Open comps opened 1 month ago
For the record - I did review the rules remediated by Ansible up to the point of it stopping for firewalld, but there was nothing obviously responsible - just some account password policy setting, /etc/login.defs
, etc., no sysctls or anything.
Description of problem:
Unfortunately, I don't have a solution, so the following is just a series of notes from my incomplete investigation.
Remediating a pre-built (by CaC/content build system) CIS playbook (any cis* profile) on RHEL-10 leads to Ansible failing to configure fapolicyd
This is possibly because it's not running - the remediation was run on a Beaker (internal) system where firewalld is disabled by default, but earlier playbook tasks should have enabled it (as they do on RHEL-8/9).
I tried unselecting
firewalld_loopback_traffic_restricted
firewalld_loopback_traffic_trusted
to progress further, which stopped on
That gave me a clue, and investigating further on the OS revealed that, indeed, networking is down after a remediation + reboot, due to NM failing to start due to an unfulfilled systemd dependency -
dbus.service
. It turns outdbus-broker.service
failed to start onI asked the systemd people, but got no reply back so far, so I started digging into the source code - I downloaded and rpmbuild-patched the same version of systemd, and discovered that
src/launch/launcher.c
line326
is theerror_origin()
inwhich means that
sd_id128_get_machine()
failed onEPERM
. I then looked intosystemd
source itself to see what the function does, and it basically just reads/etc/machine-id
:but that makes no sense - all it does is to, in essence, read the world-readable file:
Disabling SELinux also didn't fix it,
/etc
has the usual0755
, so there should be no issues accessing that file. No file ACLs either.I also looked into
src/launch/service.c
line1011
(given that it was mentioned) and there isn't anything conclusive either:Googling around, it seems that
Transport endpoint is not connected
(ENOTCONN
) is a frequent return from the function when something below goes wrong.At that point, I gave up.
Independently, I tried remediating the same playbook after
setenforce 0
, and it at least went through all rules (didn't stop on firewalld or NM), but the networking was dead anyway, so it did not fix the issue.SCAP Security Guide Version:
703fb11c94d60366da108e02f8bf21b7fae87a81
Operating System Version:
RHEL-10