ComplianceAsCode / ComplianceAsCode/content
`kdump` is not disabled via Kickstart remediations on RHEL-10
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
According to oscap HTML report, `kdump.service` has `ActiveState` as `failed`, not as `disabled` (?).
This is possibly because RHEL-10 Anaconda forcibly activates kdump even if the (oscap-generated) kickstart has
```
# Disable and enable systemd services (required for security compliance)
services --disabled=debug-shell,autofs,kdump --enabled=pcscd,rsyslog,systemd-journald,firewalld,fapolicyd,chronyd,sshd,usbguard,auditd
```
Maybe it can be fixed in content, maybe adding
```
%addon com_redhat_kdump --disable
%end
```
would fix it (in OpenSCAP code?).
This `%addon` syntax is compatible with older RHELs too, and should arguably be present in those kickstarts as well.
There was a similar issue in the past with Anaconda: https://github.com/rhinstaller/kdump-anaconda-addon/commit/06ad89188047cc28fde514ab722a1bf4637b60ad , so this may also be an Anaconda bug - we should probably contact their devel team to figure out a solution.
#### SCAP Security Guide Version:
master @ 60a184a0
#### Operating System Version:
RHEL-10
#### Steps to Reproduce:
1. Run `custom` productization as
```
--rhel 10 --arch x86_64 --test /hardening/kickstart/hipaa
```
(happens on `hipaa`, `stig` and `stig_gui`)
#### Additional Information/Debugging Steps:
* [report.html.gz](https://github.com/user-attachments/files/18428854/report.html.gz)
* [scan-arf.xml.gz](https://github.com/user-attachments/files/18428855/scan-arf.xml.gz)
Contributor guide
Assessment
This issue has not been assessed yet.