Merge pull request #499 from ferricoxide/Issue_498

Add a 'SCAP undo' state
plus3it · Apr 19, 2024 · 91dfb34 · 91dfb34
2 parents 30ba47f + 10423df
commit 91dfb34
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/ash-linux/el8/VendorSTIG/init.sls b/ash-linux/el8/VendorSTIG/init.sls
@@ -8,4 +8,5 @@
 include:
   - ash-linux.el8.VendorSTIG.packages
   - ash-linux.el8.VendorSTIG.remediate
+  - ash-linux.el8.VendorSTIG.scap_undos
   - ash-linux.el8.VendorSTIG.aws_cli_v2
diff --git a/ash-linux/el8/VendorSTIG/scap_undos.sls b/ash-linux/el8/VendorSTIG/scap_undos.sls
@@ -0,0 +1,14 @@
+# This Salt state undoes anything put in place by the
+# "remediate" state that shouldn't have been done as part of the
+# generic OSCAP content
+#
+#################################################################
+
+# Undo SCAP's appending of a `*.* @@logcollector` config-token in the
+# rsyslog.conf file
+undo logcollector in /etc/rsyslog.conf:
+  file.replace:
+    - name: '/etc/rsyslog.conf'
+    - not_found_content: ''
+    - pattern: '^(\s*|#*\s*|)\*\.\*\s*@*logcollector$'
+    - repl: ''