Include warning regarding quota options in XFS #9879

marcusburghardt · 2022-11-24T16:54:44Z

Description:

Copy of #9877 to master branch.

Rationale:

Fixes Error in quota related rules #9872

github-actions · 2022-11-24T16:55:33Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2022-11-24T16:59:28Z

This datastream diff is auto generated by the check Compare DS/Generate Diff.
Due to the excessive size of the diff, it has been trimmed to fit the 65535-character limit.

Click here to see the trimmed diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80927-7
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80927-7
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80927-7

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80929-3
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80929-3
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80929-3

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80928-5
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80928-5
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80928-5

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80959-0
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80959-0
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80959-0

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80960-8
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80960-8
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80960-8

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80961-6
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80961-6
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80961-6

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80930-1
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80930-1
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80930-1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80932-7
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80932-7
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80932-7

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80931-9
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80931-9
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80931-9

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80956-6
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80956-6
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80956-6

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80957-4
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80957-4
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80957-4

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
@@ -19,8 +19,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80958-2
 - NIST-800-53-AC-2(4)
@@ -156,8 +156,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80958-2
 - NIST-800-53-AC-2(4)
@@ -293,8 +293,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80958-2

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_immutable' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_immutable
+++ xccdf_org.ssgproject.content_rule_audit_rules_immutable
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Traverse all of:
 #

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_immutable' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_immutable
+++ xccdf_org.ssgproject.content_rule_audit_rules_immutable
@@ -23,8 +23,8 @@
 patterns: '*.rules'
 register: find_rules_d
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80708-1
 - CJIS-5.4.1.1
@@ -49,8 +49,8 @@
 loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
 }}'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80708-1
 - CJIS-5.4.1.1
@@ -77,8 +77,8 @@
 - /etc/audit/audit.rules
 - /etc/audit/rules.d/immutable.rules
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80708-1
 - CJIS-5.4.1.1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_mac_modification' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
+++ xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
 # Create a list of audit *.rules files that should be inspected for presence and correctness

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_mac_modification' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
+++ xccdf_org.ssgproject.content_rule_audit_rules_mac_modification
@@ -23,8 +23,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80721-4
 - CJIS-5.4.1.1
@@ -47,8 +47,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -71,8 +71,8 @@
 all_files:
 - /etc/audit/rules.d/MAC-policy.rules
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -95,8 +95,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -121,8 +121,8 @@
 create: true
 mode: '0640'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -147,8 +147,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80721-4
 - CJIS-5.4.1.1
@@ -172,8 +172,8 @@
 create: true
 mode: '0640'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -22,8 +22,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80722-2
 - CJIS-5.4.1.1
@@ -162,8 +162,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80722-2
 - CJIS-5.4.1.1
@@ -302,8 +302,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - audit_arch == "b64"
 tags:
 - CCE-80722-2

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
+++ xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
 # Retrieve hardware architecture of the underlying system

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
+++ xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
@@ -21,8 +21,8 @@
 set_fact:
 audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -162,8 +162,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -303,8 +303,8 @@
 state: present
 when: syscalls_found | length == 0
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - audit_arch == "b64"
 tags:
 - CCE-80723-0
@@ -329,8 +329,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -354,8 +354,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -380,8 +380,8 @@
 all_files:
 - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -405,8 +405,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -432,8 +432,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -459,8 +459,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -485,8 +485,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:
@@ -512,8 +512,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -537,8 +537,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -563,8 +563,8 @@
 all_files:
 - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -588,8 +588,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -615,8 +615,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -642,8 +642,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -668,8 +668,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:
@@ -695,8 +695,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -720,8 +720,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -746,8 +746,8 @@
 all_files:
 - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -771,8 +771,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -798,8 +798,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -825,8 +825,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -851,8 +851,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:
@@ -878,8 +878,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -903,8 +903,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -929,8 +929,8 @@
 all_files:
 - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -954,8 +954,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -981,8 +981,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -1008,8 +1008,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80723-0
 - CJIS-5.4.1.1
@@ -1034,8 +1034,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_session_events' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_session_events
+++ xccdf_org.ssgproject.content_rule_audit_rules_session_events
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
 # Create a list of audit *.rules files that should be inspected for presence and correctness

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_session_events' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_session_events
+++ xccdf_org.ssgproject.content_rule_audit_rules_session_events
@@ -23,8 +23,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -47,8 +47,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -71,8 +71,8 @@
 all_files:
 - /etc/audit/rules.d/session.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -95,8 +95,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -121,8 +121,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -147,8 +147,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -172,8 +172,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:
@@ -198,8 +198,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -222,8 +222,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -246,8 +246,8 @@
 all_files:
 - /etc/audit/rules.d/session.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -270,8 +270,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -296,8 +296,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -322,8 +322,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -347,8 +347,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:
@@ -373,8 +373,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -397,8 +397,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -421,8 +421,8 @@
 all_files:
 - /etc/audit/rules.d/session.rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -445,8 +445,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -471,8 +471,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -497,8 +497,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 tags:
 - CCE-80742-0
 - CJIS-5.4.1.1
@@ -522,8 +522,8 @@
 create: true
 mode: '0640'
 when:
- - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - '"audit" in ansible_facts.packages'
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
 # Create a list of audit *.rules files that should be inspected for presence and correctness

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers
@@ -18,8 +18,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-90175-1
 - DISA-STIG-RHEL-08-030171
@@ -37,8 +37,8 @@
 patterns: '*.rules'
 register: find_watch_key
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -56,8 +56,8 @@
 all_files:
 - /etc/audit/rules.d/actions.rules
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -75,8 +75,8 @@
 all_files:
 - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched
 is defined and find_existing_watch_rules_d.matched == 0
 tags:
@@ -96,8 +96,8 @@
 create: true
 mode: '0640'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
 == 0
 tags:
@@ -117,8 +117,8 @@
 patterns: audit.rules
 register: find_existing_watch_audit_rules
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-90175-1
 - DISA-STIG-RHEL-08-030171
@@ -137,8 +137,8 @@
 create: true
 mode: '0640'
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
 == 0
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q audit && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
 # Create a list of audit *.rules files that should be inspected for presence and correctness

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
@@ -18,8 +18,8 @@
 patterns: '*.rules'
 register: find_existing_watch_rules_d
 when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible_facts.packages'
- - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podma

... The diff is trimmed here ...

openshift-ci · 2022-11-24T17:24:06Z

@marcusburghardt: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-moderate	`39817e1`	link	true	`/test e2e-aws-rhcos4-moderate`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

codeclimate · 2022-11-24T17:29:04Z

Code Climate has analyzed commit 39817e1 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 47.2% (0.0% change).

View more on Code Climate.

jan-cerny

The automatus CI jobs fail is probably related to the container environment that is used in the jobs. This PR only introduces a warning text, that doesn't affect the actual check behavior.

Include warning regarding quota options in XFS

39817e1

marcusburghardt added the Update Rule Issues or pull requests related to Rules updates. label Nov 24, 2022

marcusburghardt added this to the 0.1.65 milestone Nov 24, 2022

marcusburghardt requested a review from jan-cerny November 24, 2022 16:54

jan-cerny self-assigned this Nov 25, 2022

jan-cerny approved these changes Nov 25, 2022

View reviewed changes

jan-cerny merged commit 40acec7 into ComplianceAsCode:master Nov 25, 2022

marcusburghardt deleted the issue_9872_quotas_master branch November 25, 2022 15:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Include warning regarding quota options in XFS #9879

Include warning regarding quota options in XFS #9879

marcusburghardt commented Nov 24, 2022

github-actions bot commented Nov 24, 2022

github-actions bot commented Nov 24, 2022

openshift-ci bot commented Nov 24, 2022

codeclimate bot commented Nov 24, 2022

jan-cerny left a comment

Include warning regarding quota options in XFS #9879

Include warning regarding quota options in XFS #9879

Conversation

marcusburghardt commented Nov 24, 2022

Description:

Rationale:

github-actions bot commented Nov 24, 2022

github-actions bot commented Nov 24, 2022

openshift-ci bot commented Nov 24, 2022

codeclimate bot commented Nov 24, 2022

jan-cerny left a comment

Choose a reason for hiding this comment