`package_tftp-server_removed` is misaligned with DISA STIG SCAP Content

[ggbecker]

Description of problem:

9.8	fail	/scanning/disa-alignment/anaconda	package_tftp-server_removed		SSG result: pass, DISA result(s): SV-257835r1155679_rule:notapplicable
9.8	fail	/scanning/disa-alignment/oscap	package_tftp-server_removed		SSG result: pass, DISA result(s): SV-257835r1155679_rule:notapplicable
9.8	fail	/scanning/disa-alignment/ansible	package_tftp-server_removed		SSG result: pass, DISA result(s): SV-257835r1155679_rule:notapplicable

SCAP Security Guide Version:

fe081c9

Operating System Version:

RHEL9.8

[jan-cerny]

The rule in DISA's automated SCAP content for RHEL 9 STIG V2R7 now contains a CPE platform (xccdf_mil.disa.stig_platform_LinuxTFTP) that makes the rule applicable only if the tftp-server RPM package is installed.

I think we don't want this behavior, it's making the rules notapplicable once they start passing. I assume we will need to make a permanent waiver for this rule.

[ggbecker]

Yeah, I believe this CPE check only makes sense for the rules related to tftp that are not the package installed rule type for example.

[jan-cerny]

Our rules tftp_uses_secure_mode_systemd and tftpd_uses_secure_mode have platform: package[tftp-server]. I think we can add this platform also to service_tftp_disabled.

[vojtapolasek]

service_tftp_disabled is not used in any RHEL profiles. @ggbecker can I close this issue? It seems like we do things correctly.