Skip to content

Remove outdated waivers after 0.1.82 stabilization #660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jan-cerny wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Remove outdated waivers after 0.1.82 stabilization #660

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 0 additions & 13 deletions conf/waivers/permanent
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,9 +63,6 @@
/static-checks/html-links/https://www.ccn-cert.cni.es/pdf/guias/series-ccn-stic/guias-de-acceso-publico-ccn-stic/6768-ccn-stic-610a22-perfilado-de-seguridad-red-hat-enterprise-linux-9-0/file.html
"URL returned error: 403" in note
# likely has bot detection
/static-checks/html-links/https://www.cyber.mil/stigs/downloads/.*
"Connection reset by peer" in note
# also bot detection?
/static-checks/html-links/https://www.cyber.gov.au/acsc/view-all-content/ism
bool(re.search("HTTP/2 stream [0-9]+ was not closed cleanly: INTERNAL_ERROR", note))

Expand Down Expand Up @@ -154,14 +151,4 @@
/scanning/boot-errors/.+/rsyslogd.+(certificate.*is not set|key.*is not set|cannot resolve hostname).*
True

# File /boot/grub2/grub2.cfg is created with lenient permissions by
# bootupd during the installation of a bootable container image.
# Tests still fail on RHEL 10.0
# https://github.com/coreos/bootupd/issues/952
# https://issues.redhat.com/browse/OPENSCAP-5326
# https://github.com/ComplianceAsCode/content/issues/14581
/hardening/container/(anaconda-ostree|bootc-image-builder|old-new)/.+/file_permissions_grub2_cfg
/hardening/container/(anaconda-ostree|bootc-image-builder|old-new)/.+/file_permissions_efi_grub2_cfg
rhel == 10.0 or rhel <= 9.7

# vim: syntax=python
17 changes: 2 additions & 15 deletions conf/waivers/productization
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,9 +88,6 @@
/hardening/container/anaconda-ostree/.+/accounts_password_set_min_life_existing
/hardening/container/anaconda-ostree/.+/accounts_password_set_warn_age_existing
True
# https://github.com/ComplianceAsCode/content/issues/14254
/hardening/container/(anaconda-ostree|bootc-image-builder|old-new)/.+/file_permissions_boot_grub2
rhel == 10

# Image builder issue. Image builder needs to add BSI, ISM Official Secret
# and ISM Official Top Secret to its allow list, tracked under
Expand All @@ -104,22 +101,12 @@
/hardening/image-builder/uefi/ism_o_top_secret
rhel == 10 and status == 'error'

# https://github.com/ComplianceAsCode/content/issues/14559
/scanning/boot-errors/(stig|ism_o|ism_o_secret|ism_o_top_secret)/.*sssd.service.*
rhel == 10
/scanning/boot-errors/(stig|anssi_bp28_intermediary|anssi_bp28_enhanced|anssi_bp28_high)/.*sssd.service.*
/scanning/boot-errors/(stig|anssi_bp28_intermediary|anssi_bp28_enhanced|anssi_bp28_high)/.*Failed to start System Security Services Daemon.*
/scanning/boot-errors/(stig|anssi_bp28_intermediary|anssi_bp28_enhanced|anssi_bp28_high)/sssd.*No domain is enabled.*
/scanning/boot-errors/(stig|anssi_bp28_high)/sssd: SSSD couldn't load the configuration database.*
rhel == 9
# https://github.com/ComplianceAsCode/content/issues/14570
/hardening/host-os/oscap/.+/rsyslog_files_permissions
rhel.is_centos() and rhel in [9, 10]

# https://github.com/ComplianceAsCode/content/issues/14992
/hardening/host-os/ansible/.+/mount_option_.+
/hardening/host-os/ansible/.+/systemd_tmp_mount_enabled
/hardening/container/.+/mount_option_.+
# https://github.com/ComplianceAsCode/content/issues/15002
/hardening/host-os/ansible/.+/mount_option_tmp_noexec
True

# https://github.com/ComplianceAsCode/content/issues/15006
Expand Down
Loading