Disable remediations for set_iptables_default_rule and set_ip6tables_default_rule on Ubuntu products

[mpurg]

Description:

• Disable remediations for set_iptables_default_rule and set_ip6tables_default_rule on Ubuntu products
• Fix path for iptables config in rule descriptions

Rationale:

• Remediations are disabled to avoid network lockout
• New behavior is consistent with analogous nftables and ufw rules nftables_ensure_default_deny_policy and set_ufw_default_rule.

[openshift-ci]

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_iptables_default_rule'.
--- xccdf_org.ssgproject.content_rule_set_iptables_default_rule
+++ xccdf_org.ssgproject.content_rule_set_iptables_default_rule
@@ -6,7 +6,9 @@
 To set the default policy to DROP (instead of ACCEPT) for
 the built-in INPUT chain which processes incoming packets,
 add or correct the following line in
+
 /etc/sysconfig/iptables:
+
 :INPUT DROP [0:0]
 
 [reference]:

[codeclimate]

Code Climate has analyzed commit a6d2564 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.1% (0.0% change).

View more on Code Climate.

[mpurg]

Automatus tests are failing due to iptables not working in podman containers.

Ubuntu 24.04 VM:

INFO - xccdf_org.ssgproject.content_rule_set_iptables_default_rule
INFO - Script wrong.fail.sh using profile (all) OK                                                                             
INFO - Script correct.pass.sh using profile (all) OK 

INFO - xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule                                                                                                                                                                                           
INFO - Script wrong.fail.sh using profile (all) OK                                                                                                                                                                                                            
INFO - Script correct.pass.sh using profile (all) OK                                                                                                                                                                                                          
INFO - Script ipv6_disabled.pass.sh using profile (all) OK 

Ubuntu 22.04 VM:

INFO - xccdf_org.ssgproject.content_rule_set_iptables_default_rule
INFO - Script wrong.fail.sh using profile xccdf_org.ssgproject.content_profile_cis_level2_server OK
INFO - Script correct.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_level2_server OK

INFO - xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule
INFO - Script wrong.fail.sh using profile xccdf_org.ssgproject.content_profile_cis_level2_server OK
INFO - Script correct.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_level2_server OK
INFO - Script ipv6_disabled.pass.sh using profile xccdf_org.ssgproject.content_profile_cis_level2_server OK

[dodys]

lgtm, thanks!