macros: bash: Avoid matching comments in fstab macros

[dodys]

Description:

• Fixes Ubuntu 22.04 sed error when run on multiple checks #10426

Rationale:

• This probably affects other vendors as well and we already added a fix for the oval back in commit ee5352b but missing the same in bash

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot/efi")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/boot/efi")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/boot/efi' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot/efi)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /boot/efi)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_noauto' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_noauto
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_noauto
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/boot")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /boot)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/boot")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /boot)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/boot")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /boot)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/boot")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/boot")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/boot' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /boot)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /boot)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
@@ -5,7 +5,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
@@ -5,7 +5,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
@@ -5,7 +5,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /dev/shm)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /dev/shm)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_grpquota' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_grpquota
+++ xccdf_org.ssgproject.content_rule_mount_option_home_grpquota
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/home")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /home)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_home_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/home")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /home)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_home_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/home")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /home)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_home_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/home")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /home)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_usrquota' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_usrquota
+++ xccdf_org.ssgproject.content_rule_mount_option_home_usrquota
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/home")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/home")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/home' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /home)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /home)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -17,7 +17,7 @@
     device_type="$(echo ${partition_record} | cut -d " " -f3)"
     if ! printf '%s\0' "${polyinstantiated_dirs[@]}" | grep -qxzF "$mount_point"; then
         # device and device_type will be used only in case when the device doesn't have fstab record
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" $mount_point)"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" $mount_point)"
 
         # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
         if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/opt")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/opt")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/opt' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /opt)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /opt)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
+++ xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
@@ -8,7 +8,7 @@
     var_mount_option_proc_hidepid=''
 
     mountoption="hidepid=$var_mount_option_proc_hidepid"
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /proc)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /proc)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/srv")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/srv")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/srv' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /srv)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /srv)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log/audit")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log/audit")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log/audit' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log/audit)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log/audit)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/log")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/log")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/log' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/log)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/log)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
@@ -3,7 +3,7 @@
 
 function perform_remediation {
     
-        mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" "/var/tmp")"
+        mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" "/var/tmp")"
 
     grep "$mount_point_match_regexp" -q /etc/fstab \
         || { echo "The mount point '/var/tmp' is not even in /etc/fstab, so we can't set up mount options" >&2;
@@ -11,7 +11,7 @@
     
 
 
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" /var/tmp)"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" /var/tmp)"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
@@ -6,7 +6,7 @@
 
 for vfstype_point in "${vfstype_points[@]}"
 do
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
@@ -6,7 +6,7 @@
 
 for vfstype_point in "${vfstype_points[@]}"
 do
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
@@ -6,7 +6,7 @@
 
 for vfstype_point in "${vfstype_points[@]}"
 do
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
@@ -6,7 +6,7 @@
 
 for vfstype_point in "${vfstype_points[@]}"
 do
-    mount_point_match_regexp="$(printf "[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
+    mount_point_match_regexp="$(printf "[^#].*[[:space:]]%s[[:space:]]" ${vfstype_point//\\/\\\\})"
 
     # If the mount point is not in /etc/fstab, get previous mount options from /etc/mtab
     if ! grep "$mount_point_match_regexp" /etc/fstab; then

[codeclimate]

Code Climate has analyzed commit a63d61f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.8% (0.0% change).

View more on Code Climate.

[jan-cerny]

[jcerny@fedora scap-security-guide{pr/10754}]$ python3 tests/test_suite.py rule --libvirt qemu:///system ssgts_rhel9 mount_option_tmp_nodev
WARNING - You call Automatus using the legacy 'test_suite.py' script, use the 'automatus.py' instead

Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-06-28-1103/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
INFO - Script fstab_comment.pass.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script runtime.pass.sh using profile (all) OK
INFO - Script fstab.fail.sh using profile (all) OK

WARNING - You call Automatus using the legacy 'test_suite.py' script, use the 'automatus.py' instead
[jcerny@fedora scap-security-guide{pr/10754}]$ 

[jan-cerny]

The CI fail on Rawhide is caused by OpenSCAP/openscap#1995 and isn't related to the contents of this PR.