Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Review profile for consistency between similar checks #41

Open
wdower opened this issue May 15, 2024 · 2 comments
Open

Review profile for consistency between similar checks #41

wdower opened this issue May 15, 2024 · 2 comments
Assignees

Comments

@wdower
Copy link
Contributor

wdower commented May 15, 2024

It has been quite some time since the entire RHEL codebase has been reviewed to ensure that tests with similar focuses (like all tests for audit rules, or all tests for kernel settings), many of which are written by different authors, are consistent in their approach. We need to take a read-through of each control to ensure that similar controls have similar test code, and ensure that the common approach covers all edge cases.

@wdower wdower self-assigned this May 15, 2024
@wdower
Copy link
Contributor Author

wdower commented May 17, 2024

TODO:

  • make profile consistent re: using the word 'permissions' vs 'mode'
  • input names -- 'exempt' vs 'exemptions' in input names
  • loads of inputs are still commented with the RHEL8 control ID they align to and not the current one
  • be consistent about using .reject and .select to filter for failing items
  • examine 257926 to see if we can get a performance increase by using find instead of just stat-ing the directory
  • make sure any ini resource call that wraps a command or a json can catch the case where the command doesn't exist (see 257949)

@kemley76
Copy link
Contributor

I created this PR (#47) without making any changes to address either the 4th or last items here. It seems to me that it would be more readable to allow either .reject or .select just for readability's sake rather than requiring an unnecessary negation. Also, there seems to be a lot of instances where both are used.
Also, with regards to the last item, I could only find a few instances where the ini resource is used, but they either didn't depend on any commands or just used cat, which I don't think should require an explicit check for if it is installed (even if cat doesn't exist, it seems like the test will fail and not give a false positive).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants