Rule postfix_prevent_unrestricted_relay fails on STIG profile

[yuumasato]

Description of problem:

During first remediation of STIG profile, rule postfix_prevent_unrestricted_relay is not applicable because postfix is not installed.
During remediation package postfix is installed and the rule starts to fail.

SCAP Security Guide Version:

5caa381

Operating System Version:

RHEL-8

Steps to Reproduce:

1. Remediate with STIG profile
2. Verify that rule postfix_prevent_unrestricted_relay is not applicable
3. Scan with the STIG profile
4. Verify that rule postfix_prevent_unrestricted_relay fails

Actual Results:

Rule is notapplicable during remediation but results in fail on subsequent scans

Expected Results:

The rule should evaluate to pass.

Additional Information/Debugging Steps:

This is another case of two remediation runs required.

[jan-cerny]

The same problem also appears on RHEL 9.1 with STIG profile:

python3 /tmp/tmp.MYh8tUzM1Q/rpmbuild/BUILD/scap-security-guide-0.1.64/tests/test_suite.py profile --libvirt qemu:///system test_suite_vm --datastream /tmp/ssg-rhel9-ds.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel9-xccdf-1.2.xml --mode online --remediate-using oscap xccdf_org.ssgproject.content_profile_stig

[mildas]

There is no easy fix - must be fixed on scanner side.

[matusmarhefka]

Closing, reported an issue in openscap - OpenSCAP/openscap#1880