ComplianceAsCode / ComplianceAsCode/content

grub2_disable_interactive_boot is not UEFI aware

Open
#9,044 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Latest content remediates this when using a RHEL-9 ospp profile:
```
...
#Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
grub2-mkconfig -o /boot/grub2/grub.cfg
```
(this can be seen in a `oscap xccdf generate --profile ospp fix`).

The problem is that the ospp profile is generally used on UEFI systems (due to Secure Boot) and `/boot/efi/EFI/*/grub.cfg` is used instead of `/boot/grub2/grub.cfg`, which is ignored.

There seem to be other grub2 rules that seem to be uefi aware (versus others that are not),

* https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/bootloader-grub2/uefi
* https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/bootloader-grub2/non-uefi

so maybe two versions of the `grub2_disable_interactive_boot` rule would make sense, for both `{{{ grub2_uefi_boot_path }}}` and `{{{ grub2_boot_path }}}`.

(Or another solution that would ensure an UEFI remediation script for the ospp profile.)

Note that this remediation script is not present in the RHEL-9.0 GA release version of scap-security-guide, it was added later during RHEL-9 lifecycle.

#### SCAP Security Guide Version:
scap-security-guide-0.1.62-1.el9

#### Operating System Version:
RHEL-9

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.