Use sssd_conf_files_present applicability in sssd_enable_pam_services

This rule is only applicable when SSSD is already in use and consequently configured. Signed-off-by: Marcus Burghardt <[email protected]>
ComplianceAsCode · Sep 17, 2024 · 319c8aa · 319c8aa
1 parent 8efd01a
commit 319c8aa
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml b/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml
@@ -1,6 +1,5 @@
 documentation_complete: true
 
-
 title: 'Configure PAM in SSSD Services'
 
 description: |-
@@ -37,10 +36,18 @@ references:
     srg: SRG-OS-000375-GPOS-00160,SRG-OS-000376-GPOS-00161,SRG-OS-000377-GPOS-00162
     stigid@ol7: OL07-00-041002
 
+platform: sssd_conf_files_present
+
 ocil_clause: 'it does not exist or ''pam'' is not added to the ''services'' option under the ''sssd'' section'
 
 ocil: |-
     To verify that SSSD is configured for PAM services, run the following command:
     <pre>$ sudo grep services /etc/sssd/sssd.conf</pre>
     If configured properly, output should be similar to
     <pre>services = pam</pre>
+
+warnings:
+    - general:
+        This rule will report as "notapplicable" if there is no SSSD configuration file present
+        in the system. The SSSD configuration might be different for each site and therefore a new
+        configuration file is not automatically created.
diff --git a/linux_os/guide/services/sssd/sssd_enable_pam_services/tests/sssd_config_missing.fail.sh b/linux_os/guide/services/sssd/sssd_enable_pam_services/tests/sssd_config_missing.fail.sh
@@ -2,6 +2,9 @@
 # packages = sssd-common
 # remediation = none
 
+# SSSD configuration files are expected to be created manually since the configuration can
+# be different for each site. Therefore, if there is no configuration files previously created
+# in the system, this rule will report "not applicable".
 SSSD_CONF_FILE="/etc/sssd/sssd.conf"
 SSSD_CONF_DIR_FILES="/etc/sssd/conf.d/*.conf"