Update ANSSI BP-028 to version 2.0 #10334

vojtapolasek · 2023-03-14T08:06:04Z

Description:

reorganize and update ANSSI requirements in controls/anssi.yml
update profile versions and control file versions
update references in newly added rules

Rationale:

This PR introduces updated version of ANSSI profiles. The coverage is not 100% but the rules which are present in the profile are aligned with the security policy.

Reference: https://www.ssi.gouv.fr/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/

Most changes were introduced by @yuumasato .

What still needs to be done?

[x] investigate problem where Ansible playbook for RHEL 7 is aborted

[x] gather rules which got removed during the upgrade process and remove ANSSI references

openshift-ci · 2023-03-14T08:06:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2023-03-14T08:08:34Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

controls/anssi.yml

- Reorder and renumber the recommendations - Selection of rules updated - Control statues updated

Some rules were added while others were removed.

- sysctl_fs_protected_fifos - sysctl_fs_protected_regular

- sysctl_net_ipv6_conf_default_disable_ipv6

Select sysctl_kernel_panic_on_oops; Select value 2 for sysctl_kernel_kptr_restrict

hidepid can cause problems with PolicyKit and D-Bus.

This keeps the same approach for ANSSI BP-028 profiles.

Add ANSSI references to rules that configure the IPv6 stack.

Remove ANSSI references from rules that are not selected anymore.

yuumasato · 2023-03-29T10:02:23Z

@teacup-on-rockingchair Hi, have you had any involvement in the development of ANSSI profiles for SLE?
Do you have any thoughts regarding this update?

yuumasato · 2023-03-29T10:04:55Z

@dodys Hi, do you have any thoughts on this update?

Edit: I see that Ubuntu doesn't use the ANSSI Control file. So this PR won't affect Ubuntu's ANSSI profiles.
But you opinion is welcome anyways, :)

yuumasato · 2023-03-29T10:15:29Z

@freddieRv Hi, do you have any thoughts on this update?

The ANSSI BP-028 profiles for OL will be updated to 2.0.

teacup-on-rockingchair · 2023-03-29T10:56:23Z

@teacup-on-rockingchair Hi, have you had any involvement in the development of ANSSI profiles for SLE? Do you have any thoughts regarding this update?

I did indeed, will try to provide feedback till end of the week, thanks for the heads up 🙇

Do we have CIS -like comparison between old and new revision, or just go over the requirement of the new spec?

codeclimate · 2023-03-29T11:04:04Z

Code Climate has analyzed commit a9a8b1e and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.8% (0.0% change).

View more on Code Climate.

yuumasato · 2023-03-29T14:51:14Z

I did indeed, will try to provide feedback till end of the week, thanks for the heads up bow

Do we have CIS -like comparison between old and new revision, or just go over the requirement of the new spec?

@teacup-on-rockingchair You mean generated by us? No.
But the 2.0 PDF has an Annex explaining changes from 1.2 to 2.0. (It is only in French for now)

yuumasato

Thank you for the fixes and improvements @vojtapolasek :)

freddieRv

Changes LGTM.
Thanks for the efforts guys!

yuumasato · 2023-04-04T13:05:51Z

@teacup-on-rockingchair Hi, have you had any involvement in the development of ANSSI profiles for SLE? Do you have any thoughts regarding this update?

I did indeed, will try to provide feedback till end of the week, thanks for the heads up bow

Do we have CIS -like comparison between old and new revision, or just go over the requirement of the new spec?

@teacup-on-rockingchair Hi, did you have a chance to look at the ANSSI 2.0 update?

teacup-on-rockingchair · 2023-04-06T07:56:46Z

@teacup-on-rockingchair Hi, have you had any involvement in the development of ANSSI profiles for SLE? Do you have any thoughts regarding this update?

I did indeed, will try to provide feedback till end of the week, thanks for the heads up bow
Do we have CIS -like comparison between old and new revision, or just go over the requirement of the new spec?

@teacup-on-rockingchair Hi, did you have a chance to look at the ANSSI 2.0 update?

Did some initial review and tests LGTM 👍

marcusburghardt

I have checked all commits and the final control file. The changes are sane and the control file parameters are consistent with the referenced document. I didn't check each rule in details to confirm they are doing exactly what is expected from the requirement. But they were mostly just included in the controlfile. So, if any referenced rule needs updates, it is not in the scope of this PR.

marcusburghardt · 2023-04-11T10:52:08Z

Overriding CODEOWNERS since a SUSE approver is not currently available. Also, we have a green light from one of the SUSE contributors: #10334 (comment)

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 14, 2023

vojtapolasek force-pushed the anssi_20_upstream branch from ac1c202 to 74038af Compare March 14, 2023 08:57

Mab879 reviewed Mar 14, 2023

View reviewed changes

controls/anssi.yml Show resolved Hide resolved

yuumasato self-assigned this Mar 20, 2023

yuumasato added 16 commits March 23, 2023 09:29

Update ANSSI-BP-028 to DRAFT v2.0

d90aaed

- Reorder and renumber the recommendations - Selection of rules updated - Control statues updated

Add and remove ANSSI references in rules

21690b0

Some rules were added while others were removed.

Add CCEs to rules reference in ANSSI

4d22557

Fix requirement levels

33569d7

Set status supported for items we can implement

0932538

Update status of remaining items

4f1c533

Update R28 with rule for hidepid=2

761ffd1

Update R40 with rule for sudo timestamp_tmeout

b4c24bd

Update R14 with sysctl rules

71bbf58

- sysctl_fs_protected_fifos - sysctl_fs_protected_regular

Select sysctl rule for R13

500a20f

- sysctl_net_ipv6_conf_default_disable_ipv6

Update R9 with new rules

fbc02c8

Select sysctl_kernel_panic_on_oops; Select value 2 for sysctl_kernel_kptr_restrict

Update R1

143f8c3

Update R8 with new rules

8a0a05e

Move hidepid out of selected rules

b4e3372

hidepid can cause problems with PolicyKit and D-Bus.

Select sysctl rules for R12

e68704c

Select rules for kernel compile config

2f2b869

vojtapolasek and others added 4 commits March 23, 2023 09:29

change ANSSI versions for SLE products

d994626

Don't disable IPv6 stack, but configure it instead

77e39a9

This keeps the same approach for ANSSI BP-028 profiles.

Add references to rules configureing IPv6 stack

ccc214b

Add ANSSI references to rules that configure the IPv6 stack.

Remove references from rules that not selected

7305fec

Remove ANSSI references from rules that are not selected anymore.

vojtapolasek force-pushed the anssi_20_upstream branch from 48ab889 to 7305fec Compare March 23, 2023 08:29

vojtapolasek marked this pull request as ready for review March 23, 2023 08:30

vojtapolasek requested review from a team as code owners March 23, 2023 08:30

vojtapolasek changed the title ~~WIP: Update ANSSI BP-028 to version 2.0~~ Update ANSSI BP-028 to version 2.0 Mar 23, 2023

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 23, 2023

yuumasato requested a review from a team March 29, 2023 10:02

yuumasato requested review from a team and removed request for a team March 29, 2023 10:05

Update ANSSI version for OL products

a9a8b1e

yuumasato added the Oracle Linux Oracle Linux product related. label Mar 29, 2023

yuumasato approved these changes Mar 30, 2023

View reviewed changes

freddieRv approved these changes Mar 30, 2023

View reviewed changes

yuumasato added this to the 0.1.68 milestone Apr 3, 2023

marcusburghardt approved these changes Apr 11, 2023

View reviewed changes

marcusburghardt merged commit acc24a1 into ComplianceAsCode:master Apr 11, 2023
29 checks passed

jan-cerny mentioned this pull request Apr 11, 2023

ANSSI high profile triggers OpenSCAP error #10450

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ANSSI BP-028 to version 2.0 #10334

Update ANSSI BP-028 to version 2.0 #10334

vojtapolasek commented Mar 14, 2023 •

edited by yuumasato

openshift-ci bot commented Mar 14, 2023

github-actions bot commented Mar 14, 2023

yuumasato commented Mar 29, 2023

yuumasato commented Mar 29, 2023 •

edited

yuumasato commented Mar 29, 2023

teacup-on-rockingchair commented Mar 29, 2023

codeclimate bot commented Mar 29, 2023

yuumasato commented Mar 29, 2023

yuumasato left a comment

freddieRv left a comment

yuumasato commented Apr 4, 2023

teacup-on-rockingchair commented Apr 6, 2023

marcusburghardt left a comment

marcusburghardt commented Apr 11, 2023

Update ANSSI BP-028 to version 2.0 #10334

Update ANSSI BP-028 to version 2.0 #10334

Conversation

vojtapolasek commented Mar 14, 2023 • edited by yuumasato

Description:

Rationale:

What still needs to be done?

openshift-ci bot commented Mar 14, 2023

github-actions bot commented Mar 14, 2023

yuumasato commented Mar 29, 2023

yuumasato commented Mar 29, 2023 • edited

yuumasato commented Mar 29, 2023

teacup-on-rockingchair commented Mar 29, 2023

codeclimate bot commented Mar 29, 2023

yuumasato commented Mar 29, 2023

yuumasato left a comment

Choose a reason for hiding this comment

freddieRv left a comment

Choose a reason for hiding this comment

yuumasato commented Apr 4, 2023

teacup-on-rockingchair commented Apr 6, 2023

marcusburghardt left a comment

Choose a reason for hiding this comment

marcusburghardt commented Apr 11, 2023

vojtapolasek commented Mar 14, 2023 •

edited by yuumasato

yuumasato commented Mar 29, 2023 •

edited