CMP-2372: Remove info override for virtual syscall rules

[rhmdnd]

The STIG has controls that ensure virtual system calls are disabled,
because they pose a security risk. However, the rule was previously
overridden to always inform users, instead of actually checking the
functionality was disabled.

This commit removes the override so that we evaluate the kernel argument
appropriately. If a user still needs to disable this check (e.g., to
make it easier to run 32 bit applications) then they can still exclude
the rule using a TailoredProfile.

[rhmdnd]

/test

[openshift-ci]

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

• /test 4.13-images
• /test 4.14-images
• /test 4.15-images
• /test 4.16-images
• /test e2e-aws-ocp4-cis
• /test e2e-aws-ocp4-cis-node
• /test e2e-aws-ocp4-e8
• /test e2e-aws-ocp4-high
• /test e2e-aws-ocp4-high-node
• /test e2e-aws-ocp4-moderate
• /test e2e-aws-ocp4-moderate-node
• /test e2e-aws-ocp4-pci-dss
• /test e2e-aws-ocp4-pci-dss-node
• /test e2e-aws-ocp4-stig
• /test e2e-aws-ocp4-stig-node
• /test e2e-aws-rhcos4-e8
• /test e2e-aws-rhcos4-high
• /test e2e-aws-rhcos4-moderate
• /test e2e-aws-rhcos4-stig
• /test images

Use /test all to run the following jobs that were automatically triggered:

• pull-ci-ComplianceAsCode-content-master-4.13-images
• pull-ci-ComplianceAsCode-content-master-4.14-images
• pull-ci-ComplianceAsCode-content-master-4.15-images
• pull-ci-ComplianceAsCode-content-master-4.16-images
• pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rhmdnd]

/test e2e-aws-rhcos4-stig

[rhmdnd]

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit cb6cd30 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.3% (0.0% change).

View more on Code Climate.

[openshift-ci]

@rhmdnd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-moderate	cb6cd30	link	true	/test e2e-aws-rhcos4-moderate
ci/prow/e2e-aws-rhcos4-high	cb6cd30	link	true	/test e2e-aws-rhcos4-high

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[rhmdnd]

The RHCOS4 high and moderate profile failures are due to unrelated issues we're tracking in separate fixes.

[rhmdnd]

Adding @BhargaviGudi for review.

[BhargaviGudi]

/hold for test

[yuumasato]

/lgtm

Just pending pre-merge tests.

[BhargaviGudi]

Verification passed with 4.16.0-0.nightly-2024-02-08-073857 + compliance-operator with compliance-operator code

Please find the testing details below

$ oc compliance bind -N test -S default-auto-apply profile/upstream-rhcos4-stig
Creating ScanSettingBinding test
$ oc get suite -w
NAME   PHASE     RESULT
test   RUNNING   NOT-AVAILABLE
test   RUNNING   NOT-AVAILABLE
test   AGGREGATING   NOT-AVAILABLE
test   AGGREGATING   NOT-AVAILABLE
test   DONE          COMPLIANT
test   DONE          COMPLIANT
$ oc get ccr | grep coreos-vsyscall-kernel-argument
upstream-rhcos4-stig-master-coreos-vsyscall-kernel-argument                                PASS     medium
upstream-rhcos4-stig-worker-coreos-vsyscall-kernel-argument                                PASS     medium

[BhargaviGudi]

/unhold
/lgtm