oscap-anaconda-addon
oscap-anaconda-addon copied to clipboard
List of excluded packages is not reset when different profile is selected
During installation of RHEL8, when a security policy is selected, and then the policy is changes to a different one, it seems that list of excluded packages is not reset.
See discussion in https://github.com/ComplianceAsCode/content/issues/6899 - performed for "Server with GUI" package selection:
When the DISA STIG security policy (a profile that removes xorg-x11-*
packages) is selected, and then the DISA STIG with GUI (a profile that does not remove the packages) is selected, it is not possible to begin the installation because of package conflicts - xorg-x11-*
packages are excluded. But, if you start a new installation, select DISA STIG with GUI first, then there are no conflicts in xorg-x11-*
packages.
We revert some of the package changes when another profile is selected from GUI - see e.g. PackageRules.revert_changes The problem probably comes from dependencies that are removed when packages are excluded, but that are not re-added when another profile doesn't exclude those packages any more.