Specify platform specific packages for xwindows_remove_packages rule #12853

teacup-on-rockingchair · 2025-01-19T11:06:17Z

Description:

Specify SLE12/SLE15 platform specific packages for xwindows_remove_packages rule

Rationale:

Define specific packages for xwindows_remove_packages rule
Drop xwindows_remove_packages from slmicro5 platform as irrelevant, as SLE MicroOS doesn't have xorg or xwayland packages by default
Fixes Review packages in xwindows_remove_packages rule #12394 for SLE context

github-actions · 2025-01-19T11:07:43Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2025-01-19T11:10:35Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages'.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -3,15 +3,13 @@
 Disable graphical user interface
 
 [description]:
-By removing the following packages,  the system no longer has X Windows installed.
-
-xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
+By removing the following packages, the system no longer has X Windows installed.
+['xorg-x11-server-Xorg', 'xorg-x11-server-common', 'xorg-x11-server-utils', 'xorg-x11-server-Xwayland']
 
 If X Windows is not installed then the system cannot boot into graphical user mode.
 This prevents the system from being accidentally or maliciously booted into a graphical.target
 mode. To do so, run the following command:
-
-sudo yum remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
+sudo yum remove ['xorg-x11-server-Xorg', 'xorg-x11-server-common', 'xorg-x11-server-utils', 'xorg-x11-server-Xwayland']
 
 [warning]:
 The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your
@@ -42,8 +40,8 @@
 SV-230553r1017315_rule
 
 [rationale]:
-Unnecessary service packages must not be installed to decrease the attack surface of the system. X windows has a long history of security
-vulnerabilities and should not be installed unless approved and documented.
+Unnecessary service packages must not be installed to decrease the attack surface of the system.
+X windows has a long history of security vulnerabilities and should not be installed unless approved and documented.
 
 [ident]:
 CCE-83411-9

OVAL for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- oval:ssg-xwindows_remove_packages:def:1
+++ oval:ssg-xwindows_remove_packages:def:1
@@ -1,5 +1,5 @@
 criteria AND
-criterion oval:ssg-package_xorg-x11-server-Xorg_removed:tst:1
-extend_definition oval:ssg-package_xorg-x11-server-common_removed:def:1
-criterion oval:ssg-package_xorg-x11-server-utils_removed:tst:1
-criterion oval:ssg-package_xorg-x11-server-Xwayland_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-Xorg_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-common_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-utils_removed:tst:1
+criterion oval:ssg-test_package_xorg-x11-server-Xwayland_removed:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1
+++ ocil:ssg-xwindows_remove_packages_ocil:questionnaire:1
@@ -1,7 +1,5 @@
 To ensure the X Windows package group is removed, run the following command:
-
-$ rpm -qi xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland
-
+$ rpm -qi ['xorg-x11-server-Xorg', 'xorg-x11-server-common', 'xorg-x11-server-utils', 'xorg-x11-server-Xwayland']
 For each package mentioned above you should receive following line:
 package <package> is not installed
       Is it the case that xorg related packages are not removed and run level is not correctly configured?

bash remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,14 +1,16 @@
-
 
 # remove packages
+
 if rpm -q --quiet "xorg-x11-server-Xorg" ; then
 yum remove -y "xorg-x11-server-Xorg"
 fi
+
+if rpm -q --quiet "xorg-x11-server-common" ; then
+yum remove -y "xorg-x11-server-common"
+fi
+
 if rpm -q --quiet "xorg-x11-server-utils" ; then
 yum remove -y "xorg-x11-server-utils"
-fi
-if rpm -q --quiet "xorg-x11-server-common" ; then
-yum remove -y "xorg-x11-server-common"
 fi
 
 if rpm -q --quiet "xorg-x11-server-Xwayland" ; then

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,10 +1,6 @@
-- name: Ensure xorg packages are removed
+- name: Ensure xorg-x11-server-Xorg is removed
   package:
-    name:
-    - xorg-x11-server-Xorg
-    - xorg-x11-server-common
-    - xorg-x11-server-utils
-    - xorg-x11-server-Xwayland
+    name: xorg-x11-server-Xorg
     state: absent
   tags:
   - CCE-83411-9
@@ -16,3 +12,48 @@
   - reboot_required
   - restrict_strategy
   - xwindows_remove_packages
+
+- name: Ensure xorg-x11-server-common is removed
+  package:
+    name: xorg-x11-server-common
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages
+
+- name: Ensure xorg-x11-server-utils is removed
+  package:
+    name: xorg-x11-server-utils
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages
+
+- name: Ensure xorg-x11-server-Xwayland is removed
+  package:
+    name: xorg-x11-server-Xwayland
+    state: absent
+  tags:
+  - CCE-83411-9
+  - DISA-STIG-RHEL-08-040320
+  - NIST-800-53-CM-6(b)
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - reboot_required
+  - restrict_strategy
+  - xwindows_remove_packages

anaconda remediation for rule 'xccdf_org.ssgproject.content_rule_xwindows_remove_packages' differs.
--- xccdf_org.ssgproject.content_rule_xwindows_remove_packages
+++ xccdf_org.ssgproject.content_rule_xwindows_remove_packages
@@ -1,2 +1,10 @@
 
-package --remove=xorg-x11-server-Xorg --remove=xorg-x11-server-common --remove=xorg-x11-server-utils --remove=xorg-x11-server-Xwayland
+# remove packages
+
+package --remove=xorg-x11-server-Xorg
+
+package --remove=xorg-x11-server-common
+
+package --remove=xorg-x11-server-utils
+
+package --remove=xorg-x11-server-Xwayland

jan-cerny

I think that this is a lot of code duplication. You should centralize the definition of the xwindows_packages to a single place. That will make it easier to change or extend in future. I suggest defining it as a product property.

We don't have xorg or xwayland packages in the default repos there anyways

…s_remove_packages rule

@jan-cerny

Thanks to @jan-cerny for the hint 🙇

codeclimate · 2025-02-04T14:32:17Z

Code Climate has analyzed commit 73fe970 and detected 1 issue on this pull request.

Here's the issue category breakdown:

Category	Count
Style	1

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

Xeicker · 2025-02-04T16:29:41Z

linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/oval/shared.xml

@@ -1,24 +1,25 @@
+
+{{% if product in ["sle12", "sle15"] %}}
+{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}


Now that you made this variable at product level, this is not required

Xeicker · 2025-02-04T16:31:16Z

linux_os/guide/services/xwindows/xwindows_base_packages.var

@@ -0,0 +1,24 @@
+documentation_complete: true


I think this file is some remains of a different approach you were trying

Xeicker · 2025-02-04T16:32:20Z

linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml

@@ -1,27 +1,27 @@
-documentation_complete: true
+{{% if product in ["sle12", "sle15"] %}}
+{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}


Also this variable set is not needed

teacup-on-rockingchair added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. Update Rule Issues or pull requests related to Rules updates. labels Jan 19, 2025

teacup-on-rockingchair added this to the 0.1.76 milestone Jan 20, 2025

jan-cerny requested changes Jan 20, 2025

View reviewed changes

jan-cerny self-assigned this Jan 20, 2025

teacup-on-rockingchair added 6 commits January 28, 2025 16:53

Specify platform specific packages for xwindows_packages rule

0b0f972

Drop xwindows_remove_packages from slmicro5 platform as irrelevant

a18a7a6

We don't have xorg or xwayland packages in the default repos there anyways

Create variable with default xwindows packages in relation to xwindow…

c4efa10

…s_remove_packages rule

Add per products ol7,sle12 and sle15 definition for xwindows_packages

182a88e

Drop code duplication in favour of product variable

297192c

Thanks to @jan-cerny for the hint 🙇

Update products stability data

73fe970

teacup-on-rockingchair force-pushed the fix_xwindows_remove_pakcakage_sle branch from ba29a71 to 73fe970 Compare February 4, 2025 14:04

teacup-on-rockingchair requested review from a team as code owners February 4, 2025 14:04

vojtapolasek modified the milestones: 0.1.76, 0.1.77 Feb 4, 2025

Xeicker requested changes Feb 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Specify platform specific packages for xwindows_remove_packages rule #12853

Specify platform specific packages for xwindows_remove_packages rule #12853

teacup-on-rockingchair commented Jan 19, 2025

github-actions bot commented Jan 19, 2025

github-actions bot commented Jan 19, 2025 •

edited

Loading

jan-cerny left a comment

codeclimate bot commented Feb 4, 2025

Xeicker Feb 4, 2025

Xeicker Feb 4, 2025

Xeicker Feb 4, 2025

		@@ -1,24 +1,25 @@

		{{% if product in ["sle12", "sle15"] %}}
		{{% set xwindows_packages = ['xorg-x11-server', 'xorg-x11-server-extra', 'xorg-x11-server-Xvfb', 'xwayland'] %}}

Specify platform specific packages for xwindows_remove_packages rule #12853

Are you sure you want to change the base?

Specify platform specific packages for xwindows_remove_packages rule #12853

Conversation

teacup-on-rockingchair commented Jan 19, 2025

Description:

Rationale:

github-actions bot commented Jan 19, 2025

github-actions bot commented Jan 19, 2025 • edited Loading

jan-cerny left a comment

Choose a reason for hiding this comment

codeclimate bot commented Feb 4, 2025

Xeicker Feb 4, 2025

Choose a reason for hiding this comment

Xeicker Feb 4, 2025

Choose a reason for hiding this comment

Xeicker Feb 4, 2025

Choose a reason for hiding this comment

github-actions bot commented Jan 19, 2025 •

edited

Loading