Fix variable selection when selecting the default value

[ggbecker]

Description:

• Fix variable selection when selecting the default value

Rationale:

• It's not possible to directly select the default value, so instead we either remove or create a new value to represent the default value.

• Fixes: openscap failing on sshd_use_strong_macs in e8 on RHEL-7 #11018

OpenSCAP Error: Attempt to get non-existent selector "default" from variable "xccdf_org.ssgproject.content_value_sshd_strong_macs" [xccdf_policy.c:462]
Invalid selector 'default' for xccdf:value/@id='xccdf_org.ssgproject.content_value_sshd_strong_macs'. Using null value instead. [xccdf_policy.c:2137]

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[qlty-cloud-legacy]

Code Climate has analyzed commit 54093c4 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.3% (0.0% change).

View more on Code Climate.

[vojtapolasek]

Hello @ggbecker I have a question. It seems you took a different approach for the E8 profile (remove the explicit default selector) and SLE ANSSI profiles (add a new selector with the SAME value as the default value, and select this selector). May I know the reason for this approach?
I think it would be enough for all profiles just to remove the explicit selection of the default selector.

[teacup-on-rockingchair]

Nice stuff 👍

[comps]

The issue references is wrong, I messed up and incorrectly associated audit_rules_privileged_commands with sshd_use_strong_macs.

The proper issue fixed by this PR would be #11018 .

[ggbecker]

The issue references is wrong, I messed up and incorrectly associated audit_rules_privileged_commands with sshd_use_strong_macs.

The proper issue fixed by this PR would be #11018 .

Fixed

[ggbecker]

Hello @ggbecker I have a question. It seems you took a different approach for the E8 profile (remove the explicit default selector) and SLE ANSSI profiles (add a new selector with the SAME value as the default value, and select this selector). May I know the reason for this approach? I think it would be enough for all profiles just to remove the explicit selection of the default selector.

The ones I overrode with a new value is because the value comes from a control file

content/controls/anssi.yml

Line 897 in 2ea9497

- var_sudo_dedicated_group=sudogrp

and this value is not the default one.

Then they were trying to revert it to the default value, but since it's not possible to select the default selector and the default value was not represented by any other selector, I had to create a new value there and use it instead.

I don't know if it would be possible to deselect the variable by using something like: !var_sudo_dedicated_group in the profile, but I think it makes more sense to have the value explicitly set for example.

[vojtapolasek]

I see now, thank you @ggbecker for the explanation. I am afraid unselecting variables in .profile files does not work, I have tried that recently.

[vojtapolasek]

LGTM, the failing check is because rawhide is broken.

[vojtapolasek]

@freddieRv could you please review? Thank you.

[freddieRv]

Changes LGTM