mount_option_remote_systems: make rule not applicable if mounts not found #11761

vojtapolasek · 2024-03-27T12:45:59Z

Description:

new platform nfs_mount_defined added
change the OVAL check of the mount_option_remote_filesystems template so that it only checks for mount options. Previously, it also checked if any mount points of nfs or nfs4 are defined. If there were not any, the check resulted in "pass".
now the approach is a bit different; the check for presence of nfs / nfs4 mount points is performed by CPE platform. Therefore, in case there is no such a mount point, the rule is marked as not applicable
This also led me to removing of test scenarios which were testing for the case when there is no nfs / nfs4 mount point.

Rationale:

This is aligning the content with DISA and at the some time I think it makes more sense.

Fixes: #11705 #11707

Review Hints:

test the rule with automatus
ensure that the applicability check works by evaluating some templated rule against the system without nfs / nfs4 mounts

…for mount_option_remote_filesystems the check will be performed on a rule level instead

github-actions · 2024-03-27T12:47:42Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-03-27T12:49:54Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11761
This image was built from commit: 94ca4bb

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11761

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11761 make deploy-local

github-actions · 2024-03-27T12:50:20Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems' differs.
--- oval:ssg-mount_option_krb_sec_remote_filesystems:def:1
+++ oval:ssg-mount_option_krb_sec_remote_filesystems:def:1
@@ -1,3 +1,2 @@
-criteria XOR
-criterion oval:ssg-test_no_nfs_defined_etc_fstab_sec_krb5_krb5i_krb5p:tst:1
+criteria OR
 criterion oval:ssg-test_nfs_sec_krb5_krb5i_krb5p_etc_fstab:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { grep -E "[[:space:]](nfs|nfs4)[[:space:]]" /etc/fstab; }; then
 
 vfstype_points=()
 readarray -t vfstype_points < <(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
@@ -4,7 +4,9 @@
   check_mode: false
   changed_when: false
   failed_when: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   tags:
   - NIST-800-53-AC-17(a)
   - NIST-800-53-CM-6(a)
@@ -29,6 +31,7 @@
     opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},sec=krb5:krb5i:krb5p'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   - (points_register.stdout | length > 0) and '\\x09' not in item
   with_items: '{{ points_register.stdout_lines }}'
   tags:

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems'
--- xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_krb_sec_remote_filesystems
@@ -1 +1 @@
-
+oval:ssg-nfs_mount_defined:def:1

OVAL for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems' differs.
--- oval:ssg-mount_option_nodev_remote_filesystems:def:1
+++ oval:ssg-mount_option_nodev_remote_filesystems:def:1
@@ -1,3 +1,2 @@
-criteria XOR
-criterion oval:ssg-test_no_nfs_defined_etc_fstab_nodev:tst:1
+criteria OR
 criterion oval:ssg-test_nfs_nodev_etc_fstab:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { grep -E "[[:space:]](nfs|nfs4)[[:space:]]" /etc/fstab; }; then
 
 vfstype_points=()
 readarray -t vfstype_points < <(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
@@ -4,7 +4,9 @@
   check_mode: false
   changed_when: false
   failed_when: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   tags:
   - CCE-84052-0
   - DISA-STIG-RHEL-08-010640
@@ -26,6 +28,7 @@
     opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},nodev'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   - (points_register.stdout | length > 0) and '\\x09' not in item
   with_items: '{{ points_register.stdout_lines }}'
   tags:

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems'
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_remote_filesystems
@@ -1 +1 @@
-
+oval:ssg-nfs_mount_defined:def:1

OVAL for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems' differs.
--- oval:ssg-mount_option_noexec_remote_filesystems:def:1
+++ oval:ssg-mount_option_noexec_remote_filesystems:def:1
@@ -1,3 +1,2 @@
-criteria XOR
-criterion oval:ssg-test_no_nfs_defined_etc_fstab_noexec:tst:1
+criteria OR
 criterion oval:ssg-test_nfs_noexec_etc_fstab:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { grep -E "[[:space:]](nfs|nfs4)[[:space:]]" /etc/fstab; }; then
 
 vfstype_points=()
 readarray -t vfstype_points < <(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
@@ -4,7 +4,9 @@
   check_mode: false
   changed_when: false
   failed_when: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   tags:
   - CCE-84050-4
   - DISA-STIG-RHEL-08-010630
@@ -28,6 +30,7 @@
     opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},noexec'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   - (points_register.stdout | length > 0) and '\\x09' not in item
   with_items: '{{ points_register.stdout_lines }}'
   tags:

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems'
--- xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_noexec_remote_filesystems
@@ -1 +1 @@
-
+oval:ssg-nfs_mount_defined:def:1

OVAL for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems' differs.
--- oval:ssg-mount_option_nosuid_remote_filesystems:def:1
+++ oval:ssg-mount_option_nosuid_remote_filesystems:def:1
@@ -1,3 +1,2 @@
-criteria XOR
-criterion oval:ssg-test_no_nfs_defined_etc_fstab_nosuid:tst:1
+criteria OR
 criterion oval:ssg-test_nfs_nosuid_etc_fstab:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { grep -E "[[:space:]](nfs|nfs4)[[:space:]]" /etc/fstab; }; then
 
 vfstype_points=()
 readarray -t vfstype_points < <(grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | awk '{print $2}')

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
@@ -4,7 +4,9 @@
   check_mode: false
   changed_when: false
   failed_when: false
-  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  when:
+  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   tags:
   - CCE-84053-8
   - DISA-STIG-RHEL-08-010650
@@ -27,6 +29,7 @@
     opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},nosuid'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - ansible_mounts|selectattr("fstype", "in", ["nfs", "nfs4"])|list|length > 0
   - (points_register.stdout | length > 0) and '\\x09' not in item
   with_items: '{{ points_register.stdout_lines }}'
   tags:

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems'
--- xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
+++ xccdf_org.ssgproject.content_rule_mount_option_nosuid_remote_filesystems
@@ -1 +1 @@
-
+oval:ssg-nfs_mount_defined:def:1

codeclimate · 2024-03-27T13:02:37Z

Code Climate has analyzed commit 94ca4bb and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.3% (0.0% change).

View more on Code Climate.

jan-cerny

I have run a scan with the rule mount_option_nodev_remote_filesystems on a system with no NFS mount and the rule has been evaluated as notapplicable.

vojtapolasek added 4 commits March 27, 2024 11:36

add new applicability platform nfs_mount_defined

cc50a8f

stop checking for nonexistence of nfs mount within the template oval …

e848fcd

…for mount_option_remote_filesystems the check will be performed on a rule level instead

add platforms to relevant rules

f373ba5

drop no longer applicable test scenarios

94ca4bb

vojtapolasek added Update Rule Issues or pull requests related to Rules updates. STIG STIG Benchmark related. labels Mar 27, 2024

vojtapolasek added this to the 0.1.73 milestone Mar 27, 2024

jan-cerny self-assigned this Mar 27, 2024

jan-cerny approved these changes Mar 27, 2024

View reviewed changes

jan-cerny merged commit 73b3a34 into ComplianceAsCode:master Mar 27, 2024
44 checks passed

This was referenced Apr 10, 2024

mount_option_nosuid_remote_filesystems is misaligned with DISA #11707

Closed

mount_option_nodev_remote_filesystems is misaligned with DISA #11706

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

mount_option_remote_systems: make rule not applicable if mounts not found #11761

mount_option_remote_systems: make rule not applicable if mounts not found #11761

vojtapolasek commented Mar 27, 2024 •

edited by jan-cerny

github-actions bot commented Mar 27, 2024

github-actions bot commented Mar 27, 2024

github-actions bot commented Mar 27, 2024

codeclimate bot commented Mar 27, 2024

jan-cerny left a comment

mount_option_remote_systems: make rule not applicable if mounts not found #11761

mount_option_remote_systems: make rule not applicable if mounts not found #11761

Conversation

vojtapolasek commented Mar 27, 2024 • edited by jan-cerny

Description:

Rationale:

Review Hints:

github-actions bot commented Mar 27, 2024

github-actions bot commented Mar 27, 2024

github-actions bot commented Mar 27, 2024

codeclimate bot commented Mar 27, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

vojtapolasek commented Mar 27, 2024 •

edited by jan-cerny