################################################################################
# One of these is likely breaking host machine mounts, so skip them for now    #
################################################################################

audit_rules_media_export

configure_bind_crypto_policy
configure_crypto_policy
configure_firewalld_ports
configure_gnutls_tls_crypto_policy
configure_kerberos_crypto_policy
configure_libreswan_crypto_policy
configure_openssl_crypto_policy
configure_openssl_tls_crypto_policy
configure_ssh_crypto_policy
harden_sshd_ciphers_openssh_conf_crypto_policy
harden_sshd_ciphers_opensshserver_conf_crypto_policy
harden_sshd_macs_openssh_conf_crypto_policy
harden_sshd_macs_opensshserver_conf_crypto_policy

################################################################################
# Intentionally disabled scripts (see status.txt for details)
################################################################################

dconf_gnome_disable_ctrlaltdel_reboot
gnome_gdm_disable_automatic_login
agent_mfetpd_running
grub2_admin_username
grub2_password
grub2_uefi_admin_username
grub2_uefi_password

# Mount scripts will error if the expected target mounts are not present, need to skip applying them unless they will work
# We don't have a /dev/cdrom during build
mount_option_nodev_removable_partitions
mount_option_noexec_removable_partitions
mount_option_nosuid_removable_partitions

# We don't have a password-auth file, so this isn't applicable to mariner.
accounts_password_pam_pwhistory_remember_password_auth
accounts_password_pam_unix_rounds_password_auth

# Switching to a different method of enabling FIPS (sysctl_crypto_fips_enabled, package_dracut-fips_installed, etc_system_fips_exists, disable_prelink, grub2_enable_fips_mode_boot_dir)
enable_fips_mode

# We don't want to disable namespaces since we will be using containers
sysctl_user_max_user_namespaces

# We don't have the abrt package
package_abrt-addon-ccpp_removed
package_abrt-addon-kerneloops_removed
package_abrt-addon-python_removed
package_abrt-cli_removed
package_abrt-plugin-logger_removed
package_abrt-plugin-rhtsupport_removed
package_abrt-plugin-sosreport_removed

# Per request we don't configure DNS since there will be no DNS available
network_configure_name_resolution

################################################################################
# Scripts that can only be run during runtime
################################################################################

# These scripts require /var/log/messages, which rsyslog creates on first boot.
# See also custom_var_log_messages_config which sets initial permissions
file_groupowner_var_log_messages
file_owner_var_log_messages
file_permissions_var_log_messages

# These scripts require /var/log/audit/audit.log, which auditd creates on first boot.
file_group_ownership_var_log_audit
file_ownership_var_log_audit_stig
file_permissions_var_log_audit

# We share the host machines /dev and /tmp during build, these scripts will work on a live machine however.
mount_option_dev_shm_nodev
mount_option_dev_shm_noexec
mount_option_dev_shm_nosuid
mount_option_tmp_nodev
mount_option_tmp_noexec
mount_option_tmp_nosuid

# These scripts require the sshd keys which are created on first boot
file_permissions_sshd_private_key
file_permissions_sshd_pub_key

# We have no network during build. This package update script can only be run on a live machine with network.
security_patches_up_to_date

# Our tooling generates the grub.cfg after these scripts run. We set the values at boot time so we disable here.
grub2_audit_argument
grub2_audit_backlog_limit_argument
grub2_pti_argument
grub2_vsyscall_argument
grub2_page_poison_argument
grub2_slub_debug_argument

# We don't have remote logging enabled, these just cause our journal to get flooded with errors
rsyslog_remote_loghost
rsyslog_encrypt_offload_actionsendstreamdrivermode
rsyslog_encrypt_offload_actionsendstreamdriverauthmode
rsyslog_encrypt_offload_defaultnetstreamdriver

# SELinux policy tooling is unhappy in a chroot
selinux_policytype
selinux_state

################################################################################
# All scripts (including duplicates of the above mount scripts)                #
################################################################################

account_emergency_expire_date
accounts_password_all_shadowed_sha512
accounts_user_dot_no_world_writable_programs
accounts_user_home_paths_only
accounts_user_interactive_home_directory_defined
accounts_user_interactive_home_directory_exists
account_temp_expire_date
account_unique_id
aide_scan_notification
auditd_audispd_configure_sufficiently_large_partition
audit_rules_media_export
audit_rules_privileged_commands_postdrop
audit_rules_privileged_commands_postqueue
audit_rules_privileged_commands_userhelper
bios_enable_execution_restrictions
configure_usbguard_auditbackend
dconf_gnome_banner_enabled
dconf_gnome_lock_screen_on_smartcard_removal
dconf_gnome_login_banner_text
dconf_gnome_screensaver_idle_delay
dconf_gnome_screensaver_lock_enabled
encrypt_partitions
file_permissions_etc_audit_auditd
installed_OS_is_vendor_supported
install_smartcard_packages
network_sniffer_disabled
package_fapolicyd_installed
package_firewalld_installed
package_gssproxy_removed
package_iprutils_removed
package_krb5-workstation_removed
package_mcafeetp_installed
package_opensc_installed
package_openssh-server_installed
package_rsyslog-gnutls_installed
package_sendmail_removed
package_tuned_removed
package_usbguard_installed
postfix_client_configure_mail_alias
postfix_prevent_unrestricted_relay
root_permissions_syslibrary_files
service_autofs_disabled
service_fapolicyd_enabled
service_firewalld_enabled
service_kdump_disabled
service_rngd_enabled
service_usbguard_enabled
sudo_restrict_privilege_elevation_to_authorized
tftpd_uses_secure_mode
usbguard_generate_policy
wireless_disable_interfaces
xwindows_remove_packages
