Watson Yuuma Sato

Drop Anaconda remediations from rules not applicable to RHV

6

#### Description: - In RHEL8, drop Anaconda remediations not applicable for RHV - They are breaking hardened install with oscap-anaconda-addon - Add remediation conditonals for `ovirt` and `no_ovirt` CPEs -...

Rule grub2_ipv6_disable_argument removes sysctl ipv6 variables and causes rules to fail

2

#### Description of problem: Remediation of rule `grub2_ipv6_disable_argument` in CIS profile makes all sysctl ipv6 variable unavailable, causing sysctl ipv6 rules to `fail`. After remediation of `grub2_ipv6_disable_argument`, the following rules...

Resolve duplicated OVAL tests created by new templating system

5

The template for `service_enabled` creates new criterions for `package_installed` instead of extending. If a rule for the package installed already exists, this will end up creating two similar OVAL objects:...

oauth_or_oauthclient_token_maxage: Use variable for remediation of rule

9

#### Description: - As the rule is parametrized to use a variable, the check should use it for remediation. #### Rationale: - The rule's extended definition checks are leveragin the...

k8s image content from PRs: remove token from action parameters

3

#### Description: - Remove `github-token` from the `Upsert comment on the PR` job. #### Rationale: - Addresses two warning: https://github.com/ComplianceAsCode/content/actions/runs/7961404888 - It seems that the default value of `${{ github.token...

Add OCP4 STIG control file and auto-add references

5

#### Description: - Based on the Manual OCP4 STIG Benchmark and the SRG_CTR add a OCP4 STIG specific control file. - With the OCP4 STIG control file we can leverage...

OCPBUGS-33194: Fix text in rule file_groupowner_ovs_conf_db_lock

4

#### Description: - The correct path for the db lock file is: /etc/openvswitch/.conf.db.~lock~ - Note: the rule checked the correct path. Only the description was incorrect. #### Rationale: - The...

CMP-2455: PCI-DSS v4 Requirement 3

4

#### Description: - `3.1`, `3.2`, `3.3`, `3.4`, `3.7` are not applicable to OCP. - `3.5` is partially applicable, due to Requirement `3.5.1`. - `3.6` is inherently met.

OCPBUGS-32551: swap token inactivity timeout rule

11

#### Description: - Let's use `oauth_or_oauthclient_inactivity_timeout` instead of `oautclient_inactivity_timeout`. #### Rationale: - The former rule checks for server and client token timeout configuration is multiple places and remediates the server...

Re-enable runtime check on network related sysctls

9

#### Description: - Re-add the syctl runtime checks to test https://github.com/ComplianceAsCode/compliance-operator/pull/497 #### Rationale: - It seems taht when CO's "scanner" pod has "HostNetwork" option set to true, these sysctls are...