Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-4727

Partitioning for DISA STIG compliance awkward

    • None
    • Moderate
    • sst_installer
    • ssg_front_door
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None

      Installations intended for DISA STIG deployments suffer from a lack of
      support for compliant partitioning. Example from customer case:

      Trying to use tmpfs for /tmp while installing with the DISA profile.
      First you need to allocate 50+MB to a partition you don't want, then
      systemctl enable tmp.mount, and remove the /tmp entry in /etc/fstab.
      Those you can do in a kickstart %post section, but you probably want to
      reallocate the space to one of the other partitions if you don't want
      dead space on your disks, and that must be done after the reboot as far
      as I can tell. Finally, you need to add noexec to the Options in
      /usr/lib/systemd/system/tmp.mount to meet CCE-82139-7, which can also
      go into the %post section but you might not realize it until after
      you've finished and run a scan with oscap.

      Does oscap-anaconda-addon potentially influence partitioning? I didn't know
      it existed until opening this bug and seeing it as a potential component.
      If so, I don't initially see documentation for that. If not, would that be
      a proper home for partitioning guidance, or would that have to live
      elsewhere in Anaconda?

      Links to that:

      https://www.open-scap.org/tools/oscap-anaconda-addon/
      https://access.redhat.com/solutions/1129633

      In any event, I'm insufficiently familiar with Anaconda to have a strong
      notion of how this might best be addressed.

            anaconda-maint-list anaconda-maint-list
            rhn-support-mbliss Mason Loring Bliss (Inactive)
            Marek Haicman
            anaconda-maint-list anaconda-maint-list
            Release Test Team Release Test Team
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: