ComplianceAsCode / ComplianceAsCode/content
grub2_disable_interactive_boot is not UEFI aware
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Latest content remediates this when using a RHEL-9 ospp profile:
```
...
#Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
grub2-mkconfig -o /boot/grub2/grub.cfg
```
(this can be seen in a `oscap xccdf generate --profile ospp fix`).
The problem is that the ospp profile is generally used on UEFI systems (due to Secure Boot) and `/boot/efi/EFI/*/grub.cfg` is used instead of `/boot/grub2/grub.cfg`, which is ignored.
There seem to be other grub2 rules that seem to be uefi aware (versus others that are not),
* https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/bootloader-grub2/uefi
* https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/bootloader-grub2/non-uefi
so maybe two versions of the `grub2_disable_interactive_boot` rule would make sense, for both `{{{ grub2_uefi_boot_path }}}` and `{{{ grub2_boot_path }}}`.
(Or another solution that would ensure an UEFI remediation script for the ospp profile.)
Note that this remediation script is not present in the RHEL-9.0 GA release version of scap-security-guide, it was added later during RHEL-9 lifecycle.
#### SCAP Security Guide Version:
scap-security-guide-0.1.62-1.el9
#### Operating System Version:
RHEL-9
Contributor guide
Assessment
This issue has not been assessed yet.