Ubuntu 22.04 usg tailoring file for cis_level1_workstation does not create rule for xccdf_org.ssgproject.content_rule_package_cups_removed

[Aris L.]

Hello,

We are trying to create a tailoring file based on the cis_level1_workstation profile using the following command:

usg generate-tailoring cis_level1_workstation ./cis_level1_workstation.xml

The resulting xml file, does not seem to contain a rule for xccdf_org.ssgproject.content_rule_package_cups_removed, which we would like to set to "false".

Steps to reproduce:

1. run usg generate-tailoring cis_level1_workstation ./cis_level1_workstation.xml
2. run grep -i cups ./cis_level1_workstation.xml

The output given only matches the role to *disable* CUPS, but not *remove* CUPS:

    <!--2.2.3 Ensure CUPS is not installed (Automated)-->
    <select idref="xccdf_org.ssgproject.content_rule_service_cups_disabled" selected="false"/>

Here are the details of my system:

Ubuntu 22.04.4 LTS (jammy)
USG version 22.04.6 (Filename: pool/main/u/ubuntu-security-guides-enhanced/usg_22.04.6_all.deb)

Please advise!

[Eduardo Barretto (ebarretto)]

Hi Aris,

thanks for reporting this issue.
Indeed the workstation level 1 profile and tailoring file are missing it.
I will add it and we will let you know on an ETA.

For now you could manually add:
    <select idref="xccdf_org.ssgproject.content_rule_package_cups_removed" selected="false"/>

And it should work still.

thanks again!

[Aris L. (alabrian)]

Thank you Eduardo for the workaround and for confirming the bug!

[Eduardo Barretto (ebarretto)]

The fix for this is now integrated into the code and should be released in a newer version of usg.
We will update the status of this ticket whenever the new usg is released.