Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow and use UUIDs for mount options and point remedations #12273

Open
Mab879 opened this issue Aug 6, 2024 · 2 comments
Open

Allow and use UUIDs for mount options and point remedations #12273

Mab879 opened this issue Aug 6, 2024 · 2 comments
Labels
Bash Bash remediation update.

Comments

@Mab879
Copy link
Member

Mab879 commented Aug 6, 2024

Share the context

RHEL (and other distros) by default use UUIDs to identify partitions and disks /etc/fstab this allows the system to be resilient and able to adapt to change if the devices are plugged into the system in a different order than when the system was installed.

Description of problem:

When our content adds mount options like nodev we replace the UUID with the device id of something like /dev/sda. This makes the system less resilient to change.

Proposed change:

Our remediation use UUID="..." vs /dev/sdX for remediation of mount points and mount options.

We can use files /dev/disk/by-uuid/ and similar to better help us figure what UUIDs to use in our remedations.

@Mab879 Mab879 added the enhancement General enhancements to the project. label Aug 6, 2024
@GitYukari
Copy link

This is a major problem, NOT an enhancement. It is causing systems to become unbootable and enter emergency mode (which is locked out per another STIG) after this STIG is applied if disks are attached or detached. This is also in violation of Red Hat's guidance, because they warn that using /dev/sdX is NOT persistent. This completely overwrites the UUID if fstab contains a UUID.

@Mab879
Copy link
Member Author

Mab879 commented Oct 10, 2024

Agreed, this is a bug.

I have removed the enhancement, label.

From my quick testing it appears that this only affects the bash remediation, not the Ansible. So for the time being it might better to use those.

@Mab879 Mab879 added Bash Bash remediation update. and removed enhancement General enhancements to the project. labels Oct 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bash Bash remediation update.
Projects
None yet
Development

No branches or pull requests

2 participants