ComplianceAsCode / ComplianceAsCode/content

Review OVAL tests in configure_crypto_policy

Open
#11,536 6 comments 0 reactions 0 assignees View on GitHub
OSPP RHEL triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

It is not clear the value of the `test_crypto_policies_updated` OVAL test in `configure_crypto_policy` considering there is already two tests confirming both `/etc/crypto-policy/config` and `/etc/crypto-policy/state/current` files are aligned to the desired content.

If the OVAL tests already confirm that both files are compliant, the `update-crypto-policy` command won't change the content but only the timestamp of the files. However, different timestamps between these two files doesn't seem to be a problem.

Can anybody confirm the value of this timestamp test in this OVAL check, please?

#### SCAP Security Guide Version:

master as of 2024-02-02

#### Operating System Version:

RHEL 9

#### Additional Information/Debugging Steps:

This issue was file to better investigate if the current rule checks are all necessary or the OVAL assessment can be simplified.

This was initially noticed when investigating the https://github.com/ComplianceAsCode/content/issues/11516

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.