rootfiles_configured: populate /usr/share/rootfiles/ in remediation

[ggbecker]

Description:

• On RHEL 9.0/9.1 the rootfiles package installs dotfiles directly into /root/ and does not create /usr/share/rootfiles/. The remediation was writing a tmpfiles.d conf with C copy entries sourcing from that directory. When the destination files were absent at boot, systemd-tmpfiles failed with "No such file or directory" because the source path did not exist.

• Fix the Bash and Ansible remediations to create /usr/share/rootfiles/ and copy each dotfile from /root/ to that directory if not already present, so the tmpfiles.d source is always valid. On RHEL 9.2+ where rootfiles already provides /usr/share/rootfiles/, these steps are no-ops.

Rationale:

• Fixes Systemd-tmpfiles errors on RHEL 9 boot #14582

• This is a Claude suggestion to fix the issue, let's run the tests and see if the error is fixed.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_rootfiles_configured' differs.
--- xccdf_org.ssgproject.content_rule_rootfiles_configured
+++ xccdf_org.ssgproject.content_rule_rootfiles_configured
@@ -1,7 +1,13 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q rootfiles; then
 
-find "/etc/tmpfiles.d/" -name "*.conf" -print0 | xargs -0 sed -i  "/C[[:space:]]*\/root\/.bash_logout/d"
+mkdir -p /usr/share/rootfiles
+    [ -f "/root/.bash_logout" ] && [ ! -f "/usr/share/rootfiles/.bash_logout" ] && cp "/root/.bash_logout" "/usr/share/rootfiles/.bash_logout"
+    [ -f "/root/.bash_profile" ] && [ ! -f "/usr/share/rootfiles/.bash_profile" ] && cp "/root/.bash_profile" "/usr/share/rootfiles/.bash_profile"
+    [ -f "/root/.bashrc" ] && [ ! -f "/usr/share/rootfiles/.bashrc" ] && cp "/root/.bashrc" "/usr/share/rootfiles/.bashrc"
+    [ -f "/root/.cshrc" ] && [ ! -f "/usr/share/rootfiles/.cshrc" ] && cp "/root/.cshrc" "/usr/share/rootfiles/.cshrc"
+    [ -f "/root/.tcshrc" ] && [ ! -f "/usr/share/rootfiles/.tcshrc" ] && cp "/root/.tcshrc" "/usr/share/rootfiles/.tcshrc"
+    find "/etc/tmpfiles.d/" -name "*.conf" -print0 | xargs -0 sed -i  "/C[[:space:]]*\/root\/.bash_logout/d"
     find "/etc/tmpfiles.d/" -name "*.conf" -print0 | xargs -0 sed -i  "/C[[:space:]]*\/root\/.bash_profile/d"
     find "/etc/tmpfiles.d/" -name "*.conf" -print0 | xargs -0 sed -i  "/C[[:space:]]*\/root\/.bashrc/d"
     find "/etc/tmpfiles.d/" -name "*.conf" -print0 | xargs -0 sed -i  "/C[[:space:]]*\/root\/.cshrc/d"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rootfiles_configured' differs.
--- xccdf_org.ssgproject.content_rule_rootfiles_configured
+++ xccdf_org.ssgproject.content_rule_rootfiles_configured
@@ -1,6 +1,54 @@
 - name: Gather the package facts
   package_facts:
     manager: auto
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Ensure source directory
+    exists
+  ansible.builtin.file:
+    path: /usr/share/rootfiles
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Stat /root/.bash_logout
+  ansible.builtin.stat:
+    path: /root/.bash_logout
+  register: rootfiles_configured_bash_logout_root_stat
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Copy /root/.bash_logout
+    to /usr/share/rootfiles/.bash_logout if missing
+  ansible.builtin.copy:
+    src: /root/.bash_logout
+    dest: /usr/share/rootfiles/.bash_logout
+    remote_src: true
+    force: false
+  when:
+  - '"rootfiles" in ansible_facts.packages'
+  - rootfiles_configured_bash_logout_root_stat.stat.exists
   tags:
   - configure_strategy
   - low_complexity
@@ -55,6 +103,37 @@
   - no_reboot_needed
   - rootfiles_configured
 
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Stat /root/.bash_profile
+  ansible.builtin.stat:
+    path: /root/.bash_profile
+  register: rootfiles_configured_bash_profile_root_stat
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Copy /root/.bash_profile
+    to /usr/share/rootfiles/.bash_profile if missing
+  ansible.builtin.copy:
+    src: /root/.bash_profile
+    dest: /usr/share/rootfiles/.bash_profile
+    remote_src: true
+    force: false
+  when:
+  - '"rootfiles" in ansible_facts.packages'
+  - rootfiles_configured_bash_profile_root_stat.stat.exists
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
 - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration files
   ansible.builtin.find:
     paths: /etc/tmpfiles.d/
@@ -101,6 +180,37 @@
   - no_reboot_needed
   - rootfiles_configured
 
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Stat /root/.bashrc
+  ansible.builtin.stat:
+    path: /root/.bashrc
+  register: rootfiles_configured_bashrc_root_stat
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Copy /root/.bashrc to
+    /usr/share/rootfiles/.bashrc if missing
+  ansible.builtin.copy:
+    src: /root/.bashrc
+    dest: /usr/share/rootfiles/.bashrc
+    remote_src: true
+    force: false
+  when:
+  - '"rootfiles" in ansible_facts.packages'
+  - rootfiles_configured_bashrc_root_stat.stat.exists
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
 - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration files
   ansible.builtin.find:
     paths: /etc/tmpfiles.d/
@@ -147,6 +257,37 @@
   - no_reboot_needed
   - rootfiles_configured
 
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Stat /root/.cshrc
+  ansible.builtin.stat:
+    path: /root/.cshrc
+  register: rootfiles_configured_cshrc_root_stat
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Copy /root/.cshrc to
+    /usr/share/rootfiles/.cshrc if missing
+  ansible.builtin.copy:
+    src: /root/.cshrc
+    dest: /usr/share/rootfiles/.cshrc
+    remote_src: true
+    force: false
+  when:
+  - '"rootfiles" in ansible_facts.packages'
+  - rootfiles_configured_cshrc_root_stat.stat.exists
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
 - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration files
   ansible.builtin.find:
     paths: /etc/tmpfiles.d/
@@ -193,6 +334,37 @@
   - no_reboot_needed
   - rootfiles_configured
 
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Stat /root/.tcshrc
+  ansible.builtin.stat:
+    path: /root/.tcshrc
+  register: rootfiles_configured_tcshrc_root_stat
+  when: '"rootfiles" in ansible_facts.packages'
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
+- name: Ensure rootfiles tmpfile.d is Configured Correctly - Copy /root/.tcshrc to
+    /usr/share/rootfiles/.tcshrc if missing
+  ansible.builtin.copy:
+    src: /root/.tcshrc
+    dest: /usr/share/rootfiles/.tcshrc
+    remote_src: true
+    force: false
+  when:
+  - '"rootfiles" in ansible_facts.packages'
+  - rootfiles_configured_tcshrc_root_stat.stat.exists
+  tags:
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rootfiles_configured
+
 - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration files
   ansible.builtin.find:
     paths: /etc/tmpfiles.d/