silences OSSEC alerts from fwupd running without udisks2

[cfm]

Status

Ready for review

Description of Changes

Fixes #6097 by adding OSSEC rules to ignore (classify as level 0) errors logged by fwupd in the absence of udisks2.

Testing

1. Staging environment: Confirm Level: 0 returned for both log messages cited in fwupd generates OSSEC alerts from syslog #6097:

$ molecule login -s libvirt-staging-focal -h mon-staging
vagrant@mon-staging:~$ echo "Aug 10 14:30:51 mon fwupd[134620]: 14:30:51:0528 FuPluginLinuxSwap    could not parse /proc/swaps: failed to call org.freedesktop.UDisks2.Manager.GetBlockDevices(): The name org.freedesktop.UDisks2 was not provided by any .service files" | sudo /var/ossec/bin/ossec-logtest
2021/09/23 23:33:33 ossec-testrule: INFO: Reading local decoder file.
2021/09/23 23:33:33 ossec-testrule: INFO: Started (pid: 132681).
ossec-testrule: Type one log per line.



**Phase 1: Completed pre-decoding.
       full event: 'Aug 10 14:30:51 mon fwupd[134620]: 14:30:51:0528 FuPluginLinuxSwap    could not parse /proc/swaps: failed to call org.freedesktop.UDisks2.Manager.GetBlockDevices(): The name org.freedesktop.UDisks2 was not provided by any .service files'
       hostname: 'mon'
       program_name: 'fwupd'
       log: '14:30:51:0528 FuPluginLinuxSwap    could not parse /proc/swaps: failed to call org.freedesktop.UDisks2.Manager.GetBlockDevices(): The name org.freedesktop.UDisks2 was not provided by any .service files'

**Phase 2: Completed decoding.
       decoder: 'fwupd'

**Phase 3: Completed filtering (rules).
       Rule id: '100113'
       Level: '0'
       Description: 'fwupd error missing UDisks2'
vagrant@mon-staging:~$ echo "Sep 18 13:32:22 mon fwupd[134454]: 13:32:22:0632 FuEngine             failed to get chassis type: no structure with type 03" | sudo /var/ossec/bin/ossec-logtest
2021/09/23 23:34:17 ossec-testrule: INFO: Reading local decoder file.
2021/09/23 23:34:17 ossec-testrule: INFO: Started (pid: 132684).
ossec-testrule: Type one log per line.



**Phase 1: Completed pre-decoding.
       full event: 'Sep 18 13:32:22 mon fwupd[134454]: 13:32:22:0632 FuEngine             failed to get chassis type: no structure with type 03'
       hostname: 'mon'
       program_name: 'fwupd'
       log: '13:32:22:0632 FuEngine             failed to get chassis type: no structure with type 03'

**Phase 2: Completed decoding.
       decoder: 'fwupd'

**Phase 3: Completed filtering (rules).
       Rule id: '100114'
       Level: '0'
       Description: 'fwupd error missing structure'

2. Production environment: I do not currently have access to a hardware production environment I can test against (as suggested by Disables OSSEC email for fwupd #5882) but hope to have this capability next week.

Deployment

No deployment considerations.

Checklist

If you made changes to the system configuration:

• Configuration tests pass

[kushaldas]

Rules are correct and the logs are coming in with level 0 on staging server.

Approved.