grub2_vsyscall_argument should only be applicable to x86_64

[matusmarhefka]

The vsyscall emulation is only available on x86_64 architecture (CONFIG_X86_VSYSCALL_EMULATION) making this rule not applicable to other CPU architectures.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument'.
--- xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
+++ xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
@@ -12,6 +12,11 @@
 /etc/default/grub as shown below:
 GRUB_CMDLINE_LINUX="... vsyscall=none ..."
 Run the following command to update command line for already installed kernels:# grubby --update-kernel=ALL --args="vsyscall=none"
+
+[warning]:
+The vsyscall emulation is only available on x86_64 architecture
+(CONFIG_X86_VSYSCALL_EMULATION) making this rule not applicable
+to other CPU architectures.
 
 [reference]:
 CCI-001084

bash remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
+++ xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && { ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && grep -q x86_64 /proc/sys/kernel/osrelease ); }; then
 
 grubby --update-kernel=ALL --args=vsyscall=none --env=/boot/grub2/grubenv
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument' differs.
--- xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
+++ xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
@@ -16,7 +16,8 @@
   command: /sbin/grubby --update-kernel=ALL --args="vsyscall=none"
   when:
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+    and ansible_architecture == "x86_64" )
   tags:
   - CCE-80946-7
   - DISA-STIG-RHEL-08-010422

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument'
--- xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
+++ xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument
@@ -1 +1,2 @@
 oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-proc_sys_kernel_osrelease_arch_x86_64:def:1

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12408
This image was built from commit: 7099fce

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12408

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12408 make deploy-local

[codeclimate]

Code Climate has analyzed commit 7099fce and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

[Mab879]

Waving Automatus tests as they pass locally.

[Mab879]

Thanks!