CMP-4049: Add rules to RHCOS DS#14461
Open
yuumasato wants to merge 3 commits intoComplianceAsCode:masterfrom
Open
CMP-4049: Add rules to RHCOS DS#14461yuumasato wants to merge 3 commits intoComplianceAsCode:masterfrom
yuumasato wants to merge 3 commits intoComplianceAsCode:masterfrom
Conversation
yuumasato
force-pushed
the
add-rules-to-co-pb
branch
2 times, most recently
from
69a6a41 to
0854ba4
Compare
rhmdnd
reviewed
Mar 3, 2026
Collaborator
rhmdnd
left a comment
rhmdnd
left a comment
There was a problem hiding this comment.
One question on adding additional CCEs for the RHCOS rules now that we're using them there. Otherwise looks good.
linux_os/guide/system/software/system-tools/package_python3-dnf_removed/rule.yml
Outdated
Show resolved
Hide resolved
Collaborator
|
Generally the PR is good. I have created a tailoredprofile for all newly added rules. After autoremediations applied, two rules failed, one rule was accounts-authorized-local-users , the other rule was package-python3-dnf-removed. After add rules "core|containers" to the variable upstream-rhcos4-var-accounts-authorized-local-users-regex, the rule accounts-authorized-local-users could PASS.
|
yuumasato
force-pushed
the
add-rules-to-co-pb
branch
from
0854ba4 to
340d167
Compare
rhmdnd
approved these changes
Mar 5, 2026
yuumasato
force-pushed
the
add-rules-to-co-pb
branch
from
0fb640f to
07a0d8c
Compare
Member
Author
|
@rhmdnd Rebased, I'll propose them in separate PR. Makes it easier to merge this one. |
yuumasato
force-pushed
the
add-rules-to-co-pb
branch
from
07a0d8c to
2cda2eb
Compare
Member
Author
|
@xiaojiey I have removed the new rules, will add them later. And I added a variable selector for RHCOS4. |
Ensure warning about no automated remediation is shown. Add RHCOS4 variable selector for 'var_accounts_authorized_local_users_regex'.
yuumasato
force-pushed
the
add-rules-to-co-pb
branch
from
2cda2eb to
ced8ff7
Compare
rhmdnd
reviewed
Mar 5, 2026
Collaborator
rhmdnd
left a comment
rhmdnd
left a comment
There was a problem hiding this comment.
Only one rule recommendation inline, otherwise this looks good.
| - service_cups_disabled | ||
| - audit_rules_networkconfig_modification_network_scripts | ||
| - audit_rules_mac_modification_etc_selinux | ||
| - audit_rules_login_events_faillog |
Collaborator
There was a problem hiding this comment.
What about? That's similar to audit_rules_mac_modifications_etc_selinux.
- audit_rules_mac_modification_usr_share
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
defaultprofile.Rationale:
TailoredProfilesin Compliance OperatorReview Hints: