Fixes #5835 disables ossec mails for fwupd

Adds a new rules group and also the related decoder.
freedomofpress · Mar 29, 2021 · 4fd0b81 · 4fd0b81
1 parent 480cf77
commit 4fd0b81
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 0 deletions.
diff --git a/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml b/install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml
@@ -47,3 +47,10 @@
 <decoder name="dhclient">
   <program_name>dhclient</program_name>
 </decoder>
+
+<!--
+  The default fwupd tries to auto-update and generates error.
+-->
+<decoder name="fwupd">
+  <program_name>fwupd</program_name>
+</decoder>
diff --git a/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml b/install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml
@@ -73,6 +73,25 @@
   </rule>
 </group>
 
+<!--
+  fwupd auto-updates realted rules.
+-->
+
+<group name="fwupd">
+  <rule id="100111" level="0">
+    <decoded_as>fwupd</decoded_as>
+    <match>Error opening directory</match>
+    <description>fwupd error</description>
+    <options>no_email_alert</options>
+  </rule>
+  <rule id="100112" level="0">
+    <decoded_as>fwupd</decoded_as>
+    <match>Failed to load SMBIOS</match>
+    <description>fwupd error for auto updates</description>
+    <options>no_email_alert</options>
+  </rule>
+</group>
+
 <!--
   Do not alert on stagging VM dhcp client errors. These events should not occur
   in production environments