Fix OS Release Comparing: 8.10 #39
Conversation
Tested against 8.10. Regex for 8.1 and fails test. Should add End of Line for regex to differ 8.1 with 8.10
|
Please update the patch version in the |
|
each time we do a merge to main we have to update the version here so that inspec knows to pull down the updated code https://github.com/mitre/redhat-enterprise-linux-8-stig-baseline/blob/main/inspec.yml#L7C1-L7C16 |
|
The logic here is: version: 1.14.1STIG Version 1 Release 14 of the benchmark generally and we have made .... 1,2,3 ... n patches and fixes to the test. Then we can make a set of releases v1.14.x -> v1.14 -> v1 So folks can 'pin' as they need to and don't 'run off main' in real workflows. https://mitre.github.io/saf-training/courses/profile-dev-test/02.html |
Will note for https://github.com/mitre/redhat-enterprise-linux-8-stig-baseline/tree/faillock_dir_dynamic branch upstream from this |
bump inspec version
| @@ -87,7 +87,7 @@ | |||
| !input('central_account_management') | |||
| } | |||
|
|
|||
| if os.release.to_f >= 8.2 | |||
| if Gem::Version.new(os.release) >= Gem::Version.new('8.2') | |||
There was a problem hiding this comment.
We never call direct ruby in controls as it executes on the runner not the target.
The `round() method off Float would likely be the better solution.
Something like os.release.to_f.round(2) may be what you are looking for. Chaining it this way off an inspec resource ensures the code runs on the target - in either local or remote scanning.
| @@ -4,7 +4,7 @@ maintainer: MITRE SAF Team | |||
| copyright: MITRE | |||
| license: Apache-2.0 | |||
| summary: "This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]." | |||
| version: 1.14.1 | |||
| version: 1.14.2 | |||
There was a problem hiding this comment.
My guidance to you on this was incorrect. I was reminded that we only update the version on release not on general updates to main. My appologies.
|
I created a PR on the inspec side to fix this - inspec/inspec#7271 You may be able to just drop my udpated os resource into your profiles libraries directy to handle this as I took your approach and just moved it to the resource level vs the control level. |
Tested against 8.10. Regex for 8.1 and fails test. Should add End of Line for regex to differ 8.1 with 8.10