OpenSCAP/scap-security-guide — pull request #239 by iankko (2014-09-24 15:27:42+00:00)
Title: [bugfix] [RHEL/7] Update RHEL-7 service_*_disabled.sh remediation fixes (so they would have the form as expected by systemd)

This change updates the RHEL/7/input/fixes/bash/service_*_disabled.sh remediation scripts to the form so they would work against RHEL7's systemd. The changes performed can be split into four groups:

case when

chkconfig --level 0..6 service_name off

to

systemctl disable service_name.service

was sufficient

case when original

chkconfig --level 0..6 service_name off

would still work on RHEL-7 (for example case of rhnsd or netconsole services)

case when particular service isn't present in RHEL-7 anymore (for example case of cpuspeed or haldaemon) -- deleted particular remediations in this case

and finally case when "something changed" in RHEL-7 causing original

chkconfig

script wouldn't work on RHEL-7 (example is tftp service which is now handled via xinetd and therefore needs itself dedicated / specific remediation script of the form edit /etc/xinet.d/tftp & change

disabled=no

to

disabled=yes

-- in this case deleted the original chkconfig based remediation script too, since it wouldn't work & needs rewrite / reimplementation

Testing status:
------------------
None of the proposed changes is included without proper testing (IOW that I would just blindly replace old form with the new one). But rather each of the script changes form has been first checked on RHEL-7's Server's command line for proper work & performed only then.

Please review.

Thank you && Regards, Jan.

P.S.: Intend to create same remediation scripts update for RHEL-7 service_*_enabled.sh scripts (since they are displayed in the scan report), but decided to split these into two pull requests since the service_*_disabled.sh change is massive enough for review.