From f0a6859a33bb5ec95299a4dded29d32596019c7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Tue, 3 Dec 2024 14:03:16 +0100 Subject: [PATCH] Create a product property for bootable containers Promote the variable `bootable_containers_supported` to a product property. By default, bootable containers won't be supported. The RHEL 9 and 10 products will support bootable containers. This variable can be used at build time in many types of the code. --- products/rhel10/product.yml | 1 + products/rhel9/product.yml | 1 + shared/templates/grub2_bootloader_argument/oval.template | 9 ++------- ssg/constants.py | 1 + ssg/products.py | 4 ++++ tests/data/product_stability/alinux2.yml | 1 + tests/data/product_stability/alinux3.yml | 1 + tests/data/product_stability/anolis23.yml | 1 + tests/data/product_stability/anolis8.yml | 1 + tests/data/product_stability/chromium.yml | 1 + tests/data/product_stability/debian11.yml | 1 + tests/data/product_stability/debian12.yml | 1 + tests/data/product_stability/eks.yml | 1 + tests/data/product_stability/example.yml | 1 + tests/data/product_stability/fedora.yml | 1 + tests/data/product_stability/firefox.yml | 1 + tests/data/product_stability/macos1015.yml | 1 + tests/data/product_stability/ocp4.yml | 1 + tests/data/product_stability/ol7.yml | 1 + tests/data/product_stability/ol8.yml | 1 + tests/data/product_stability/ol9.yml | 1 + tests/data/product_stability/openembedded.yml | 1 + tests/data/product_stability/opensuse.yml | 1 + tests/data/product_stability/rhcos4.yml | 1 + tests/data/product_stability/rhel8.yml | 1 + tests/data/product_stability/rhel9.yml | 1 + tests/data/product_stability/rhv4.yml | 1 + tests/data/product_stability/sle12.yml | 1 + tests/data/product_stability/sle15.yml | 1 + tests/data/product_stability/ubuntu1604.yml | 1 + tests/data/product_stability/ubuntu1804.yml | 1 + tests/data/product_stability/ubuntu2004.yml | 1 + tests/data/product_stability/ubuntu2204.yml | 1 + tests/data/product_stability/ubuntu2404.yml | 1 + 34 files changed, 38 insertions(+), 7 deletions(-) diff --git a/products/rhel10/product.yml b/products/rhel10/product.yml index 6f502eef3e1e..1c8cfea0ccb8 100644 --- a/products/rhel10/product.yml +++ b/products/rhel10/product.yml @@ -21,6 +21,7 @@ init_system: "systemd" # EFI and non-EFI configs are stored in same path, see https://fedoraproject.org/wiki/Changes/UnifyGrubConfig sshd_distributed_config: "true" +bootable_containers_supported: "true" dconf_gdm_dir: "distro.d" diff --git a/products/rhel9/product.yml b/products/rhel9/product.yml index 30cbdeb0c229..eb0c0ac15ae5 100644 --- a/products/rhel9/product.yml +++ b/products/rhel9/product.yml @@ -25,6 +25,7 @@ groups: name: ssh_keys sshd_distributed_config: "true" +bootable_containers_supported: "true" dconf_gdm_dir: "distro.d" diff --git a/shared/templates/grub2_bootloader_argument/oval.template b/shared/templates/grub2_bootloader_argument/oval.template index 7159c5715972..ebcfbf891dbe 100644 --- a/shared/templates/grub2_bootloader_argument/oval.template +++ b/shared/templates/grub2_bootloader_argument/oval.template @@ -12,7 +12,6 @@ {{% set system_with_kernel_options_in_etc_default_grub_d = false -%}} {{% set system_with_expanded_kernel_options_in_grub_cfg = false -%}} {{% set system_with_bios_and_uefi_support = false -%}} -{{% set bootable_containers_supported = false %}} {{% if product in ["fedora", "ol9", "rhel9", "rhel10"] -%}} {{% set system_with_expanded_kernel_options_in_loader_entries = true %}} @@ -34,10 +33,6 @@ {{% set system_with_bios_and_uefi_support = true %}} {{%- endif -%}} -{{% if product in ["rhel9", "rhel10"] -%}} -{{% set bootable_containers_supported = true %}} -{{%- endif -%}} - {{{ oval_metadata("Ensure " + ARG_NAME_VALUE + " is configured in the kernel line in /etc/default/grub.") }}} @@ -114,7 +109,7 @@ {{%- endif %}} - {{% if bootable_containers_supported %}} + {{% if bootable_containers_supported == "true" %}} @@ -319,7 +314,7 @@ {{% endif %}} -{{% if bootable_containers_supported %}} +{{% if bootable_containers_supported == "true" %}} diff --git a/ssg/constants.py b/ssg/constants.py index f64c168495ad..baa5484df230 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -457,6 +457,7 @@ DEFAULT_CHRONY_D_PATH = '/etc/chrony.d/' DEFAULT_AUDISP_CONF_PATH = '/etc/audit' DEFAULT_SYSCTL_REMEDIATE_DROP_IN_FILE = 'false' +DEFAULT_BOOTABLE_CONTAINERS_SUPPORTED = 'false' # Constants for OVAL object model diff --git a/ssg/products.py b/ssg/products.py index 2c496689b9d2..7f3c360b92b9 100644 --- a/ssg/products.py +++ b/ssg/products.py @@ -20,6 +20,7 @@ DEFAULT_AUDISP_CONF_PATH, DEFAULT_FAILLOCK_PATH, DEFAULT_SYSCTL_REMEDIATE_DROP_IN_FILE, + DEFAULT_BOOTABLE_CONTAINERS_SUPPORTED, PKG_MANAGER_TO_SYSTEM, PKG_MANAGER_TO_CONFIG_FILE, XCCDF_PLATFORM_TO_PACKAGE, @@ -115,6 +116,9 @@ def _get_implied_properties(existing_properties): if "sysctl_remediate_drop_in_file" not in existing_properties: result["sysctl_remediate_drop_in_file"] = DEFAULT_SYSCTL_REMEDIATE_DROP_IN_FILE + if "bootable_containers_supported" not in existing_properties: + result["bootable_containers_supported"] = DEFAULT_BOOTABLE_CONTAINERS_SUPPORTED + return result diff --git a/tests/data/product_stability/alinux2.yml b/tests/data/product_stability/alinux2.yml index 1d0d21086e4e..5d78e56d1c09 100644 --- a/tests/data/product_stability/alinux2.yml +++ b/tests/data/product_stability/alinux2.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: ALINUX-2 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/alinux3.yml b/tests/data/product_stability/alinux3.yml index b9911b65b230..a35c8bc095af 100644 --- a/tests/data/product_stability/alinux3.yml +++ b/tests/data/product_stability/alinux3.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: ALINUX-3 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/anolis23.yml b/tests/data/product_stability/anolis23.yml index 5d075e1dbae0..5cf40e76f80f 100644 --- a/tests/data/product_stability/anolis23.yml +++ b/tests/data/product_stability/anolis23.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: ANOLIS-23 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/anolis8.yml b/tests/data/product_stability/anolis8.yml index 1234155c677a..6897ec95e56f 100644 --- a/tests/data/product_stability/anolis8.yml +++ b/tests/data/product_stability/anolis8.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: ANOLIS-8 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/chromium.yml b/tests/data/product_stability/chromium.yml index 988756f6b2af..cabfac582bb0 100644 --- a/tests/data/product_stability/chromium.yml +++ b/tests/data/product_stability/chromium.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: CHROMIUM benchmark_root: ./guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/debian11.yml b/tests/data/product_stability/debian11.yml index 781766106c0e..fd61f5233c53 100644 --- a/tests/data/product_stability/debian11.yml +++ b/tests/data/product_stability/debian11.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: DEBIAN-11 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/debian12.yml b/tests/data/product_stability/debian12.yml index e255f44fddaa..e97bfc39f9eb 100644 --- a/tests/data/product_stability/debian12.yml +++ b/tests/data/product_stability/debian12.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: DEBIAN-12 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/chrony.d/ cpes: diff --git a/tests/data/product_stability/eks.yml b/tests/data/product_stability/eks.yml index 8d5d75abbaae..c509b65d65c4 100644 --- a/tests/data/product_stability/eks.yml +++ b/tests/data/product_stability/eks.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: EKS benchmark_root: ../../applications +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/example.yml b/tests/data/product_stability/example.yml index d57b09f6bc8d..b0194b338bec 100644 --- a/tests/data/product_stability/example.yml +++ b/tests/data/product_stability/example.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: EXAMPLE benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ components_root: ../../components diff --git a/tests/data/product_stability/fedora.yml b/tests/data/product_stability/fedora.yml index 6e90589886b7..0b8886d55dfe 100644 --- a/tests/data/product_stability/fedora.yml +++ b/tests/data/product_stability/fedora.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: FEDORA benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ components_root: ../../components diff --git a/tests/data/product_stability/firefox.yml b/tests/data/product_stability/firefox.yml index d34ed55f33bd..843bedc1b55a 100644 --- a/tests/data/product_stability/firefox.yml +++ b/tests/data/product_stability/firefox.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: FIREFOX benchmark_root: ./guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/macos1015.yml b/tests/data/product_stability/macos1015.yml index c5be4ce23efe..ec7e7c1b9481 100644 --- a/tests/data/product_stability/macos1015.yml +++ b/tests/data/product_stability/macos1015.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: macOS-1015 benchmark_root: ../../apple_os/ +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/ocp4.yml b/tests/data/product_stability/ocp4.yml index fabaf4197331..8a791680945d 100644 --- a/tests/data/product_stability/ocp4.yml +++ b/tests/data/product_stability/ocp4.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: OCP-4 benchmark_root: ../../applications +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/ol7.yml b/tests/data/product_stability/ol7.yml index 6540a69e646e..a82c12ecf646 100644 --- a/tests/data/product_stability/ol7.yml +++ b/tests/data/product_stability/ol7.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: OL-7 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/ol8.yml b/tests/data/product_stability/ol8.yml index 3de5d9a3218d..5ff104357a23 100644 --- a/tests/data/product_stability/ol8.yml +++ b/tests/data/product_stability/ol8.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: OL-8 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/ol9.yml b/tests/data/product_stability/ol9.yml index 54f95e16db53..9cd20637ca14 100644 --- a/tests/data/product_stability/ol9.yml +++ b/tests/data/product_stability/ol9.yml @@ -10,6 +10,7 @@ auxiliary_key_fingerprint: 982231759C7467065D0CE9B2A7DD07088B4EFBE6 basic_properties_derived: true benchmark_id: OL-9 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/openembedded.yml b/tests/data/product_stability/openembedded.yml index c94f79d4c41e..dc88232705a6 100644 --- a/tests/data/product_stability/openembedded.yml +++ b/tests/data/product_stability/openembedded.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: OPENEMBEDDED benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/opensuse.yml b/tests/data/product_stability/opensuse.yml index bd26608bfcdb..ff9555f3abb5 100644 --- a/tests/data/product_stability/opensuse.yml +++ b/tests/data/product_stability/opensuse.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: OPENSUSE benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/rhcos4.yml b/tests/data/product_stability/rhcos4.yml index aabfed5ee078..cafb6b18c3ce 100644 --- a/tests/data/product_stability/rhcos4.yml +++ b/tests/data/product_stability/rhcos4.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: RHCOS-4 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/rhel8.yml b/tests/data/product_stability/rhel8.yml index be5057703047..61ed42a12857 100644 --- a/tests/data/product_stability/rhel8.yml +++ b/tests/data/product_stability/rhel8.yml @@ -10,6 +10,7 @@ auxiliary_key_fingerprint: 6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792 basic_properties_derived: true benchmark_id: RHEL-8 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' centos_major_version: '8' centos_pkg_release: 5ccc5b19 centos_pkg_version: 8483c65d diff --git a/tests/data/product_stability/rhel9.yml b/tests/data/product_stability/rhel9.yml index 839bc42a0307..1f4b5144bcdc 100644 --- a/tests/data/product_stability/rhel9.yml +++ b/tests/data/product_stability/rhel9.yml @@ -10,6 +10,7 @@ auxiliary_key_fingerprint: 7E4624258C406535D56D6F135054E4A45A6340B3 basic_properties_derived: true benchmark_id: RHEL-9 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'true' centos_major_version: '9' centos_pkg_release: 5ccc5b19 centos_pkg_version: 8483c65d diff --git a/tests/data/product_stability/rhv4.yml b/tests/data/product_stability/rhv4.yml index 1d023d032016..0746eeaa7d3e 100644 --- a/tests/data/product_stability/rhv4.yml +++ b/tests/data/product_stability/rhv4.yml @@ -10,6 +10,7 @@ auxiliary_key_fingerprint: 6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792 basic_properties_derived: true benchmark_id: RHV-4 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/sle12.yml b/tests/data/product_stability/sle12.yml index 870ac6482da8..2b0962bde5f3 100644 --- a/tests/data/product_stability/sle12.yml +++ b/tests/data/product_stability/sle12.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: SLE-12 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/sle15.yml b/tests/data/product_stability/sle15.yml index fb226b17f5c4..fca0213d418f 100644 --- a/tests/data/product_stability/sle15.yml +++ b/tests/data/product_stability/sle15.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: SLE-15 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony.conf chrony_d_path: /etc/chrony.d/ cpes: diff --git a/tests/data/product_stability/ubuntu1604.yml b/tests/data/product_stability/ubuntu1604.yml index 938835c6c644..b4288d197aab 100644 --- a/tests/data/product_stability/ubuntu1604.yml +++ b/tests/data/product_stability/ubuntu1604.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: UBUNTU-XENIAL benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/conf.d/ cpes: diff --git a/tests/data/product_stability/ubuntu1804.yml b/tests/data/product_stability/ubuntu1804.yml index b2cff15e15fb..176cd33d2978 100644 --- a/tests/data/product_stability/ubuntu1804.yml +++ b/tests/data/product_stability/ubuntu1804.yml @@ -7,6 +7,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: UBUNTU-BIONIC benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/conf.d/ cpes: diff --git a/tests/data/product_stability/ubuntu2004.yml b/tests/data/product_stability/ubuntu2004.yml index 17a596d37cd4..416270f9c8be 100644 --- a/tests/data/product_stability/ubuntu2004.yml +++ b/tests/data/product_stability/ubuntu2004.yml @@ -8,6 +8,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: UBUNTU_20-04 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/conf.d/ cpes: diff --git a/tests/data/product_stability/ubuntu2204.yml b/tests/data/product_stability/ubuntu2204.yml index e4a53f9749d3..4b0c515c1c61 100644 --- a/tests/data/product_stability/ubuntu2204.yml +++ b/tests/data/product_stability/ubuntu2204.yml @@ -8,6 +8,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: UBUNTU_22-04 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/conf.d/ cpes: diff --git a/tests/data/product_stability/ubuntu2404.yml b/tests/data/product_stability/ubuntu2404.yml index 50d4e232f1a9..62853e25cb5b 100644 --- a/tests/data/product_stability/ubuntu2404.yml +++ b/tests/data/product_stability/ubuntu2404.yml @@ -8,6 +8,7 @@ auid: 1000 basic_properties_derived: true benchmark_id: UBUNTU_24-04 benchmark_root: ../../linux_os/guide +bootable_containers_supported: 'false' chrony_conf_path: /etc/chrony/chrony.conf chrony_d_path: /etc/chrony/conf.d/ components_root: ../../components