Updates for Debian 12.6

[a-skr]

Description:

• update to Debian 12.6
• port to Debian the last few rules that were added to anssi bp28 guide.

[openshift-ci]

Hi @a-skr. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_aide_verify_acls'.
--- xccdf_org.ssgproject.content_rule_aide_verify_acls
+++ xccdf_org.ssgproject.content_rule_aide_verify_acls
@@ -10,6 +10,7 @@
 FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
 AIDE rules can be configured in multiple ways; this is merely one example that is already
 configured by default.
+
 
 The remediation provided with this rule adds acl to all rule sets available in
 /etc/aide.conf

bash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_verify_acls' differs.
--- xccdf_org.ssgproject.content_rule_aide_verify_acls
+++ xccdf_org.ssgproject.content_rule_aide_verify_acls
@@ -7,7 +7,9 @@
 
 aide_conf="/etc/aide.conf"
 
+
 groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u)
+
 
 for group in $groups
 do

New content has different text for rule 'xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes'.
--- xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
+++ xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
@@ -10,6 +10,7 @@
 FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
 AIDE rules can be configured in multiple ways; this is merely one example that is already
 configured by default.
+
 
 The remediation provided with this rule adds xattrs to all rule sets available in
 /etc/aide.conf

bash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes' differs.
--- xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
+++ xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes
@@ -7,7 +7,9 @@
 
 aide_conf="/etc/aide.conf"
 
+
 groups=$(LC_ALL=C grep "^[A-Z][A-Za-z_]*" $aide_conf | grep -v "^ALLXTRAHASHES" | cut -f1 -d '=' | tr -d ' ' | sort -u)
+
 
 for group in $groups
 do

New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled'.
--- xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled
+++ xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled
@@ -7,6 +7,7 @@
 chronyd service:
 $ sudo systemctl is-active chronyd
 If the service is running, it should return the following: active
+
 Note: The chronyd daemon is enabled by default.
 
        

OCIL for rule 'xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled' differs.
--- ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1
+++ ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1
@@ -1,3 +1,4 @@
+
 
 
 Run the following command to determine the current status of the
@@ -6,6 +7,7 @@
 If the service is running, it should return the following: active
 
 
+
 Run the following command to determine the current status of the
 ntpd service:
 $ sudo systemctl is-active ntpd

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12432
This image was built from commit: fffcc69

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12432

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12432 make deploy-local

[codeclimate]

Code Climate has analyzed commit fffcc69 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

[Mab879]

Thanks!

[Mab879]

Waving UBI8 tests as they pass locally.