Move ISM O references to the control file #13922
Conversation
Mab879
added
RHEL
|
/retest-required |
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
5c65aa9 to
61a6dcd
Compare
|
/packit build |
There was a problem hiding this comment.
I can find some rules in the built datastream that still don't have the ISM_O reference but are part of the ISM_O profile. For example, in RHEL 8 data stream, rules accounts_password_all_shadowed, usbguard_allow_hid_and_hub and sshd_allow_only_protocol2 don't have the ISM_O reference. These are rules that aren't selected in control file but are added in the profile file for RHEL 8 ISM profile. We have seen this problem before. We solved it by adding the rules to control files instead of profile files. The we added a deselection of the rules in profile files of products where these rules shouldn't be present. Please resolve missing references in these rules and verify that a similar situation doesn't happen also in other products.
The CI fails can be caused by recent changes in our fmf files. Try to rebase the PR on the top of the latest upstream master branch.
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
61a6dcd to
8423f90
Compare
|
@Mab879 you can also remove the explicit additions of the 3 rules in products/rhel9/profiles/ism_o.profile because they are now coming from the control file |
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
8423f90 to
07d18a2
Compare
| - "!package_subscription-manager_installed" | ||
| - '!accounts_password_all_shadowed' | ||
| - '!usbguard_allow_hid_and_hub' | ||
| - '!sshd_allow_only_protocol2' |
There was a problem hiding this comment.
These three rules above should also be removed from ol10 ism_o_secret and ism_o_top_secret profiles
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
07d18a2 to
f40cc6a
Compare
|
@Mab879 conflicts |
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
f40cc6a to
4f1e85a
Compare
|
@Xeicker Can you please check this one again and approve or request changes? |
|
@Mab879 please rebase on the latest upstream master branch, the error should now be fixed in master |
Mab879
force-pushed
the
fix_ism_o_refs
branch
from
b9d3014 to
184b908
Compare
|
@Mab879: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Description:
Move ISM O references to the control file
Rationale:
Fixes #12423
Fixes #12427
Fixes #12430