Fix rule mount_option_nodev_nonroot_local_partitions Bash remediation

[evgenyz]

Description:

• Don't try to create an fstab entry for /proc/* mtab items.

Rationale:

• It is a problem because mtab could contain a line like /proc/cmdline /dev/mapper/rhel_rhel91-root[/var/cache/osbuild-worker/osbuild-store/tmp/osbuild-tmp-ahbt5omy/proc/cmdline] xfs ro,nosuid,nodev,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota which would end as a bogus fstab entry.

• Fixes Bash remediation against STIG for RHEL9 (maybe others) in Image Builder creates a bogus /etc/fstab entry #11795

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -3,7 +3,7 @@
 
 MOUNT_OPTION="nodev"
 # Create array of local non-root partitions
-readarray -t partitions_records < <(findmnt --mtab --raw --evaluate | grep "^/\w" | grep "\s/dev/\w")
+readarray -t partitions_records < <(findmnt --mtab --raw --evaluate | grep "^/\w" | grep -v "^/proc" | grep "\s/dev/\w")
 
 # Create array of polyinstantiated directories, in case one of them is found in mtab
 readarray -t polyinstantiated_dirs < \

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11827
This image was built from commit: 363c557

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11827

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11827 make deploy-local

[codeclimate]

Code Climate has analyzed commit 363c557 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.2% (0.0% change).

View more on Code Climate.

[Mab879]

Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/ComplianceAsCode/content/tests/logs/rule-custom-2024-04-16-1442/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script missing_multiple_nodev.fail.sh using profile (all) OK
INFO - Script missing_one_nodev.fail.sh using profile (all) OK
INFO - Script local_mounted_during_runtime.fail.sh using profile (all) OK
INFO - Script remote_without_nodev.pass.sh using profile (all) OK

Test pass locally.