Improve template pam_account_password_faillock

[mpurg]

Description:

• Improve template pam_account_password_faillock
• Add documentation for template
• Define requirements for variables in template.py:
  • ext_variable must be defined since it is used in the remediation
  • bounding variables must be 'use_ext_variable', (int), or undefined (if undefined, bounding variables are initialized to None)
• Modify OVAL logic:
  • fix conditionals to consistently use inclusive comparisons instead of inclusive for ext_variable, and exclusive for numbers (this requires changing the lower boundary for _deny rule from 0 to 1)
  • remove conditionals which compare to var_ref="{{{ VARIABLE_*_BOUND}}}" as these variables don't exist in the OVAL
  • modify check for undefined variable to compare to jinja test none
• Fix tests
  • tests were generalized and are no longer specific to _deny rule
  • tests check the different logic flows defined by template parameters and external variables
  • a new macro was created to initialize the variables
  • tests from the rules that use the template were removed
  • fix for missing profile "minimal" in fedora
• Fix platform in ansible remediation to match remediations in original rules

[openshift-ci]

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[mpurg]

@Mab879 @jan-cerny I see that one fedora test (conflicting_settings_authselect.fail.sh) is failing with

+ authselect create-profile testingProfile --base-on minimal
[error] Unable to read base profile [minimal] [2]: No such file or directory
[error] Unable to create profile [2]: No such file or directory
Unable to create new profile [2]: No such file or directory
+ CUSTOM_PROFILE_DIR=/etc/authselect/custom/testingProfile
+ authselect select --force custom/testingProfile
[error] Unable to get profile information [2]: No such file or directory

Should the profile be based on local or sssd maybe?

Update: I added a fallback command based on the local profile which seems to fix the issue: 2507ad8

Update2: The ansible remediations in fedora automatus tests are failing because of missing python3-rpm

[codeclimate]

Code Climate has analyzed commit 8055c39 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

[Xeicker]

LGTM

[dodys]

@Mab879 could you please take a look on this one?

[Mab879]

Thanks!

[dodys]

lgtm, thanks!