using profile (all) OK                                                             
INFO - Script package-installed.pass.sh using profile (all) OK                                                                 
INFO - Script package-removed-wrong-var.pass.sh using profile (all) OK                                                   

WARNING - Rule 'xccdf_org.ssgproject.content_rule_package_timesyncd_removed' isn't present in benchmark 'xccdf_org.ssgproject.content_benchmark_UBUNTU_24-04' in '/tmp/ssgts-ds-pfmf_qqb'
ERROR - No tests found matching the rule ID(s) 'package_timesyncd_removed'                                               
WARNING - Nothing has been tested!                          

[dodys]

lgtm, thanks!