update notes of the R36 requirement for ANSSI

[vojtapolasek]

Description:

• describe the reason why configuring umask for services is not automatable.

Rationale:

• ANSSI alignment

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11639

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11639

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11639 make deploy-local

[marcusburghardt]

The description is fine. I just wonder if the status could not be moved to "automated" instead of "partial". I understood that part of the requirement can be automated and part is manual. The part that can be automated is already automated. So, leaving the status as partial may create the impression that more automation is still possible and is pending.

[vojtapolasek]

I am glad you ask, because I had similar tendencies. But from the description of statuses in the devel guide, this was not clear for me. I suggest we update this guide to explicitly state that "automated" means that what could be automated with regards to the control, is automated. There might be cases when the control is phrased in a way so that it just can't be automated completely. I can do a separate PR if you agree.

[codeclimate]

Code Climate has analyzed commit ffceb64 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.8% (0.0% change).

View more on Code Climate.

[marcusburghardt]

I am glad you ask, because I had similar tendencies. But from the description of statuses in the devel guide, this was not clear for me. I suggest we update this guide to explicitly state that "automated" means that what could be automated with regards to the control, is automated. There might be cases when the control is phrased in a way so that it just can't be automated completely. I can do a separate PR if you agree.

Sure, it would be good to clarify how to proceed in cases like this in the Devel Guide. I don't think we have many similar cases, but when we have, an agreement on how to proceed would be good.

[marcusburghardt]

LGTM. We discussed an update in Devel Guide to clarify how to proceed with the status field when everything possible to be automated is already automated but part of the same requirement is manual.