Support drop-in config in journald rules on RHEL

[jan-cerny]

This patch adds support for the drop-in configuration files in directory /etc/systemd/journald.conf.d/ to these rules configuring journald:

• journald_compress
• journald_forward_to_syslog
• journald_storage

This patch levarages the systemd_dropin_configuration template that is already in use on SLES 15.

This patch also adds some test scenarios for the
systemd_dropin_configuration template and fixes issues revealed by these test scenarios.

Resolves: https://issues.redhat.com/browse/RHEL-14484

This PR is a replacement of #11431. I have created a new PR to avoid unnecessary requests to review from CODEOWNERS which would complicate the review process.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- oval:ssg-journald_compress:def:1
+++ oval:ssg-journald_compress:def:1
@@ -1,2 +1,3 @@
 criteria OR
 criterion oval:ssg-test_journald_compress:tst:1
+criterion oval:ssg-test_journald_compress_dropin_file:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- ocil:ssg-journald_compress_ocil:questionnaire:1
+++ ocil:ssg-journald_compress_ocil:questionnaire:1
@@ -1,7 +1,8 @@
 Storing logs with compression can help avoid filling the system disk.
 Run the following command to verify that journald is compressing logs.
 
-grep "^\sCompress" /etc/systemd/journald.conf
+grep "^\sCompress" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
 
 and it should return
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- xccdf_org.ssgproject.content_rule_journald_compress
+++ xccdf_org.ssgproject.content_rule_journald_compress
@@ -1,29 +1,46 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-if [ -e "/etc/systemd/journald.conf" ] ; then
-    
-    LC_ALL=C sed -i "/^\s*Compress\s*=\s*/d" "/etc/systemd/journald.conf"
-else
-    touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_Compress_configuration {
+    local COMPONENT_PARAM_CONFIG
+    mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+    COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
 
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*Compress'.
-line_number="$(LC_ALL=C grep -n "^#\s*Compress" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
-    # There was no match of '^#\s*Compress', insert at
-    # the end of the file.
-    printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
-else
-    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
-    printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
-    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+    for f in "${COMPONENT_PARAM_CONFIG[@]}"
+    do
+        sed -i "/^\s*Compress\s*=\s*/d" "$f"
+        # make sure file has newline at the end
+        sed -i -e '$a\' "$f"
+    done
+    sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_Compress_add_configuration {
+    local COMPONENT_PARAM_REMEDY_CFG
+    mkdir -p "/etc/systemd/journald.conf.d"
+    COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+    if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+        touch "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+    # Insert before the line matching the regex '^#\s*Compress'.
+    line_number="$(LC_ALL=C grep -n "^#\s*Compress" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+    if [ -z "$line_number" ]; then
+       # There was no match of '^#\s*Compress', insert at
+       # the end of the file.
+       printf '%s\n' "Compress=yes" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    else
+        head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+        printf '%s\n' "Compress=yes" >> "/etc/systemd/journald.conf"
+        tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    # Clean up after ourselves.
+    rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_Compress_configuration
+journald_Compress_add_configuration
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_compress' differs.
--- xccdf_org.ssgproject.content_rule_journald_compress
+++ xccdf_org.ssgproject.content_rule_journald_compress
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'Compress' to 'yes' in '/etc/systemd/journald.conf'
-  block:
-
-  - name: Check for duplicate values
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Compress=
-      state: absent
-    check_mode: true
-    changed_when: false
-    register: dupes
-
-  - name: Deduplicate values from /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Compress=
-      state: absent
-    when: dupes.found is defined and dupes.found > 1
-
-  - name: Insert correct line to /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Compress=
-      line: Compress=yes
-      state: present
-      insertbefore: ^# Compress
-      validate: /usr/bin/bash -n %s
+- name: Check for duplicate Compress values in master journald configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*Compress=
+    state: absent
+  check_mode: true
+  changed_when: false
+  register: dupes_master
   when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   tags:
   - CCE-85930-6
@@ -37,3 +16,73 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+
+- name: Deduplicate Compress values from journald master configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*Compress=
+    state: absent
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - dupes_master.found is defined and dupes_master.found > 1
+  tags:
+  - CCE-85930-6
+  - journald_compress
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Collect all config journald files which configure Compress
+  ansible.builtin.find:
+    paths: /etc/systemd/journald.conf.d
+    contains: ^[\s]*Compress=.*$
+    patterns: '*.conf'
+  register: journald_Compress_dropin_config_files
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85930-6
+  - journald_compress
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Deduplicate values from journald Compress dropin configuration
+  ansible.builtin.lineinfile:
+    path: '{{ item.path }}'
+    create: false
+    regexp: ^\s*Compress=
+    state: absent
+  loop: '{{  journald_Compress_dropin_config_files.files }}'
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85930-6
+  - journald_compress
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Insert correct line to journald Compress configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+    create: true
+    regexp: ^\s*Compress=
+    line: Compress=yes
+    state: present
+    insertbefore: ^# Compress
+    validate: bash -n %s
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85930-6
+  - journald_compress
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy

OVAL for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- oval:ssg-journald_forward_to_syslog:def:1
+++ oval:ssg-journald_forward_to_syslog:def:1
@@ -1,2 +1,3 @@
 criteria OR
 criterion oval:ssg-test_journald_forward_to_syslog:tst:1
+criterion oval:ssg-test_journald_forward_to_syslog_dropin_file:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- ocil:ssg-journald_forward_to_syslog_ocil:questionnaire:1
+++ ocil:ssg-journald_forward_to_syslog_ocil:questionnaire:1
@@ -1,7 +1,8 @@
 Storing logs remotely protects the integrity of the data from local attacks.
 Run the following command to verify that journald is forwarding logs to a remote host.
 
-grep "^\sForwardToSyslog" /etc/systemd/journald.conf
+grep "^\sForwardToSyslog" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
 
 and it should return
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
+++ xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
@@ -1,29 +1,46 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-if [ -e "/etc/systemd/journald.conf" ] ; then
-    
-    LC_ALL=C sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "/etc/systemd/journald.conf"
-else
-    touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_ForwardToSyslog_configuration {
+    local COMPONENT_PARAM_CONFIG
+    mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+    COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
 
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*ForwardToSyslog'.
-line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
-    # There was no match of '^#\s*ForwardToSyslog', insert at
-    # the end of the file.
-    printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
-else
-    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
-    printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
-    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+    for f in "${COMPONENT_PARAM_CONFIG[@]}"
+    do
+        sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "$f"
+        # make sure file has newline at the end
+        sed -i -e '$a\' "$f"
+    done
+    sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_ForwardToSyslog_add_configuration {
+    local COMPONENT_PARAM_REMEDY_CFG
+    mkdir -p "/etc/systemd/journald.conf.d"
+    COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+    if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+        touch "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+    # Insert before the line matching the regex '^#\s*Compress'.
+    line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+    if [ -z "$line_number" ]; then
+       # There was no match of '^#\s*ForwardToSyslog', insert at
+       # the end of the file.
+       printf '%s\n' "ForwardToSyslog=yes" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    else
+        head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+        printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
+        tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    # Clean up after ourselves.
+    rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_ForwardToSyslog_configuration
+journald_ForwardToSyslog_add_configuration
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_forward_to_syslog' differs.
--- xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
+++ xccdf_org.ssgproject.content_rule_journald_forward_to_syslog
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'ForwardToSyslog' to 'yes' in '/etc/systemd/journald.conf'
-  block:
-
-  - name: Check for duplicate values
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*ForwardToSyslog=
-      state: absent
-    check_mode: true
-    changed_when: false
-    register: dupes
-
-  - name: Deduplicate values from /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*ForwardToSyslog=
-      state: absent
-    when: dupes.found is defined and dupes.found > 1
-
-  - name: Insert correct line to /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*ForwardToSyslog=
-      line: ForwardToSyslog=yes
-      state: present
-      insertbefore: ^# ForwardToSyslog
-      validate: /usr/bin/bash -n %s
+- name: Check for duplicate ForwardToSyslog values in master journald configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*ForwardToSyslog=
+    state: absent
+  check_mode: true
+  changed_when: false
+  register: dupes_master
   when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   tags:
   - CCE-85995-9
@@ -37,3 +16,73 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+
+- name: Deduplicate ForwardToSyslog values from journald master configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*ForwardToSyslog=
+    state: absent
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - dupes_master.found is defined and dupes_master.found > 1
+  tags:
+  - CCE-85995-9
+  - journald_forward_to_syslog
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Collect all config journald files which configure ForwardToSyslog
+  ansible.builtin.find:
+    paths: /etc/systemd/journald.conf.d
+    contains: ^[\s]*ForwardToSyslog=.*$
+    patterns: '*.conf'
+  register: journald_ForwardToSyslog_dropin_config_files
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85995-9
+  - journald_forward_to_syslog
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Deduplicate values from journald ForwardToSyslog dropin configuration
+  ansible.builtin.lineinfile:
+    path: '{{ item.path }}'
+    create: false
+    regexp: ^\s*ForwardToSyslog=
+    state: absent
+  loop: '{{  journald_ForwardToSyslog_dropin_config_files.files }}'
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85995-9
+  - journald_forward_to_syslog
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Insert correct line to journald ForwardToSyslog configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+    create: true
+    regexp: ^\s*ForwardToSyslog=
+    line: ForwardToSyslog=yes
+    state: present
+    insertbefore: ^# ForwardToSyslog
+    validate: bash -n %s
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-85995-9
+  - journald_forward_to_syslog
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy

OVAL for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- oval:ssg-journald_storage:def:1
+++ oval:ssg-journald_storage:def:1
@@ -1,2 +1,3 @@
 criteria OR
 criterion oval:ssg-test_journald_storage:tst:1
+criterion oval:ssg-test_journald_storage_dropin_file:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- ocil:ssg-journald_storage_ocil:questionnaire:1
+++ ocil:ssg-journald_storage_ocil:questionnaire:1
@@ -1,7 +1,8 @@
 Storing logs with persistent storage ensures they are available after a reboot or system crash.
 Run the command below to verify that logs are being persistently stored to disk.
 
-grep "^\sStorage" /etc/systemd/journald.conf
+grep "^\sStorage" /etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf
+
 
 and it should return
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- xccdf_org.ssgproject.content_rule_journald_storage
+++ xccdf_org.ssgproject.content_rule_journald_storage
@@ -1,29 +1,46 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-if [ -e "/etc/systemd/journald.conf" ] ; then
-    
-    LC_ALL=C sed -i "/^\s*Storage\s*=\s*/d" "/etc/systemd/journald.conf"
-else
-    touch "/etc/systemd/journald.conf"
-fi
-# make sure file has newline at the end
-sed -i -e '$a\' "/etc/systemd/journald.conf"
+function remove_journald_Storage_configuration {
+    local COMPONENT_PARAM_CONFIG
+    mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)
+    COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
 
-cp "/etc/systemd/journald.conf" "/etc/systemd/journald.conf.bak"
-# Insert before the line matching the regex '^#\s*Storage'.
-line_number="$(LC_ALL=C grep -n "^#\s*Storage" "/etc/systemd/journald.conf.bak" | LC_ALL=C sed 's/:.*//g')"
-if [ -z "$line_number" ]; then
-    # There was no match of '^#\s*Storage', insert at
-    # the end of the file.
-    printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
-else
-    head -n "$(( line_number - 1 ))" "/etc/systemd/journald.conf.bak" > "/etc/systemd/journald.conf"
-    printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
-    tail -n "+$(( line_number ))" "/etc/systemd/journald.conf.bak" >> "/etc/systemd/journald.conf"
-fi
-# Clean up after ourselves.
-rm "/etc/systemd/journald.conf.bak"
+    for f in "${COMPONENT_PARAM_CONFIG[@]}"
+    do
+        sed -i "/^\s*Storage\s*=\s*/d" "$f"
+        # make sure file has newline at the end
+        sed -i -e '$a\' "$f"
+    done
+    sed -i -e '$a\' "/etc/systemd/journald.conf"
+}
+
+function journald_Storage_add_configuration {
+    local COMPONENT_PARAM_REMEDY_CFG
+    mkdir -p "/etc/systemd/journald.conf.d"
+    COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"
+
+    if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
+        touch "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+    # Insert before the line matching the regex '^#\s*Compress'.
+    line_number="$(LC_ALL=C grep -n "^#\s*Storage" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
+    if [ -z "$line_number" ]; then
+       # There was no match of '^#\s*Storage', insert at
+       # the end of the file.
+       printf '%s\n' "Storage=persistent" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    else
+        head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
+        printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
+        tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
+    fi
+    # Clean up after ourselves.
+    rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
+}
+
+remove_journald_Storage_configuration
+journald_Storage_add_configuration
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_journald_storage' differs.
--- xccdf_org.ssgproject.content_rule_journald_storage
+++ xccdf_org.ssgproject.content_rule_journald_storage
@@ -1,33 +1,12 @@
-- name: Setting unquoted shell-style assignment of 'Storage' to 'persistent' in '/etc/systemd/journald.conf'
-  block:
-
-  - name: Check for duplicate values
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Storage=
-      state: absent
-    check_mode: true
-    changed_when: false
-    register: dupes
-
-  - name: Deduplicate values from /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Storage=
-      state: absent
-    when: dupes.found is defined and dupes.found > 1
-
-  - name: Insert correct line to /etc/systemd/journald.conf
-    lineinfile:
-      path: /etc/systemd/journald.conf
-      create: true
-      regexp: ^\s*Storage=
-      line: Storage=persistent
-      state: present
-      insertbefore: ^# Storage
-      validate: /usr/bin/bash -n %s
+- name: Check for duplicate Storage values in master journald configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*Storage=
+    state: absent
+  check_mode: true
+  changed_when: false
+  register: dupes_master
   when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   tags:
   - CCE-86045-2
@@ -37,3 +16,73 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+
+- name: Deduplicate Storage values from journald master configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf
+    create: false
+    regexp: ^\s*Storage=
+    state: absent
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - dupes_master.found is defined and dupes_master.found > 1
+  tags:
+  - CCE-86045-2
+  - journald_storage
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Collect all config journald files which configure Storage
+  ansible.builtin.find:
+    paths: /etc/systemd/journald.conf.d
+    contains: ^[\s]*Storage=.*$
+    patterns: '*.conf'
+  register: journald_Storage_dropin_config_files
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-86045-2
+  - journald_storage
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Deduplicate values from journald Storage dropin configuration
+  ansible.builtin.lineinfile:
+    path: '{{ item.path }}'
+    create: false
+    regexp: ^\s*Storage=
+    state: absent
+  loop: '{{  journald_Storage_dropin_config_files.files }}'
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-86045-2
+  - journald_storage
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy
+
+- name: Insert correct line to journald Storage configuration
+  ansible.builtin.lineinfile:
+    path: /etc/systemd/journald.conf.d/oscap-remedy.conf
+    create: true
+    regexp: ^\s*Storage=
+    line: Storage=persistent
+    state: present
+    insertbefore: ^# Storage
+    validate: bash -n %s
+  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  tags:
+  - CCE-86045-2
+  - journald_storage
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - restrict_strategy

[codeclimate]

Code Climate has analyzed commit 06d6189 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5% (0.0% change).

View more on Code Climate.

[vojtapolasek]

LGTM, thank you very much.

[jan-cerny]

@teacup-on-rockingchair please take a look into this one

[teacup-on-rockingchair]

Nice improvement 👍