SCAP scan fails for RHEL-07-040160 (TMOUT)

[danbarr]

Describe the Issue
A SCAP scan fails on STIG ID RHEL-07-040160. The issue is that the STIG check text looks specifically for the syntax declare -xr TMOUT=900 in /etc/profile.d/tmout.sh, but the task doesn't use "declare", instead it sets the variable then uses readonly and export separately.

The end result is functional / as intended, just doesn't match the check in the DISA SCAP file for v3r5.

Expected Behavior
Rule should pass a scan.

Actual Behavior
Rule fails the scan because the expected syntax is not found.

Environment
Scanned using SCC 5.4.2 using U_RHEL_7_V3R5_STIG_SCAP_1-2_Benchmark.xml

Control(s) Affected
RHEL-07-040160

Possible Solution
Update fix-cat2.yml:

RHEL7-STIG/tasks/fix-cat2.yml

Lines 2806 to 2810 in 7eb9d55

	block: |
	# Set session timeout - STIG ID RHEL-07-040160
	TMOUT={{ rhel7stig_shell_session_timeout.timeout }}
	readonly TMOUT
	export TMOUT

With:

      block: |
        # Set session timeout - STIG ID RHEL-07-040160
        declare -xr TMOUT={{ rhel7stig_shell_session_timeout.timeout }}

[uk-bolly]

hi @danbarr

Thanks as always for the feedback and #398 , as you know feedback and details like these help immensely to improve these benchmarks.

Should be merged by the end of the month.

uk-bolly