Add service_systemd-journal-upload_enabled to RHEL 10 CIS

[jan-cerny]

Add rule service_systemd-journal-upload_enabled to RHEL 10 CIS profile. Aligns the RHEL 10 CIS profile with CIS RHEL 10 Benchmark v1.0.1.

Resolves: https://issues.redhat.com/browse/OPENSCAP-6109

[Mab879]

While you didn't write this rule on this PR you might double check it before we merge this. Seems something seems wrong.

[jan-cerny]

I have improved description and rationale

[Mab879]

The rule is also failing tests, is that something we expect? If you we should waive it.

[jan-cerny]

I have found that the service failed to start and in journal I can see this error:

Oct 31 10:33:21 localhost.localdomain systemd-journal-upload[4238]: Required --url=/-u option missing.

That happens because the service doesn't have the remote log host configured. That should be done as a part of the configuration for the preceding CIS requirement (6.2.2.1.2 Ensure systemd-journal-upload authentication is configured). But, that requirement is manual.

Is it OK to keep the rule service_systemd-journal-upload_enabled in the profile and waive the fail in contest or should we move the service_systemd-journal-upload_enabled to related_rules and therefore remove it from the profile?

[Mab879]

I assume there isn't a way for US to NA this until the URL is configured?

[jan-cerny]

@Mab879

I think it's possible, the URL is configured in a configuration file, that means we can write a CPE OVAL check for that.

But, I think it isn't something we want, because the report showing that rule is evaluated as notapplicable will be misleading. The CIS says users should have the service enabled. If the rule fails, the users know that they're incompliant and can resolve it. If the rule resolves as notapplicable, the users can skip the requirement.

I lean towards this solution: add a warning to the rule and waive it in contest.

[jan-cerny]

I have add a warning and I have created a PR that adds a waiver to contest: RHSecurityCompliance/contest#481

[openshift-ci]

@jan-cerny: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	819c918	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Mab879]

/packit retest-failed