search

OpenSCAP / oscap-anaconda-addon

The add-on to Anaconda installer providing scanning capabilities
https://www.open-scap.org/tools/oscap-anaconda-addon/
GNU General Public License v2.0
28 stars 26 forks source link

List of excluded packages is not reset when different profile is selected #142

Open mildas opened 3 years ago

mildas commented 3 years ago

During installation of RHEL8, when a security policy is selected, and then the policy is changes to a different one, it seems that list of excluded packages is not reset.

See discussion in https://github.com/ComplianceAsCode/content/issues/6899 - performed for "Server with GUI" package selection: When the DISA STIG security policy (a profile that removes xorg-x11-* packages) is selected, and then the DISA STIG with GUI (a profile that does not remove the packages) is selected, it is not possible to begin the installation because of package conflicts - xorg-x11-* packages are excluded. But, if you start a new installation, select DISA STIG with GUI first, then there are no conflicts in xorg-x11-* packages.

matejak commented 3 years ago

We revert some of the package changes when another profile is selected from GUI - see e.g. PackageRules.revert_changes The problem probably comes from dependencies that are removed when packages are excluded, but that are not re-added when another profile doesn't exclude those packages any more.