diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml index 2cebcfdc5d3..a3490a60d13 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml @@ -4,13 +4,23 @@ # complexity = low # disruption = low +{{% if 'sle' in product %}} +- name: Require emergency mode password + ansible.builtin.blockinfile: + create: yes + dest: /etc/systemd/system/emergency.service.d/10-oscap.conf + block: | + [Service] + ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency +{{% else %}} - name: Require emergency mode password lineinfile: create: yes dest: /usr/lib/systemd/system/emergency.service regexp: "^#?ExecStart=" - {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9","sle12", "sle15"] -%}} + {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9"] -%}} line: "ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency" {{%- else -%}} line: 'ExecStart=-/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"' {{%- endif %}} +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh index 410d611cfa4..2a65ef992e5 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/bash/shared.sh @@ -1,6 +1,11 @@ # platform = multi_platform_all +{{% if 'sle' in product %}} +service_dropin_cfg_dir="/etc/systemd/system/emergency.service.d" +service_dropin_file="${service_dropin_cfg_dir}/10-oscap.conf" +{{% else %}} service_file="/usr/lib/systemd/system/emergency.service" +{{% endif %}} {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9", "sle12", "sle15"] -%}} sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency" @@ -8,8 +13,14 @@ sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency" sulogin='/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"' {{%- endif %}} +{{% if 'sle' in product %}} +mkdir -p "${service_dropin_cfg_dir}" +echo "[Service]" >> "${service_dropin_file}" +echo "ExecStart=-$sulogin" >> "${service_dropin_file}" +{{% else %}} if grep "^ExecStart=.*" "$service_file" ; then sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file" else echo "ExecStart=-$sulogin" >> "$service_file" fi +{{% endif %}} diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/oval/shared.xml index a9c7188b6cb..25b2e735eef 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/oval/shared.xml @@ -2,13 +2,25 @@ {{{ oval_metadata("The requirement for a password to boot into emergency mode should be configured correctly.") }}} - - - - - +{{% if 'sle' in product %}} + +{{% endif %}} + + + + + + +{{% if 'sle' in product %}} + + + + +{{% endif %}} 1 +{{% if 'sle' in product %}} + + + + + /etc/systemd/system/emergency.service.d + ^.*\.conf$ + ^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency + 1 + +{{% endif %}} + @@ -66,4 +95,19 @@ /etc/systemd/system ^emergency.target$ + + + + + + + + /etc/systemd/system/emergency.service.d + ^*.conf$ +