Skip to content

Conversation

@AlexXuan233
Copy link
Owner

Description:

Test remove jinja2 from var_network_filtering_service.var

Rationale:

Do it for trestle-bot

Review Hints:

Check all reference of var_network_filtering_service.var

@AlexXuan233 AlexXuan233 force-pushed the example-remove-var-jinja2 branch 4 times, most recently from 6db8696 to 48f03a6 Compare June 9, 2025 03:35
@AlexXuan233
Copy link
Owner Author

@marcusburghardt Updated. Can you help take a look again. Currently no ubuntu product use default option, but should we add a comment like i do in this PR. To let users know ubuntu default use nftables

@marcusburghardt
Copy link

@marcusburghardt Updated. Can you help take a look again. Currently no ubuntu product use default option, but should we add a comment like i do in this PR. To let users know ubuntu default use nftables

Great. For more context, every variable has a default value that is used when the variable is not explicitly defined in control files or profiles. In this case, if any rule using this variable is defined in a Ubuntu control file or profile, but the variable is not explicitly defined using the "nftables" option, the rule will use the default (firewalld) and will likely fail.

The last version of Ubuntu is also using the STIG control file, which does not include the variable. We should also define the variable var_network_filtering_service=nftables in https://github.com/ComplianceAsCode/content/blob/master/controls/stig_ubuntu2404.yml .

Once the PR is opened, we can ask Ubuntu maintainers to review and inform if we also need to set this variable in profiles used by older versions not using control files.

@AlexXuan233
Copy link
Owner Author

AlexXuan233 commented Jun 10, 2025

@marcusburghardt Updated. Can you help take a look again. Currently no ubuntu product use default option, but should we add a comment like i do in this PR. To let users know ubuntu default use nftables

Great. For more context, every variable has a default value that is used when the variable is not explicitly defined in control files or profiles. In this case, if any rule using this variable is defined in a Ubuntu control file or profile, but the variable is not explicitly defined using the "nftables" option, the rule will use the default (firewalld) and will likely fail.

The last version of Ubuntu is also using the STIG control file, which does not include the variable. We should also define the variable var_network_filtering_service=nftables in https://github.com/ComplianceAsCode/content/blob/master/controls/stig_ubuntu2404.yml .

Once the PR is opened, we can ask Ubuntu maintainers to review and inform if we also need to set this variable in profiles used by older versions not using control files.

@marcusburghardt Thanks for your review again. I think you mean add var_network_filtering_service=nftables in https://github.com/ComplianceAsCode/content/blob/master/products/ubuntu2404/profiles/stig.profile , which refer stig_ubuntu2404.yml, am i understand correctly or not.

By the way, do you think we should open one PR to remove all Jinja2 from all var file or one PR per var file.

@AlexXuan233 AlexXuan233 force-pushed the example-remove-var-jinja2 branch from 48f03a6 to be48ac6 Compare June 11, 2025 02:12
@AlexXuan233
Copy link
Owner Author

AlexXuan233 commented Jun 11, 2025

Some kind of var file is more complex, example : https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/accounts/accounts-banners/login_banner_text.var . @marcusburghardt Do you have any suggestions how to remove Jinja2 from this kind var file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants