all_apparmor_profiles_in_enforce_complain_mode: Fix OVAL logic

[dodys]

Description:

• Current OVAL fails with unknown result because the variables are looking for a subexpression field of the object when there's none. Instead use text part of the object. Also change how you seek for unconfined.
• Also fixes test not working on sle15.

Rationale:

• To have a subexpression field from the object you would need to select some specific text with parenthesis, but that's not being done. Since we don't care about the actual pattern being matched but instead the number of matches, using the text field instead is enough.

Review Hints:

• OVAL passes.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11672
This image was built from commit: bbff647

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11672

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11672 make deploy-local

[dodys]

@teacup-on-rockingchair is the tests you added to this rule actually working? they seem completely broken right now. I tried to fix it by adding the apparmor-utils to platform-packages-override and now it fails with something else.
I will leave it to you to add what is missing there and to test my changes.

[teacup-on-rockingchair]

@teacup-on-rockingchair is the tests you added to this rule actually working? they seem completely broken right now. I tried to fix it by adding the apparmor-utils to platform-packages-override and now it fails with something else. I will leave it to you to add what is missing there and to test my changes.

I am afraid for the aa-teardown, and apparmor_parser used in the tests you need to add also apparmor-parser package, but anyways the tools in the tests require appropriate kernel patches etc, so should not consider them ready for container environment.

[dodys]

@teacup-on-rockingchair is the tests you added to this rule actually working? they seem completely broken right now. I tried to fix it by adding the apparmor-utils to platform-packages-override and now it fails with something else. I will leave it to you to add what is missing there and to test my changes.

I am afraid for the aa-teardown, and apparmor_parser used in the tests you need to add also apparmor-parser package, but anyways the tools in the tests require appropriate kernel patches etc, so should not consider them ready for container environment.

in that case, we should waiver the test failures.

Could you please check now if it works fine on sles?

[codeclimate]

Code Climate has analyzed commit bbff647 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.8% (0.0% change).

View more on Code Climate.

[teacup-on-rockingchair]

@teacup-on-rockingchair is the tests you added to this rule actually working? they seem completely broken right now. I tried to fix it by adding the apparmor-utils to platform-packages-override and now it fails with something else. I will leave it to you to add what is missing there and to test my changes.

I am afraid for the aa-teardown, and apparmor_parser used in the tests you need to add also apparmor-parser package, but anyways the tools in the tests require appropriate kernel patches etc, so should not consider them ready for container environment.

in that case, we should waiver the test failures.

Could you please check now if it works fine on sles?

Yes they work with the patches and are failing on master branch with my half baked commit so I guess we are ok there :)

[teacup-on-rockingchair]

Thanks for the contribution and corrections @dodys 🙇 . If you decide to go with the suggested more simplistic approach just ping me to approve it again. Overall I think most important is that we have a working precedent of oval check working with apparmor ;)

[dodys]

Thanks for the contribution and corrections @dodys 🙇 . If you decide to go with the suggested more simplistic approach just ping me to approve it again. Overall I think most important is that we have a working precedent of oval check working with apparmor ;)

I feel like this OVAL still doesn't implement the whole check from CIS. It only checks profiles, not processes.
I was mostly fixing it so Ubuntu can still rely on the SCE check instead.
I will leave it as-is for now. If you could merge it, it would be great :)
Then any later work on this OVAL can be done in a next PR.