Closed gpavinteractiv closed 1 year ago
"BZ 2030226 [RFE] oVirt hypervisors should ..." is probably just an automatic translation, you can see in the bug it was a RHV feature. We do not test this upstream in oVirt really, mostly because it's hard to keep up with the profile changes. It may work, I don't mind merging a patch if you post one and confirm it works.
I don't have the know how to build an image with theses changes in order to test them. Could the build be done on oVirt infra, if such thing is possible, and I'll happily test and report ?
unfortunately not. for this project the automation is too tied with actual release. But it shouldnt' be that difficult to run locally, just prepare host as https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L40 and run priviledged container from https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L57 with the script and few variables like https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L66
@michalskrivanek I'm totally unsure of the individual steps to build the iso.
On a clean centos stream 9, could you provide the exact command flow that will result in creating the container with the proper variables you mentioned and then run build.sh?
i dont' have it at hand, but really just copying from the workflow code it should be mkdir -p /host/modules mount --bind /lib/modules/$(uname -r) /host/modules podman run -it --privileged -v /host/modules:/host/modules quay.io/ovirt/buildcontainer:el9stream and then inside just check out the repo with your PR and run export SUPERMIN_MODULES=/host/modules export SUPERMIN_KERNEL=/host/modules/vmlinuz build.sh
Thank! We have build the centos 9 iso with the aforementioned patch :
Change the name of the file to match what's expected by anaconda. From :
ln -sf/usr/share/xml/scap/ssg/content/{ssg-rhel9,ssg-onn45}-ds.xml
To :
ln -sf /usr/share/xml/scap/ssg/content/{ssg-rhel9,ssg-onn4}-ds.xml
Please note that we kept linking from ssg-rhel9-ds.xml, as originally. However, there is also a ssg-cs9-ds.xml in the same folder.
Do you know if applying the rhel9 rules to a centos is valid ?
We got an error when starting the installtaion :
The host has been provisioned and joined to the oVirt Cluster. It seems to be working properly.
Please use the cs9 one as the OVAL tuple isn't matching between cs9 and rhel9.
Once deployed, you can check it with:
sudo oscap xccdf eval --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_pci-dss --report /tmp/report.html /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml
and look at the report.
Should be fixed by #115
Sorry for coming back to you late.
I see that you have merged my initial patch linking to ssg-rhel9-ds.xml
In the meantime, I had followed your advice and retried builing an iso while linking to ssg-cs9-ds.xml
Two notes :
I still got the same exact error complaining about ssg-rhel9-ds.xml not being valid, even thoud we are linking to ssg-cs9-ds.xml :
after installation I tried the oscap eval command but many tests are in failed state. Therefore I am unsure if the profile was applied or not. Please find the oscap eval --verbose DEVEL & html reports attached. oscap-eval-verbose-2023-05-17.log report-oscap-eval-2023-05-17.html.zip
As reported on ovirt users mailing list:
I tried with el8 & el9 oVirt Node 4.5.4 isos, But in both cases, the installation failed when selecting the PCI-DSS security profile. Please see screenshots attached
According to 4.5.0 release note this is a supported feature :
https://bugzilla.redhat.com/show_bug.cgi?id=2030226
As the RFE says that deployment works, I guess this is a regression somewhere between 4.5.0 & 4.5.4
On the mailing list, @sandrobonazzola answered :