test scenarios for firewalld_sshd_port_enabled are failing on RHEL 8.6

[vojtapolasek]

Description of problem:

There are test scenarios which should make the rule firewalld_sshd_port_enabled fail. But the rule passes when they are executed.

• customized_zone_without_ssh.fail.sh
• new_zone_without_ssh.fail.sh
• only_nics_configured.fail.sh

SCAP Security Guide Version:

stabilization-v0.1.73, commit 0b096bc

Operating System Version:

RHEL 8.6

Steps to Reproduce:

1. ./build_product rhel8
2. cd tests/
3. python automatus.py rule --libvirt qemu:///system <domain_name> --remediate-using ansible firewalld_sshd_port_enabled

Actual Results:

The scan after applying test scenarious should return "fail", but it returns "pass".

Expected Results:

The test scenario returns "fail" and the remediation is performed. The final result should be "pass".

Additional Information/Debugging Steps:

The --remediate-using does not play a role here as the problem appears after the first scan, before remediation.

[Mab879]

This might need a sometimes wavier.

Also needs more investigation from the testing env.

[vojtapolasek]

This manifested also in the second stabilization run.

[Mab879]

Locally I can't reproduce.

$ ./automatus.py rule --datastream ../build/ssg-rhel8-ds.xml --remediate-using oscap  --libvirt qemu:///system automatus_rhel_8_6 firewalld_sshd_port_enabled 
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/ComplianceAsCode/content/tests/logs/rule-custom-2024-05-10-0831/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled
INFO - Script customized_zone_configured.pass.sh using profile (all) OK
INFO - Script customized_zone_without_ssh.fail.sh using profile (all) OK
INFO - Script new_zone_configured.pass.sh using profile (all) OK
INFO - Script new_zone_without_ssh.fail.sh using profile (all) OK
INFO - Script only_nics_configured.fail.sh using profile (all) OK
INFO - Script only_zones_configured.fail.sh using profile (all) OK
INFO - Script zones_and_nics_configured.pass.sh using profile (all) OK
INFO - Script zones_and_nics_ok_no_custom_files.pass.sh using profile (all) OK
INFO - Script zones_and_nics_ok_port_changed.pass.sh using profile (all) OK

[mildas]

All test scenarios for this rule pass on latest RHEL8. Moreover, 8.6 EUS ends in few weeks and no SSG updates there anymore. Thus, closing this issue.