Update grub2_mitigation_argument texts

This is to reflect actual behavior, and align with other similar rules in this project Signed-off-by: Edgar Aguilar <[email protected]>
ComplianceAsCode · Nov 23, 2023 · f903954 · f903954
1 parent 66e81d0
commit f903954
Showing 1 changed file with 6 additions and 21 deletions.
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_mitigation_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_mitigation_argument/rule.yml
@@ -5,13 +5,8 @@ prodtype: ol8
 title: 'System Must Avoid Meltdown and Spectre Exploit Vulnerabilities in Modern Processors'
 
 description: |-
-    Determine the default kernel:
-    <pre>$ sudo grubby --default-kernel
-
-    /boot/vmlinuz-5.4.17-2011.1.2.el8uek.x86_64</pre>
-
-    Using the default kernel, verify that Meltdown mitigations are not disabled:
-    <pre>$ sudo grubby --info=<i>path-to-default-kernel</i> | grep mitigations</pre>
+    Verify that Meltdown mitigations are not disabled:
+    <pre>$ sudo grubby --info=ALL | grep mitigations</pre>
 
     The mitigations must not be set to "off".
 
@@ -35,25 +30,15 @@ platform: grub2
 ocil_clause: 'mitigations is set to off'
 
 ocil: |-
-    Make sure that the kernel is not disabling mitigations with the following
-    commands.
-    <pre>$ sudo grubby --default-kernel</pre>
-    <pre>/boot/vmlinuz-5.4.17-2011.1.2.el8uek.x86_64</pre>
-
-    Using the default kernel, verify that Meltdown mitigations are not disabled:
+    Verify that Meltdown mitigations are not disabled in any kernel:
 
-    <pre>$ sudo grubby --info={path-to-default-kernel} | grep mitigations</pre>
+    <pre>$ sudo grubby --info=ALL | grep mitigations</pre>
 
 
 fixtext: |-
-    Determine the default kernel:
-
-    <pre>$ sudo grubby --default-kernel
-    /boot/vmlinuz-5.4.17-2011.1.2.el8uek.x86_64</pre>
-
-    Using the default kernel, remove the Meltdown mitigations:
+    Remove the Meltdown mitigations:
 
-    <pre>$ sudo grubby --update-kernel=<path-to-default-kernel> --remove-args=mitigations=off</pre>
+    <pre>$ sudo grubby --update-kernel=ALL --remove-args=mitigations=off</pre>
 
     Reboot the system for the change to take effect.