search

ComplianceAsCode / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://complianceascode.readthedocs.io/en/latest/
Other
2.23k stars 698 forks source link

Backups in offline mode #10926

Open kingsleyzissou opened 1 year ago

kingsleyzissou commented 1 year ago

Share the context

We are currently updating our osbuild stage tests [1] and ran into an issue with the OpenSCAP remediation tests. The test basically creates an image with remediations and one without and compares the diff of the two images. We noticed that authselect was creating backups.

Description of problem:

The OpenSCAP offline remediation created backups for a freshly created image.

OS: Fedora-38

Version: scap-security-guide-0.1.68-1.fc38

Proposed change:

Backups for an already running system makes sense, however, we were wondering if it makes sense to enable these for a freshly created image? Would it be possible to disable the backups in offline mode?

References:

  1. https://github.com/osbuild/osbuild/pull/1351
ggbecker commented 1 year ago

This unfortunately cannot be parameterized, the following code adds this backup feature:

https://github.com/ComplianceAsCode/content/blob/fa5de550a674f0e5f5dcc1badf7d4d238c555d90/shared/macros/10-bash.jinja#L1020-L1040

and

https://github.com/ComplianceAsCode/content/blob/fa5de550a674f0e5f5dcc1badf7d4d238c555d90/shared/macros/10-ansible.jinja#L816-L838

The only solution I see here is to remove this backup feature. Maybe @marcusburghardt has some other ideas.

marcusburghardt commented 1 year ago

Yes, we can update the macro to make the backup optional or even based in a conditional. I will take a look on this.

ggbecker commented 1 year ago

Yes, we can update the macro to make the backup optional or even based in a conditional. I will take a look on this.

The question is, how are you going to control this via the remediation. I don't think we can do it just with the fact that the scanning runs on offline mode.

marcusburghardt commented 1 year ago

Yes, we can update the macro to make the backup optional or even based in a conditional. I will take a look on this.

The question is, how are you going to control this via the remediation. I don't think we can do it just with the fact that the scanning runs on offline mode.

I don't know details now, but it is something I expect to figure out when investigating the case.

marcusburghardt commented 1 year ago

Related: https://github.com/ComplianceAsCode/content/issues/10967