-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
rhel-10.0
-
None
-
Moderate
-
sst_installer
-
ssg_front_door
-
None
-
False
-
-
None
-
None
-
None
-
None
-
If docs needed, set a value
-
-
All
-
None
Installations intended for DISA STIG deployments suffer from a lack of
support for compliant partitioning. Example from customer case:
Trying to use tmpfs for /tmp while installing with the DISA profile.
First you need to allocate 50+MB to a partition you don't want, then
systemctl enable tmp.mount, and remove the /tmp entry in /etc/fstab.
Those you can do in a kickstart %post section, but you probably want to
reallocate the space to one of the other partitions if you don't want
dead space on your disks, and that must be done after the reboot as far
as I can tell. Finally, you need to add noexec to the Options in
/usr/lib/systemd/system/tmp.mount to meet CCE-82139-7, which can also
go into the %post section but you might not realize it until after
you've finished and run a scan with oscap.
Does oscap-anaconda-addon potentially influence partitioning? I didn't know
it existed until opening this bug and seeing it as a potential component.
If so, I don't initially see documentation for that. If not, would that be
a proper home for partitioning guidance, or would that have to live
elsewhere in Anaconda?
Links to that:
https://www.open-scap.org/tools/oscap-anaconda-addon/
https://access.redhat.com/solutions/1129633
In any event, I'm insufficiently familiar with Anaconda to have a strong
notion of how this might best be addressed.