New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi… #10064

rumch-se · 2023-01-16T11:57:07Z

…ch covers CIS recommendation

Description:

This rule covers CIS recommendation 1.7.1.3 Ensure all AppArmor Profiles are in enforce or complain mode

Rationale:

At the moment CIS profiles for SLE 12/15 does not include this recommendation. The recommendation could be extended to support - other Linux distributions

openshift-ci · 2023-01-16T11:57:18Z

Hi @rumch-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2023-01-16T11:59:01Z

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

dodys

a few fixes needed

...x_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/ansible/shared.yml

linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml

dodys · 2023-01-17T13:52:55Z

linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml

+    <linux:state state_ref="no_processes_which_are_unconfined" />
+  </linux:apparmorstatus_test>
+
+  <linux:apparmorstatus_object id="apparmor_exists_on_our_system" version="1">


you can consolidate this is one line:
<linux:apparmorstatus_object id="apparmor_exists_on_our_system" version="1" />

linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml

dodys · 2023-01-17T13:55:28Z

fyi, since we don't have a SUSE maintainer and this rule also is needed for Ubuntu, I've assigned it to me.

dodys · 2023-01-17T13:59:51Z

This rule is not buildable in Ubuntu (and Debian), as apparmor schema was only added in OVAL Format 5.11.2 and Ubuntu now only has OVAL Format 5.11.1. A separate OVAL will be sent after this is merged to make it work in Ubuntu.

@rumch-se can you confirm that this is also the case for OpenSUSE, as the logs are showing that it doesn't recognize the apparmor schema.

rumch-se · 2023-01-18T10:59:14Z

Hello @dodys
Yes I can confirm about openSUSE
"
AppArmor is installed and running on any installation of openSUSE® Leap by default, regardless of what patterns are installed. The packages listed below are needed for a fully-functional instance of AppArmor:
source: https://doc.opensuse.org/documentation/leap/security/html/book-security/cha-apparmor-start.html
"

dodys · 2023-01-18T11:02:59Z

Hello @dodys Yes I can confirm about openSUSE " AppArmor is installed and running on any installation of openSUSE® Leap by default, regardless of what patterns are installed. The packages listed below are needed for a fully-functional instance of AppArmor: source: https://doc.opensuse.org/documentation/leap/security/html/book-security/cha-apparmor-start.html "

Hey @rumch-se, I meant please check the OVAL format version in opensuse, I believe you have OVAL Format < 5.11.2 and therefore that's why the build/test is failing here. For that you must run: oscap -V

rumch-se · 2023-01-18T11:23:18Z

Hello @dodys
I have done expected corrections.
According to question related to OVAL version check - in my case the version is 5.11.1 which is < 5.11.2
Have a nice day
Rumen

dodys

lgtm, thanks!
@marcusburghardt this rule will fail to build in a few of the containers because of the OVAL version, as apparmor tests were added to OVAL Format 5.11.2 only. Can we merge it as-is?

...x_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/ansible/shared.yml

linux_os/guide/system/apparmor/var_apparmor_mode.var

linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml

marcusburghardt · 2023-01-26T11:53:01Z

lgtm, thanks! @marcusburghardt this rule will fail to build in a few of the containers because of the OVAL version, as apparmor tests were added to OVAL Format 5.11.2 only. Can we merge it as-is?

Is the package already available but the containers are not updated?
If not, is there any plan to update the OVAL version on these systems?

I am not sure about the impact of CI tests if we merge it. @mildas , maybe you can help us on this?

rumch-se · 2023-02-13T09:11:58Z

Good morning @marcusburghardt and @dodys
Thank you for your feedback.
The proposed corrections are done.
Have a nice day
Rumen

marcusburghardt · 2023-02-13T11:12:14Z

lgtm, thanks! @marcusburghardt this rule will fail to build in a few of the containers because of the OVAL version, as apparmor tests were added to OVAL Format 5.11.2 only. Can we merge it as-is?

Is the package already available but the containers are not updated? If not, is there any plan to update the OVAL version on these systems?

I am not sure about the impact of CI tests if we merge it. @mildas , maybe you can help us on this?

I have talked to @mildas offline and he confirmed my concern of merging this PR now. It would impact the CI tests and cause failures in other PRs.

The ideal would be to ensure the OVAL Format 5.11.2 support before merging.

dodys · 2023-02-13T15:16:13Z

lgtm, thanks! @marcusburghardt this rule will fail to build in a few of the containers because of the OVAL version, as apparmor tests were added to OVAL Format 5.11.2 only. Can we merge it as-is?

Is the package already available but the containers are not updated? If not, is there any plan to update the OVAL version on these systems?
I am not sure about the impact of CI tests if we merge it. @mildas , maybe you can help us on this?

I have talked to @mildas offline and he confirmed my concern of merging this PR now. It would impact the CI tests and cause failures in other PRs.

The ideal would be to ensure the OVAL Format 5.11.2 support before merging.

Should we rename the oval to be sle15.xml so it won't get used in other platforms? Would that fix this issue temporarily?

marcusburghardt · 2023-02-14T07:04:14Z

lgtm, thanks! @marcusburghardt this rule will fail to build in a few of the containers because of the OVAL version, as apparmor tests were added to OVAL Format 5.11.2 only. Can we merge it as-is?

Is the package already available but the containers are not updated? If not, is there any plan to update the OVAL version on these systems?
I am not sure about the impact of CI tests if we merge it. @mildas , maybe you can help us on this?

I have talked to @mildas offline and he confirmed my concern of merging this PR now. It would impact the CI tests and cause failures in other PRs.
The ideal would be to ensure the OVAL Format 5.11.2 support before merging.

Should we rename the oval to be sle15.xml so it won't get used in other platforms? Would that fix this issue temporarily?

Interesting idea @dodys . I believe this should work. What do you think @yuumasato ?

dodys · 2023-02-21T18:40:02Z

@rumch-se could you please rename the oval file from shared.xml to sle.xml ?

rumch-se · 2023-02-22T09:12:58Z

Hello @dodys
The change was done.
Have a nice day
Rumen

dodys · 2023-02-22T09:14:21Z

Hello @dodys The change was done. Have a nice day Rumen

Thanks!
We will wait now for the test results to be sure it works. Also do test on your side, but I would expect that an OVAL file named sle.xml, should work for you.

dodys · 2023-02-22T13:34:30Z

@marcusburghardt ok, so the renaming of the oval file will not prevent tests to fail.
Then I think the way to go is to drop that oval altogether. What do you think?

dodys · 2023-03-09T09:39:48Z

Hi @rumch-se, could you please rebase this PR and remove the commit to add the OVAL. Since your OVAL is dependent of OVAL format 5.11.2 and most of the CI only has OVAL format 5.11.1, we won't be able to merge it as this will break the CI.
I will later add an SCE audit script for ubuntu.
@teacup-on-rockingchair fyi ^
let us know if you have any doubts.

…ch covers CIS recommendation

rumch-se · 2023-03-09T10:20:16Z

Hello @dodys
I have done a rebase and removed the OVAL part.
Have a nice day
Rumen

codeclimate · 2023-03-09T11:13:07Z

Code Climate has analyzed commit c04426f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.7% (0.0% change).

View more on Code Climate.

dodys

lgtm thanks!

marcusburghardt · 2023-03-13T14:24:32Z

The Automatus tests are failing because the rule is restricted to sle products.

marcusburghardt · 2023-03-13T14:29:16Z

Although I don't have a system to properly test apparmor, this new rule is restricted to sle products, was proposed by a known SUSE maintainer and approved by a know Ubuntu maintainer. The files are also sane for me.

Therefore, I am overriding CODEOWNERS since a SUSE approver is not currently available.

rumch-se requested a review from a team as a code owner January 16, 2023 11:57

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jan 16, 2023

dodys mentioned this pull request Jan 17, 2023

Add new rule ensure_apparmor_enforce_or_complain #9985

Closed

dodys requested changes Jan 17, 2023

View reviewed changes

dodys self-assigned this Jan 17, 2023

dodys approved these changes Jan 20, 2023

View reviewed changes

marcusburghardt requested changes Jan 26, 2023

View reviewed changes

dodys mentioned this pull request Jan 30, 2023

A new rule as a part of CIS profile for SLE 12/15 - all_apparmor_prof… #10057

Merged

marcusburghardt added SLES SUSE Linux Enterprise Server product related. Ubuntu Ubuntu product related. labels Feb 8, 2023

New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi…

bb7dd28

…ch covers CIS recommendation

rumch-se force-pushed the rule_all_apparmor_profiles_in_enforce_complain_mode branch from 4e10996 to bb7dd28 Compare March 9, 2023 10:16

Remove of OVAL part

c04426f

dodys requested a review from marcusburghardt March 9, 2023 12:30

dodys approved these changes Mar 9, 2023

View reviewed changes

marcusburghardt approved these changes Mar 13, 2023

View reviewed changes

marcusburghardt merged commit 64a2698 into ComplianceAsCode:master Mar 13, 2023

marcusburghardt added this to the 0.1.67 milestone Mar 13, 2023

marcusburghardt added the New Rule Issues or pull requests related to new Rules. label Mar 13, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi… #10064

New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi… #10064

rumch-se commented Jan 16, 2023

openshift-ci bot commented Jan 16, 2023

github-actions bot commented Jan 16, 2023

dodys left a comment

dodys Jan 17, 2023

dodys commented Jan 17, 2023

dodys commented Jan 17, 2023

rumch-se commented Jan 18, 2023

dodys commented Jan 18, 2023

rumch-se commented Jan 18, 2023

dodys left a comment

marcusburghardt commented Jan 26, 2023

rumch-se commented Feb 13, 2023

marcusburghardt commented Feb 13, 2023

dodys commented Feb 13, 2023

marcusburghardt commented Feb 14, 2023

dodys commented Feb 21, 2023

rumch-se commented Feb 22, 2023

dodys commented Feb 22, 2023

dodys commented Feb 22, 2023

dodys commented Mar 9, 2023

rumch-se commented Mar 9, 2023

codeclimate bot commented Mar 9, 2023

dodys left a comment

marcusburghardt commented Mar 13, 2023

marcusburghardt commented Mar 13, 2023

New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi… #10064

New SLE 12/15 rule all_apparmor_profiles_in_enforce_complain_mode whi… #10064

Conversation

rumch-se commented Jan 16, 2023

Description:

Rationale:

openshift-ci bot commented Jan 16, 2023

github-actions bot commented Jan 16, 2023

dodys left a comment

Choose a reason for hiding this comment

dodys Jan 17, 2023

Choose a reason for hiding this comment

dodys commented Jan 17, 2023

dodys commented Jan 17, 2023

rumch-se commented Jan 18, 2023

dodys commented Jan 18, 2023

rumch-se commented Jan 18, 2023

dodys left a comment

Choose a reason for hiding this comment

marcusburghardt commented Jan 26, 2023

rumch-se commented Feb 13, 2023

marcusburghardt commented Feb 13, 2023

dodys commented Feb 13, 2023

marcusburghardt commented Feb 14, 2023

dodys commented Feb 21, 2023

rumch-se commented Feb 22, 2023

dodys commented Feb 22, 2023

dodys commented Feb 22, 2023

dodys commented Mar 9, 2023

rumch-se commented Mar 9, 2023

codeclimate bot commented Mar 9, 2023

dodys left a comment

Choose a reason for hiding this comment

marcusburghardt commented Mar 13, 2023

marcusburghardt commented Mar 13, 2023