FMF plans and CI machine hardening tests

[mildas]

Description:

New hardening tests introduced via separate FMF plans to isolate them from other tests. Hardening tests are isolated because they are destructive.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[jan-cerny]

@mildas any plans?

[mildas]

@jan-cerny This PR is not meant to be merged. It's only for polishing CI tests to be ready for Testing Farm. When test is in good shape, it will get packit tag and then this PR will be closed.

[matusmarhefka]

I looked into failures on CS9:

• file_permissions_etc_audit_rulesd - known issue, Rule file_permissions_etc_audit_rulesd gets broken by some other remediation #8947
• no_empty_passwords - known issue, Couple of PAM rules fail on RHEL9 during kickstart installation #8857
• accounts_user_interactive_home_directory_defined - reported a new issue, accounts_user_interactive_home_directory_defined OVAL regex needs update #9042
• usbguard_generate_policy - new issue found, rule does not work correctly when system has no usb bus, we can fix it by updating our remediation to either add a comment into /etc/usbguard/rules.conf or add a "reject all" rule into the config file as there won't be any usb devices connected to such system - fixed by usbguard_generate_policy: handle also systems without USBs #9059

Btw TF uses ec2 images from https://cloud.centos.org/centos/9-stream/x86_64/images/ and https://cloud.centos.org/centos/8-stream/x86_64/images/ and installs beakerlib from the upstream repo (https://copr.fedorainfracloud.org/coprs/packit/beakerlib-beakerlib-master/). After downloading image:

unxz CentOS-Stream-ec2-9-20220621.1.x86_64.raw.xz
mv CentOS-Stream-ec2-9-20220621.1.x86_64.raw CentOS-Stream-ec2-9-20220621.1.x86_64.qcow2
virt-customize -a CentOS-Stream-ec2-9-20220621.1.x86_64.qcow2 --root-password password:root

[matusmarhefka]

CS8 failures:

• configure_bashrc_exec_tmux - known issue, configure_bashrc_exec_tmux failing after remediation #8913
• file_permissions_etc_audit_rulesd - known issue, Rule file_permissions_etc_audit_rulesd gets broken by some other remediation #8947
• no_empty_passwords - known issue, Couple of PAM rules fail on RHEL9 during kickstart installation #8857
• usbguard_generate_policy - new issue found, rule does not work correctly when system has no usb bus, we can fix it by updating our remediation to either add a comment into /etc/usbguard/rules.conf or add a "reject all" rule into the config file as there won't be any usb devices connected to such system - should be fixed by usbguard_generate_policy: handle also systems without USBs #9059
• bios_enable_execution_restrictions - function pcre_exec returns code -10 which corresponds to PCRE_ERROR_BADUTF8 - there are some characters in /var/log/messages which have different encoding than UTF8 - no longer occurs in the latest results

[codeclimate]

Code Climate has analyzed commit 2bcc1ca and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 42.7% (0.0% change).

View more on Code Climate.

[matusmarhefka]

Test plans and results look great, thanks!