ComplianceAsCode / ComplianceAsCode/content

Remediation should support chroot environments

Open
#10,967 0 comments 0 reactions 0 assignees View on GitHub
CPE-AL triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

When running in a chroot environment, such as a kiwi appliance build, where /proc is not available, application of sysctl specific rules fails. Those rules try to read and set active kernel parameters, which requires a running system. In a chroot env, application of those rules should be limited to handling files /etc/sysctl.d/. Similarly, any rule that requires a running systemd fails too (see also https://github.com/ComplianceAsCode/content/issues/10945), and should be limited to configuring and enabling or disabling services.

Generally speaking, there should be an offline mode in which all operations that require a running system are skipped, so remediation in an appliance build is possible.

#### SCAP Security Guide Version:

0.1.68

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.