Specify platform specific packages for xwindows_remove_packages rule by teacup-on-rockingchair · Pull Request #12853 · ComplianceAsCode/content

teacup-on-rockingchair · 2025-01-19T11:06:17Z

Description:

Specify SLE12/SLE15 platform specific packages for xwindows_remove_packages rule

Rationale:

Define specific packages for xwindows_remove_packages rule
Drop xwindows_remove_packages from slmicro5 platform as irrelevant, as SLE MicroOS doesn't have xorg or xwayland packages by default
Fixes Review packages in xwindows_remove_packages rule #12394 for SLE context

github-actions · 2025-01-19T11:07:43Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2025-01-19T11:10:35Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages'.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -3,14 +3,15 @@
 Disable graphical user interface
 
 [description]:
-By removing the following packages,  the system no longer has X Windows installed.
-
-xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
+By removing the following packages, the system no longer has X Windows installed.
+ xorg-x11-server-Xorg
+        xorg-x11-server-common
+        xorg-x11-server-utils
+        xorg-x11-server-Xwayland
 
 If X Windows is not installed then the system cannot boot into graphical user mode.
 This prevents the system from being accidentally or maliciously booted into a graphical.target
 mode. To do so, run the following command:
-
 sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
 
 [warning]:
@@ -42,8 +43,8 @@
 SV-230553r1017315_rule
 
 [rationale]:
-Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
-vulnerabilities and should not be installed unless approved and documented.
+Unnecessary service packages must not be installed to decrease the attack surface of the system.
+X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
 
 [ident]:
 CCE-83411-9

OVAL for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- oval:ssg-xwindows_remove_packages:def:1
+++ oval:ssg-xwindows_remove_packages:def:1
@@ -1,5 +1,5 @@
 criteria AND
-criterion oval:ssg-package_xorg-x11-server-Xorg_removed:tst:1
-extend_definition oval:ssg-package_xorg-x11-server-common_removed:def:1
-criterion oval:ssg-package_xorg-x11-server-utils_removed:tst:1
-criterion oval:ssg-package_xorg-x11-server-Xwayland_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-Xorg_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-common_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-utils_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-Xwayland_removed:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1
+++ ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1
@@ -1,7 +1,8 @@
 To ensure the X Windows package group is removed, run the following command:
-
-$ rpm -qi xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
-
+$ rpm -qi xorg-x11-server-Xorg
+$ rpm -qi xorg-x11-server-common
+$ rpm -qi xorg-x11-server-utils
+$ rpm -qi xorg-x11-server-Xwayland
 For each package mentioned above you should receive following line:
 package <package> is not installed
       Is it the case that xorg related packages are not removed and run level is not correctly configured?

bash remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,14 +1,16 @@
-
 
 # remove packages
+
 if rpm -q --quiet "xorg-x11-server-Xorg" ; then
 yum remove -y "xorg-x11-server-Xorg"
 fi
+
+if rpm -q --quiet "xorg-x11-server-common" ; then
+yum remove -y "xorg-x11-server-common"
+fi
+
 if rpm -q --quiet "xorg-x11-server-utils" ; then
 yum remove -y "xorg-x11-server-utils"
-fi
-if rpm -q --quiet "xorg-x11-server-common" ; then
-yum remove -y "xorg-x11-server-common"
 fi
 
 if rpm -q --quiet "xorg-x11-server-Xwayland" ; then

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,10 +1,6 @@
-- name: Ensure xorg packages are removed
+- name: Disable graphical user interface - Ensure xorg-x11-server-Xorg is removed
   package:
-    name:
-    - xorg-x11-server-Xorg
-    - xorg-x11-server-common
-    - xorg-x11-server-utils
-    - xorg-x11-server-Xwayland
+    name: xorg-x11-server-Xorg
     state: absent
   tags:
   - CCE-83411-9
@@ -16,3 +12,48 @@
   - reboot_required
   - restrict_strategy
   - xwindows_remove_packages
+
+- name: Disable graphical user interface - Ensure xorg-x11-server-common is removed
+  package:
+    name: xorg-x11-server-common
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages
+
+- name: Disable graphical user interface - Ensure xorg-x11-server-utils is removed
+  package:
+    name: xorg-x11-server-utils
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages
+
+- name: Disable graphical user interface - Ensure xorg-x11-server-Xwayland is removed
+  package:
+    name: xorg-x11-server-Xwayland
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages

anaconda remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,2 +1,10 @@
 
-package --remove=xorg-x11-server-Xorg --remove=xorg-x11-server-common --remove=xorg-x11-server-utils --remove=xorg-x11-server-Xwayland
+# remove packages
+
+package --remove=xorg-x11-server-Xorg
+
+package --remove=xorg-x11-server-common
+
+package --remove=xorg-x11-server-utils
+
+package --remove=xorg-x11-server-Xwayland

jan-cerny

I think that this is a lot of code duplication. You should centralize the definition of the xwindows_packages to a single place. That will make it easier to change or extend in future. I suggest defining it as a product property.

Xeicker · 2025-02-04T16:29:41Z

@@ -1,24 +1,25 @@
+
+{{% if product in ["sle12", "sle15"] %}}
+{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}


Now that you made this variable at product level, this is not required

Thanks 🙇 should be handled in aeb38eb

Xeicker · 2025-02-04T16:31:16Z

@@ -0,0 +1,24 @@
+documentation_complete: true


I think this file is some remains of a different approach you were trying

Dropped in 24a75b4 🙇

Xeicker · 2025-02-04T16:32:20Z

@@ -1,27 +1,27 @@
-documentation_complete: true
+{{% if product in ["sle12", "sle15"] %}}
+{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}


Also this variable set is not needed

Thanks 🙇 should be handled in aeb38eb

jan-cerny · 2025-02-05T10:14:04Z


- name: Ensure xorg packages are removed
+{{% for package in xwindows_packages %}}
+- name: Ensure {{{ package }}} is removed


You need to add {{{ rule_title }}} - to the Ansible Task's name.

Done in 6878d53 🙇

jan-cerny · 2025-02-20T13:35:22Z

@jan-cerny Please check that the package names are correct for RHEL.

jan-cerny · 2025-02-27T08:00:14Z

+- xorg-x11-server-Xorg
+- xorg-x11-server-common
+- xorg-x11-server-utils
+- xorg-x11-server-Xwayland


I have verified that these packages exist in RHEL 9.5.0. 👍

jan-cerny · 2025-02-27T08:00:29Z

+xwindows_packages:
+- xorg-x11-server-Xorg
+- xorg-x11-server-common
+- xorg-x11-server-utils
+- xorg-x11-server-Xwayland


I have verified that these packages exist in RHEL 8.10.0. 👍

jan-cerny · 2025-02-27T08:03:18Z

-    <tt>xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</tt>
-    {{% endif %}}
+    By removing the following packages, the system no longer has X Windows installed.
+    <tt>{{{ xwindows_packages }}}</tt>


This needs to be improved because the generated output contains quotes and brackets

['xorg-x11-server-Xorg', 'xorg-x11-server-common', 'xorg-x11-server-utils', 'xorg-x11-server-Xwayland']

It should be rendered as some sort of a bullet list or comma separated list instead.

jan-cerny · 2025-02-27T08:04:52Z

-    {{% else %}}
-    <pre>sudo {{{ pkg_manager }}} remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland</pre>
-    {{% endif %}}
+    <pre>sudo {{{ pkg_manager }}} remove {{{ xwindows_packages }}}</pre>


This needs to be improved because the generated command is invalid command because it contains brackets and also quotes:

sudo dnf remove ['xorg-x11-server-Xorg', 'xorg-x11-server-common', 'xorg-x11-server-utils', 'xorg-x11-server-Xwayland']

I expect:

sudo dnf remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland

Should be handled in aee3ac6 👍

jan-cerny · 2025-02-27T08:05:31Z

-    {{% else %}}
-    {{{ package_remove("xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland") }}}
-    {{% endif %}}
+    {{{ package_remove(xwindows_packages) }}}


OCIL and fixtext are affected as well

Should be handled in aee3ac6 👍

We don't have xorg or xwayland packages in the default repos there anyways

…s_remove_packages rule

@jan-cerny

Thanks to @jan-cerny for the hint 🙇

@jan-cerny

Thanks for the feedback to @jan-cerny

qlty-cloud-legacy · 2025-03-02T12:06:09Z

Code Climate has analyzed commit b2632c4 and detected 1 issue on this pull request.

Here's the issue category breakdown:

Category	Count
Style	1

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.1% (0.1% change).

View more on Code Climate.

jan-cerny

I have reviewed the generated rule.yml and I have reviewed the product files.

teacup-on-rockingchair added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. Update Rule Issues or pull requests related to Rules updates. labels Jan 19, 2025

teacup-on-rockingchair added this to the 0.1.76 milestone Jan 20, 2025

jan-cerny requested changes Jan 20, 2025

View reviewed changes

jan-cerny self-assigned this Jan 20, 2025

teacup-on-rockingchair force-pushed the fix_xwindows_remove_pakcakage_sle branch from ba29a71 to 73fe970 Compare February 4, 2025 14:04

teacup-on-rockingchair requested review from a team as code owners February 4, 2025 14:04

vojtapolasek modified the milestones: 0.1.76, 0.1.77 Feb 4, 2025

Xeicker suggested changes Feb 4, 2025

View reviewed changes

jan-cerny reviewed Feb 5, 2025

View reviewed changes

jan-cerny requested changes Feb 27, 2025

View reviewed changes

teacup-on-rockingchair added 9 commits March 2, 2025 13:31

Specify platform specific packages for xwindows_packages rule

3809bba

Drop xwindows_remove_packages from slmicro5 platform as irrelevant

5a5a741

We don't have xorg or xwayland packages in the default repos there anyways

Create variable with default xwindows packages in relation to xwindow…

3594ce1

…s_remove_packages rule

Add per products ol7,sle12 and sle15 definition for xwindows_packages

01a87c1

Drop code duplication in favour of product variable

b00bb34

Thanks to @jan-cerny for the hint 🙇

Update products stability data

ed0e564

Drop file added by mistake

5657771

Use rule name in ansible remediation task

0efae6b

Drop xwindows_packages var in file in favour of product setting

b37b415

teacup-on-rockingchair added 2 commits March 2, 2025 13:31

Display list of xwindow packages in better formatting

e89c261

Thanks for the feedback to @jan-cerny

Update products stability data for rhel10 after rebase

b2632c4

teacup-on-rockingchair force-pushed the fix_xwindows_remove_pakcakage_sle branch from aee3ac6 to b2632c4 Compare March 2, 2025 11:34

jan-cerny approved these changes Mar 3, 2025

View reviewed changes

jan-cerny merged commit de2ee92 into ComplianceAsCode:master Mar 3, 2025

		@@ -1,24 +1,25 @@

		{{% if product in ["sle12", "sle15"] %}}
		{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}

Conversation

teacup-on-rockingchair commented Jan 19, 2025

Description:

Rationale:

Uh oh!

github-actions Bot commented Jan 19, 2025

Uh oh!

github-actions Bot commented Jan 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jan-cerny commented Feb 20, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qlty-cloud-legacy Bot commented Mar 2, 2025

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Jan 19, 2025 •

edited

Loading