Update ANSSI BP28 profiles in rhel10 product

[vojtapolasek]

Description:

• revise list of excluded rules; remove some exclusions and add comments
• make some modifications to the content (I can propose them as separate PR if needed). The reason is so that the content can be tested without much noise.
  • remove dedicated ssh group owning private ssh keys because RHEL 10 no longer uses it
  • the aide.conf directive for database location has changed, I changed it in the content as well

Rationale:

• add content to rhel10 product

Review Hints:

./build_product rhel10
cd tests
./ds_unselect_rules.sh  ../build/ssg-rhel10-ds.xml  unselect_rules_list 
python automatus.py profile --libvirt <your_qemu_conection> <your_vm_name> --datastream /tmp/ssg-rhel10-ds.xml anssi_bp28_high

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[vojtapolasek]

@Mab879 @marcusburghardt as you worked with some profile in rhel10 product recently... could you voice your opinion on rules which I made no longer excluded from the ANSSI profile? It was not clear to me why they were actually excluded. Thank you.

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12351
This image was built from commit: ebb1265

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12351

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12351 make deploy-local

[vojtapolasek]

Hello @Mab879 and thank you. Issues you highlighted were caused by copying over files from RHEL 9. I fixed that.

[marcusburghardt]

RHEL10 is using yescrypt by default instead of SHA512. Could you update the variables, please?

[marcusburghardt]

@Mab879 @marcusburghardt as you worked with some profile in rhel10 product recently... could you voice your opinion on rules which I made no longer excluded from the ANSSI profile? It was not clear to me why they were actually excluded. Thank you.

It was also not clear to me the reason some the rules were excluded. But your updates make sense to me. You only need to ensure these rules have CCEs for RHEL 10.

[marcusburghardt]

@Mab879 @marcusburghardt as you worked with some profile in rhel10 product recently... could you voice your opinion on rules which I made no longer excluded from the ANSSI profile? It was not clear to me why they were actually excluded. Thank you.

It was also not clear to me the reason some the rules were excluded. But your updates make sense to me. You only need to ensure these rules have CCEs for RHEL 10.

@vojtapolasek the CCEs errors are still present.

[vojtapolasek]

@marcusburghardt I added missing CCEs.Hello @Mab879 and thank you. Issues you highlighted were caused by copying over files from RHEL 9. I fixed that.

[marcusburghardt]

My local tests worked fine testing the profile and remediating with Ansible. However, when remediating with Bash the automatus test finishes with error. I isolated the problem and it is related to the service_sssd_enabled rule. I saw some issues with this rule and intend to fix them soon. But for now, could you also remove this rule from the RHEL 10 Draft profiles, please?

[marcusburghardt]

service_sssd_enabled

@vojtapolasek , I would recommend to remove the following rules from RHEL 10 profiles for now so we can merge this PR:

• sssd_enable_pam_services
• sssd_ldap_configure_tls_reqcert
• sssd_ldap_start_tls

I am working on these rules in #12378 but it will still take some time to organize all these SSSD related rules.

[codeclimate]

Code Climate has analyzed commit ebb1265 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

[marcusburghardt]

Nice work @vojtapolasek . Thanks