Enforce explicit setting in system-auth#11740
Conversation
The rule passes if the `rounds` option isn't set but the profile uses a value that equals to system default value. This will no longer be possible. We will always require `rounds` to be set explicitly. The reason is to align the rule with DISA STIG. The commit also updates the test scenarios to fail if the `rounds` isn't set and system default is used. Fixes: ComplianceAsCode#11697
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1
+++ oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1
@@ -1,5 +1,2 @@
criteria OR
criterion oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1
-criteria AND
-criterion oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1
-criterion oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1 |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
|
Code Climate has analyzed commit 8c77155 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.3% (0.0% change). View more on Code Climate. |
The rule passes if the
roundsoption isn't set but the profile uses a value that equals to system default value. This will no longer be possible. We will always requireroundsto be set explicitly. The reason is to align the rule with DISA STIG.The commit also updates the test scenarios to fail if the
roundsisn't set and system default is used.Fixes: #11697