tmp.mount.j2 invalid options

[I-am-MoS]

Have you checked ReadtheDocs?: yes

Describe the Issue
From v3 to v4 the tmp.mount.j2 file switched from the format of:

Options=mode=1777,strictatime,{% if rhel8cis_rule_1_1_2_1_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_2_1_3 %}nosuid,{% endif %}{% if rhel8cis_rule_1_1_2_1_4 %}noexec{% endif %}

to:

Options: "{{ mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"

First issue was mount_point_fs_and_options is undefined, I found though prelim_mount_point_fs_and_options.
Second issue, this format results in the following in the unit file: Options: "rw,nosuid,nodev,seclabel" This is not proper syntax.

Expected Behavior
To proper set the tmp.mount unit file with : Options=mode=1777,strictatime,nodev,nosuid,noexec

Actual Behavior
Creates unit file with : Options: "rw,nosuid,nodev,seclabel"

I am unsure if the initial problem is missing something to create the variable and should not use prelim_ in the var, or just somehow this was fully overlooked as an issue (seems every CIS release the tmp.mount.j2 has issues with using the old variable numbers until and update comes out)

Possible Solution
Move back to the old format:

Options=mode=1777,strictatime,{% if rhel8cis_rule_1_1_2_1_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_2_1_3 %}nosuid,{% endif %}{% if rhel8cis_rule_1_1_2_1_4 %}noexec{% endif %}

Even the newer RHEL10 codebase uses this format.

[chayan88]

@I-am-MoS - I am seeing the same issue . Are you saying moving it back to old format solves the issue ?

[I-am-MoS]

@chayan88 Yes using the old format will work, it is what I did, to get past this. I do not like modifying the "vendor" code, as I do not want to try to remember between CIS versions and Code updates what I had to modify.

However this new "prelim_mount_point_fs_and_options[mount_point]" setup never versions of the code base uses for all mount point options not just tmp.mount, as been a bane of mine for the past 2 weeks. I even opened a support request as we are paying members, it helped me to understand what was happening, and as a result looks like I will not be able to now as we have for years, use 1 single play to call different OS versions for RHEL and as a result the correct version of the "vendor" code. Depending on using import vs include run into either handler issues due to handlers being combined from the 3 versions as it is all 1 large play, or going the other route these new non-unique variables they are using for mount points get shared as a whole play and then break functionally for the different OS's. I can see why using non-unique things is handy as it is faster between CIS and OS versions to keep basically the same code for many items unchanged, but makes things harder if you want to streamline your deployments across different OS versions.

[chayan88]

Thanks @I-am-MoS ! I was able to solve this with old format too . I totally agree with you 👍

[uk-bolly]

hi @chayan88 and @I-am-MoS

Apologies it has taken some time to get to these open issues. As you maybe aware from community announcements we have been rewriting every repo and branch in the background in excess of 200 branches as well as supporting other projects. So its meant that the community requests have not had the normal level of attention we would have liked to give.
I have been reading through and trying to understand there appears to be two issues.
I understand that someone has support and not getting it. Please please either drop onto discord (uk-bolly) and hit me up with any question regarding support, this should not be the case and keen to ensure this is resolved asap.
The newer way we moved to for remount across all our repos quite a while back doesn't work for you and making it slightly harder to run through, there is a new /tmp approach in the newest PR.
I would be very happy to see how you work and if we can improve this to make it easier for all, maintenance and use.
Please reply or drop me a discord message uk-bolly happy to have a chat. We will try and get to the bottom of this asap.

Thank you again for your continued support and feedback.

uk-bolly