firewall_single_service_active: add firewalld support and fix tests

[vojtapolasek]

Description:

• Add firewalld to the list of recognized firewall services in the firewall_single_service_active rule. Previously, the OVAL check and rule description only covered ufw, iptables, and nftables, missing the default firewall on RHEL/Fedora/SUSE systems.
• Add new test scenarios (firewalld_single.pass.sh, firewalld_multiple.fail.sh) targeting RHEL and Fedora platforms.
• Update existing test scenarios to use proper platform and packages metadata, replace hardcoded apt install calls with packages directives, and add 2>/dev/null || true guards for systemctl stop calls to handle services that may not exist.

Rationale:

• The rule was incomplete — it did not detect firewalld, the default firewall manager on RHEL and Fedora. This meant RHEL/Fedora systems with firewalld active were not being evaluated, and conflicts between firewalld and another firewall service were missed.
• The existing test scenarios were fragile: they assumed Debian/Ubuntu (apt install) without declaring platform constraints, and systemctl stop calls would fail on systems where a given service was not installed.

Review Hints:

• The OVAL change is a one-line addition of firewalld to the service name regex in oval/shared.xml.
• The rule.yml change adds firewalld to the description list.
• New test scenarios follow the same pattern as existing ones but target RHEL/Fedora.
• Existing test scenarios were cleaned up for portability (platform metadata, package declarations, error-tolerant stop commands).
• Build and test with:

  ./build_product rhel10 --datastream --rule-id firewall_single_service_active
  ./tests/automatus.py rule --libvirt qemu:///system rhel10 --datastream build/ssg-rhel10-ds.xml firewall_single_service_active
  

• The rule is not currently selected by any RHEL profile, so no profile-level side effects.
• Review both commits together — they are tightly related.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_firewall_single_service_active'.
--- xccdf_org.ssgproject.content_rule_firewall_single_service_active
+++ xccdf_org.ssgproject.content_rule_firewall_single_service_active
@@ -6,7 +6,7 @@
 The system must have exactly one active firewall service running to avoid conflicts
 and ensure consistent packet filtering. Only one of the following services should
 be enabled and active at any time:
-ufw - Uncomplicated Firewall (Ubuntu/Debian default)iptables - Classic Linux firewallnftables - Next Generation Firewall replacement for iptables
+firewalld - Dynamic Firewall Manager (RHEL/Fedora/SUSE default)ufw - Uncomplicated Firewall (Ubuntu/Debian default)iptables - Classic Linux firewallnftables - Next Generation Firewall replacement for iptables
 Having zero active firewalls leaves the system vulnerable, while having multiple
 active firewalls can lead to rule conflicts and security gaps.
 

[jan-cerny]

@vojtapolasek Currently the rule is used only in Debian and Ubuntu content (in Debian 12, 13 and Ubuntu 24.04 CIS profiles). What is the idea behind adding RHEL default firewall to the rule that isn't used in RHEL? Do we want to add the rule to any RHEL or Fedora content? Is that firewalld component available in Debian and Ubuntu? Shouldn't the regex in OVAL to be different based on the product? Do Debian and Ubuntu CIS Benchmarks requirements allow firewalld as acceptable option?

[openshift-ci]

@vojtapolasek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	ad1a1dc	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.