Skip to content

Commit 4dc1926

Browse files
committed
Stop changing permissions on files on Rocky 9
A similar change was made for Ubuntu systems in #1119, but it did not apply to Rocky 9 systems. This changes brings the two into line. (cherry picked from commit ef96aa2)
1 parent 66b75bf commit 4dc1926

File tree

1 file changed

+16
-0
lines changed
  • etc/kayobe/inventory/group_vars/overcloud

1 file changed

+16
-0
lines changed

etc/kayobe/inventory/group_vars/overcloud/cis

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,22 @@ rhel9cis_rule_5_3_4: false
6161
# Please double-check yourself with: sudo passwd -S root
6262
rhel9cis_rule_5_6_6: false
6363

64+
# Stop the CIS benchmark scanning all files on every filesystem since this
65+
# takes a long time. Related to the changing permissions block below. This
66+
# would normally warn you about violations, but we can use Wazuh to continually
67+
# monitor this.
68+
rhel9cis_rule_6_1_9: false
69+
rhel9cis_rule_6_1_10: false
70+
rhel9cis_rule_6_1_11: false
71+
rhel9cis_rule_6_1_12: false
72+
rhel9cis_rule_6_1_13: false
73+
rhel9cis_rule_6_1_14: false
74+
rhel9cis_rule_6_1_15: false
75+
76+
# The following rules change permissions on all files on every mounted
77+
# filesystem. We do not want to change /var/lib/docker permissions.
78+
rhel9cis_no_world_write_adjust: false
79+
6480
# Configure log rotation to prevent audit logs from filling the disk
6581
rhel9cis_auditd:
6682
space_left_action: syslog

0 commit comments

Comments
 (0)