ComplianceAsCode / ComplianceAsCode/content
Rules related to ntp shouldn't be present in products where ntp isn't available
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
The rule `service_ntpd_enabled` is about service provided by `ntp` package. But the `ntp` package isn't present in Fedora, RHEL 9 and maybe also some other systems, they have `chrony` instead. But the rule doesn't have a prodtype defined and therefore it appears in all products.
One of the possible problems this inconsistency caused was during review of https://github.com/ComplianceAsCode/content/pull/9951 where the content test filtering has discovered that we change `rule.yml` in rule `service_ntpd_enabled` and Automatus tried to execute the test scenarios on Fedora and CS9 machines which failed because it couldn't install the `ntp` RPM package. This caused that no tests were run in the CI in automatus job.
Adding the prodtype to the rule isn't easy because the generated OVAL for this rule is used in other rules via extend_definition: `chronyd_or_ntpd_specify_multiple_servers`, `chronyd_or_ntpd_specify_remote_server` or `service_chronyd_or_ntpd_enabled`. Together, these rules are used in multiple profiles and products.
These rules have their "chrony" counterpart. We need to start using the "chrony" variants of the rules in products and profiles where `ntp` package isn't available. Then, we will have to provide prodype in rules `service_ntpd_enabled`.
#### SCAP Security Guide Version:
current upstream as of 2023-01-04 as of HEAD 772d932d1401095b36c0c1b9514f343d3f45bbe0
#### Operating System Version:
all
#### Steps to Reproduce:
1. ./build_product $product
#### Actual Results:
rules related to ntp are present in products where ntp isn't present
#### Expected Results:
rules related to ntp aren't present in products where ntp isn't present
#### Additional Information/Debugging Steps:
none
Contributor guide
Assessment
This issue has not been assessed yet.