ComplianceAsCode / ComplianceAsCode/content
Compare ds tool may produce useless information when comparing ansible remediation
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
[compare_ds.py](https://github.com/ComplianceAsCode/content/blob/master/utils/compare_ds.py) may produce useless information when comparing ansible remediation.
These kind of changes don't add any real value to the comparison (especially from the tags section), and may produce a huge changelog impossible to be processed by humans. It would be nice to have an option to leave these kind of changes out of the result so real changes to the ansible remediation could be easily analyzed.
#### SCAP Security Guide Version:
latest
#### Actual Results:
```
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_service_nfs_disabled' differs:
--- old datastream
+++ new datastream
@@ -11,18 +11,18 @@
state: stopped
masked: 'yes'
when: '"nfs.service" in ansible_facts.services'
- when: ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker"
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz"]
tags:
- - service_nfs_disabled
- - unknown_severity
+ - CCE-80237-1
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
- disable_strategy
- low_complexity
- low_disruption
- no_reboot_needed
- - CCE-80237-1
- - NIST-800-53-CM-7(a)
- - NIST-800-53-CM-7(b)
- - NIST-800-53-CM-6(a)
+ - service_nfs_disabled
+ - unknown_severity
- name: Unit Socket Exists - nfs.socket
command: systemctl list-unit-files nfs.socket
@@ -32,18 +32,18 @@
changed_when: false
ignore_errors: true
check_mode: false
- when: ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker"
+ when: ansible_virtualization_type not in ["docker", "lxc", "openvz"]
tags:
- - service_nfs_disabled
- - unknown_severity
+ - CCE-80237-1
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
- disable_strategy
- low_complexity
- low_disruption
- no_reboot_needed
- - CCE-80237-1
- - NIST-800-53-CM-7(a)
- - NIST-800-53-CM-7(b)
- - NIST-800-53-CM-6(a)
+ - service_nfs_disabled
+ - unknown_severity
- name: Disable socket nfs
systemd:
@@ -53,15 +53,15 @@
masked: 'yes'
when:
- '"nfs.socket" in socket_file_exists.stdout_lines[1]'
- - ansible_virtualization_role != "guest" or ansible_virtualization_type != "docker"
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz"]
tags:
- - service_nfs_disabled
- - unknown_severity
+ - CCE-80237-1
+ - NIST-800-53-CM-6(a)
+ - NIST-800-53-CM-7(a)
+ - NIST-800-53-CM-7(b)
- disable_strategy
- low_complexity
- low_disruption
- no_reboot_needed
- - CCE-80237-1
- - NIST-800-53-CM-7(a)
- - NIST-800-53-CM-7(b)
- - NIST-800-53-CM-6(a)
+ - service_nfs_disabled
+ - unknown_severity
```
#### Expected Results:
Empty
Contributor guide
Assessment
This issue has not been assessed yet.