ComplianceAsCode / ComplianceAsCode/content

`kdump` is not disabled via Kickstart remediations on RHEL-10

Open
#12,832 7 comments 0 reactions 1 assignee Claimed by @jan-cerny View on GitHub
blocked productization-issue RHEL10 triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

According to oscap HTML report, `kdump.service` has `ActiveState` as `failed`, not as `disabled` (?).

This is possibly because RHEL-10 Anaconda forcibly activates kdump even if the (oscap-generated) kickstart has
```
# Disable and enable systemd services (required for security compliance)
services --disabled=debug-shell,autofs,kdump --enabled=pcscd,rsyslog,systemd-journald,firewalld,fapolicyd,chronyd,sshd,usbguard,auditd
```

Maybe it can be fixed in content, maybe adding
```
%addon com_redhat_kdump --disable
%end
```
would fix it (in OpenSCAP code?).

This `%addon` syntax is compatible with older RHELs too, and should arguably be present in those kickstarts as well.

There was a similar issue in the past with Anaconda: https://github.com/rhinstaller/kdump-anaconda-addon/commit/06ad89188047cc28fde514ab722a1bf4637b60ad , so this may also be an Anaconda bug - we should probably contact their devel team to figure out a solution.

#### SCAP Security Guide Version:
master @ 60a184a0

#### Operating System Version:
RHEL-10

#### Steps to Reproduce:
1. Run `custom` productization as
```
--rhel 10 --arch x86_64 --test /hardening/kickstart/hipaa
```
(happens on `hipaa`, `stig` and `stig_gui`)

#### Additional Information/Debugging Steps:
* [report.html.gz](https://github.com/user-attachments/files/18428854/report.html.gz)
* [scan-arf.xml.gz](https://github.com/user-attachments/files/18428855/scan-arf.xml.gz)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.