Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-88297

fix: add default seccomp filters for el9/10

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • rhel-system-roles
    • 0
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • None
    • Bug Fix
    • Hide
      .The `timesync` RHEL system role no longer removes the `OPTIONS="-F 2"` default setting from `/etc/sysconfig/chronyd`

      Before this update, the `timesync` system role replaced the default `OPTIONS=` setting for the `chronyd` service with `""`. As a consequence, this removed the default `OPTIONS="-F 2"` setting which weakened the security of `chronyd`. With this release, `-F 2` is added as the default setting for `OPTIONS`, and the user can override or extend this setting. As a result, the `timesync` role now applies the correct security settings while still allowing user customization.
      Show
      .The `timesync` RHEL system role no longer removes the `OPTIONS="-F 2"` default setting from `/etc/sysconfig/chronyd` Before this update, the `timesync` system role replaced the default `OPTIONS=` setting for the `chronyd` service with `""`. As a consequence, this removed the default `OPTIONS="-F 2"` setting which weakened the security of `chronyd`. With this release, `-F 2` is added as the default setting for `OPTIONS`, and the user can override or extend this setting. As a result, the `timesync` role now applies the correct security settings while still allowing user customization.
    • Done
    • Done
    • Done
    • Not Required
    • None

      Cause: The timesync role is replacing the default `OPTIONS=` setting for chronyd with `""` upon every role run.

      Consequence: This removes the default `OPTIONS="-F 2"` setting on EL9 and EL10 which weakens the security of chronyd.

      Fix: Add `-F 2` as the default setting for `OPTIONS` in EL9 and EL10. Ensure that the user can override this setting if necessary, and ensure that this setting can co-exist with other `OPTIONS` settings that may be set by the user.

      Result: The timesync role applies the correct security settings on every platform and allows the user to override/extend these settings.

      Fixes #278

              rmeggins@redhat.com Richard Megginson
              rmeggins@redhat.com Richard Megginson
              Richard Megginson Richard Megginson
              David Jez David Jez
              Valentina Ashirova Valentina Ashirova
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: