Add ubuntu ansible remediation for dconf_gnome_banner_enabled

[yunimoo]

Description:

• The remediation was modified to enable the banner also in greeter.dconf-defaults and not only in the dconf database, specifically for Ubuntu products.
• This is to be consistent with the remediation in related rule dconf_gnome_login_banner_text and be better aligned with STIG V1R1.
• I will slowly start reopening UBTU20 PRs under new account

Original PR: #11089
Present Bash Remediation: #12042

Rationale:

• Missing ansible remediation
• Align existing ansible remediation tasks to proper format
• Part of Ubuntu 2004 STIG v1r12 profile upgrade

Review Hints:

Build the product:

./build_product ubuntu2004

To test these changes with Ansible:

ansible-playbook build/ansible/ubuntu2004-playbook-stig.yml --tags "DISA-STIG-UBTU-20-010002"

Checkout Manual STIG OVAL definitions, and use software like DISA STIG Viewer to view definitions.

git checkout yunimoo:update-manual-stig-ubtu-20-v1r12

For reference, please review the latest artifacts: https://public.cyber.mil/stigs/downloads/

[openshift-ci]

Hi @yunimoo. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
@@ -15,7 +15,7 @@
   - no_reboot_needed
   - unknown_strategy
 
-- name: Enable GNOME3 Login Warning Banner
+- name: Enable GNOME3 Login Warning Banner - Enable GNOME3 Login Warning Banner
   ini_file:
     dest: /etc/dconf/db/gdm.d/00-security-settings
     section: org/gnome/login-screen
@@ -38,7 +38,7 @@
   - no_reboot_needed
   - unknown_strategy
 
-- name: Prevent user modification of GNOME banner-message-enabled
+- name: Enable GNOME3 Login Warning Banner - Prevent user modification of GNOME banner-message-enabled
   lineinfile:
     path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
     regexp: ^/org/gnome/login-screen/banner-message-enable$
@@ -59,7 +59,7 @@
   - no_reboot_needed
   - unknown_strategy
 
-- name: Dconf Update
+- name: Enable GNOME3 Login Warning Banner - Dconf Update
   command: dconf update
   when: '"gdm" in ansible_facts.packages'
   tags:

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12292
This image was built from commit: 01c96c4

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12292

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12292 make deploy-local

[dodys]

Hi @yunimoo could you please rebase your PR based on latest master? That way we will get the Ubuntu tests running.

[dodys]

@yunimoo the ansible remediation is not passing the tests, could you take a look?

[yunimoo]

@yunimoo the ansible remediation is not passing the tests, could you take a look?

Sure. I haven't had much bandwidth these past days but I'm noticing these errors are not the same as ones noted #12296. I'm able to spin up my containers for ubuntu 22.04 so will slowly start fixing any potential problems with tests.

[yunimoo]

Rebased this branch and removed content_profile_ncp which seemed to be giving some warnings. All ubuntu22 tests are passing for me locally

[codeclimate]

Code Climate has analyzed commit 01c96c4 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

[dodys]

Rebased this branch and removed content_profile_ncp which seemed to be giving some warnings. All ubuntu22 tests are passing for me locally

@yunimoo no need to remove the content_profile_ncp unless you think that the test is worth to all platforms and there aren't any similar already. But the tests are still failing for the ansible remediation.

[yunimoo]

Rebased this branch and removed content_profile_ncp which seemed to be giving some warnings. All ubuntu22 tests are passing for me locally

@yunimoo no need to remove the content_profile_ncp unless you think that the test is worth to all platforms and there aren't any similar already. But the tests are still failing for the ansible remediation.

Ah, thank you. I was going about this incorrectly. Let me fix up the remediation script.

ERROR - Ansible playbook remediation run has exited with return code 2 instead of expected 0