exclude some problematic rules from ism_o rhel10 profiles

see comments
ComplianceAsCode · Sep 25, 2024 · 1fefa5a · 1fefa5a
1 parent 93a82b0
commit 1fefa5a
Show file tree

Hide file tree

Showing 3 changed files with 45 additions and 0 deletions.
diff --git a/products/rhel10/profiles/ism_o.profile b/products/rhel10/profiles/ism_o.profile
@@ -28,3 +28,18 @@ extends: e8
 
 selections:
     - ism_o:all:base
+    # these rules do not work properly on RHEL 10 for now
+    - '!enable_dracut_fips_module'
+    - '!firewalld_sshd_port_enabled'
+    - '!require_singleuser_auth'
+    - '!enable_fips_mode'
+    # tally2 is deprecated, replaced by faillock
+    - '!accounts_passwords_pam_tally2_deny_root'
+    - '!accounts_passwords_pam_tally2_unlock_time'
+    - '!audit_rules_login_events_tallylog'
+    # lastlog is not used in RHEL 10
+    - '!audit_rules_login_events_lastlog'
+    # this rule is currently failing on some systemd services, probably because of require_emergency_target_auth and require_singleuser_auth rules
+    - '!rpm_verify_hashes'
+    # this rule should not be needed anymore on RHEL 10, but investigation is recommended
+    - '!openssl_use_strong_entropy'
diff --git a/products/rhel10/profiles/ism_o_secret.profile b/products/rhel10/profiles/ism_o_secret.profile
@@ -30,3 +30,18 @@ extends: e8
 
 selections:
     - ism_o:all:secret
+    # these rules do not work properly on RHEL 10 for now
+    - '!enable_dracut_fips_module'
+    - '!firewalld_sshd_port_enabled'
+    - '!require_singleuser_auth'
+    - '!enable_fips_mode'
+    # tally2 is deprecated, replaced by faillock
+    - '!accounts_passwords_pam_tally2_deny_root'
+    - '!accounts_passwords_pam_tally2_unlock_time'
+    - '!audit_rules_login_events_tallylog'
+    # lastlog is not used in RHEL 10
+    - '!audit_rules_login_events_lastlog'
+    # this rule is currently failing on some systemd services, probably because of require_emergency_target_auth and require_singleuser_auth rules
+    - '!rpm_verify_hashes'
+    # this rule should not be needed anymore on RHEL 10, but investigation is recommended
+    - '!openssl_use_strong_entropy'
diff --git a/products/rhel10/profiles/ism_o_top_secret.profile b/products/rhel10/profiles/ism_o_top_secret.profile
@@ -28,3 +28,18 @@ extends: e8
 
 selections:
     - ism_o:all:top_secret
+    # these rules do not work properly on RHEL 10 for now
+    - '!enable_dracut_fips_module'
+    - '!firewalld_sshd_port_enabled'
+    - '!require_singleuser_auth'
+    - '!enable_fips_mode'
+    # tally2 is deprecated, replaced by faillock
+    - '!accounts_passwords_pam_tally2_deny_root'
+    - '!accounts_passwords_pam_tally2_unlock_time'
+    - '!audit_rules_login_events_tallylog'
+    # lastlog is not used in RHEL 10
+    - '!audit_rules_login_events_lastlog'
+    # this rule is currently failing on some systemd services, probably because of require_emergency_target_auth and require_singleuser_auth rules
+    - '!rpm_verify_hashes'
+    # this rule should not be needed anymore on RHEL 10, but investigation is recommended
+    - '!openssl_use_strong_entropy'