From 84136d85e60245b1871ac5d058d4963e8a086940 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 6 May 2021 09:05:54 +0200
Subject: [PATCH] Move rule to grub2_bootloader_argument template
Implement content for grub2_enable_iommu_force via template
grub2_bootloader_argument.
Also adds warning about possible instabilities depending on hardware,
devices and operating system used.
Support for IOMMU is broad and generally well tested, so I assume
automated remediation for this rule should not be a problem in general.
---
.../grub2_enable_iommu_force/oval/shared.xml | 42 -------------------
.../grub2_enable_iommu_force/rule.yml | 11 +++++
2 files changed, 11 insertions(+), 42 deletions(-)
delete mode 100644 linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/oval/shared.xml
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/oval/shared.xml
deleted file mode 100644
index 0552ef2a644..00000000000
--- a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/oval/shared.xml
+++ /dev/null
@@ -1,42 +0,0 @@
-<def-group>
- <definition class="compliance" id="grub2_enable_iommu_force" version="1">
- {{{ oval_metadata("Ensure iommu=force is configured in the kernel line in /etc/default/grub.") }}}
- <criteria operator="AND">
- <extend_definition definition_ref="grub2_default_exists" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub" />
- <criteria operator="OR">
- <criterion test_ref="test_grub2_enable_force_iommu_default" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" />
- <criterion test_ref="test_grub2_enable_force_iommu" comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" />
- </criteria>
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test id="test_grub2_enable_force_iommu"
- comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX"
- check="all" check_existence="all_exist" version="1">
- <ind:object object_ref="object_grub2_enable_force_iommu" />
- <ind:state state_ref="state_grub2_enable_force_iommu" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object id="object_grub2_enable_force_iommu" version="1">
- <ind:filepath>/etc/default/grub</ind:filepath>
- <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_test id="test_grub2_enable_force_iommu_default"
- comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"
- check="all" check_existence="all_exist" version="1">
- <ind:object object_ref="object_grub2_enable_force_iommu_default" />
- <ind:state state_ref="state_grub2_enable_force_iommu" />
- </ind:textfilecontent54_test>
-
- <ind:textfilecontent54_object id="object_grub2_enable_force_iommu_default" version="1">
- <ind:filepath>/etc/default/grub</ind:filepath>
- <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_state id="state_grub2_enable_force_iommu" version="1">
- <ind:subexpression datatype="string" operation="pattern match">^.*iommu=force.*$</ind:subexpression>
- </ind:textfilecontent54_state>
-</def-group>
diff --git a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
index b560e8d2376..c1f77e21c36 100644
--- a/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
+++ b/linux_os/guide/system/bootloader-grub2/grub2_enable_iommu_force/rule.yml
@@ -20,3 +20,14 @@ references:
anssi: BP28(R11)
platform: machine
+
+warnings:
+ - functionality:
+ Depending on the hardware, devices and operating system used, enabling IOMMU can cause hardware instabilities.
+ Proper function and stability should be assessed before applying remediation to production systems.
+
+template:
+ name: grub2_bootloader_argument
+ vars:
+ arg_name: iommu
+ arg_value: 'force'