Move RPM verify rules to use --restore

[Mab879]

Description:

• Move RPM verify rules to use --restore

Rationale:

Update for RHEL 10

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_ownership'.
--- xccdf_org.ssgproject.content_rule_rpm_verify_ownership
+++ xccdf_org.ssgproject.content_rule_rpm_verify_ownership
@@ -11,7 +11,7 @@
 $ rpm -qf FILENAME
           
 Next, run the following command to reset its permissions to the correct values:
-$ sudo rpm --setugids PACKAGENAME
+$ sudo rpm --restore PACKAGENAME
 
 [warning]:
 Profiles may require that specific files be owned by root while the default owner defined

bash remediation for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_ownership' differs.
--- xccdf_org.ssgproject.content_rule_rpm_verify_ownership
+++ xccdf_org.ssgproject.content_rule_rpm_verify_ownership
@@ -17,5 +17,5 @@
 # correct values
 for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
 do
-        rpm --setugids "${RPM_PACKAGE}"
+        rpm --restore "${RPM_PACKAGE}"
 done

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_ownership' differs.
--- xccdf_org.ssgproject.content_rule_rpm_verify_ownership
+++ xccdf_org.ssgproject.content_rule_rpm_verify_ownership
@@ -55,7 +55,7 @@
   - rpm_verify_ownership
 
 - name: Correct file ownership with RPM
-  command: rpm --setugids '{{ item }}'
+  command: rpm --restore '{{ item }}'
   with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
     | unique }}'
   when: (files_with_incorrect_ownership.stdout_lines | length > 0)

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_permissions'.
--- xccdf_org.ssgproject.content_rule_rpm_verify_permissions
+++ xccdf_org.ssgproject.content_rule_rpm_verify_permissions
@@ -16,7 +16,7 @@
           
           
 Next, run the following command to reset its permissions to the correct values:
-$ sudo rpm --setperms PACKAGENAME
+$ sudo rpm --restore PACKAGENAME
 
 [warning]:
 Profiles may require that specific files have stricter file permissions than defined by

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_permissions' differs.
--- xccdf_org.ssgproject.content_rule_rpm_verify_permissions
+++ xccdf_org.ssgproject.content_rule_rpm_verify_permissions
@@ -57,7 +57,7 @@
   - rpm_verify_permissions
 
 - name: Correct file permissions with RPM
-  command: rpm --setperms '{{ item }}'
+  command: rpm --restore '{{ item }}'
   with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
     | unique }}'
   when: (files_with_incorrect_permissions.stdout_lines | length > 0)

[Mab879]

/retest-required

[jan-cerny]

I think the same change needs do be done in Ansible code.

[jan-cerny]

I think in rpm_verify_permissions you need to update also the Bash and Ansible remediations.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12413
This image was built from commit: 06fbf18

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12413

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12413 make deploy-local

[codeclimate]

Code Climate has analyzed commit 06fbf18 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

[jan-cerny]

/packit build