plus3it / plus3it/ash-linux-formula

[BUG] Missing Dependency in `ash-linux/el8/STIGbyID/cat2/RHEL-08-030590.sls`

Open
#481 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
SaltStack
Stars
19
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

If not running the entirety of the ash-linux-formula – specifically triggerable if invoking watchmaker with --exclude-states ash-linux.el8.VendorSTIG.remediate – this state will fail due to file not found for the /etc/audit/rules.d/logins.rules file.

Severity

Breaks the ability to do some partial watchmaker executions

To Reproduce
Steps to reproduce the behavior:

  1. Launch an EL8-based EC2 (etc)

  2. Invoke watchmaker with watchmaker --exclude-states ash-linux.el8.VendorSTIG.remediate

  3. Wait for watchmaker to exit

  4. See error like:

        Log faillock modifications (RHEL-08-030590):
            __id__: Log faillock modifications (RHEL-08-030590)
            __run_num__: 81
            __sls__: ash-linux.el8.STIGbyID.cat2.RHEL-08-030590
            changes: {}
            comment: '/etc/audit/rules.d/logins.rules: file not found'
            duration: 10.043
            name: /etc/audit/rules.d/logins.rules
            result: false
            start_time: '14:02:03.551634'
    

    In the watchmaker logs:

Expected behavior

The state should be successfully executable regardless of exclusions of other states.

Deviance Description

Screenshots

Additional context

Fix Suggestions

Add a step to the formula that ensures that the target file exists before executing attempts to alter it.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ash-linux/el8/STIGbyID/cat2/RHEL-08-030590.sls and reproduce with watchmaker --exclude-states ash-linux.el8.VendorSTIG.remediate on an EL8 system. Confirm the state no longer fails because /etc/audit/rules.d/logins.rules is missing, and verify it runs successfully when other states are excluded.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.