Add mount[] platform and use it for /tmp and /var/tmp mount option rules #10431

evgenyz · 2023-04-06T01:52:50Z

Description:

This is a continuation on #10295 and, at the same time, a fix for #10389.

Rationale:

The name of the platform is mount[] instead partition[] because it better reflects the nature of the applicability check.
It is a tradeoff and a temporary solution until we refactor mount and mount_option related rules.
Fixes mount_option_*_tmp_* is pass when should be not applicable on RHEL8/RHEL9 #10389.

Review Hints:

Bash conditional now checks for findmnt --kernel || findmnt --fstab.
Ansible does something. But we don't really care about the details for now, as it won't be used for offline remediation (ever?).

github-actions · 2023-04-06T01:54:33Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

a new templated platform mount[] The platform conditionals now check for the /etc/fstab entries in addition to active mountpoint presence. Also the name better reflects the nature of the check.

and mount_option_var_tmp* rules This restores previously removed 'not applicable' behavior of these rules for systems where mountpoints have not been configured.

codeclimate · 2023-04-06T02:54:01Z

Code Climate has analyzed commit 442aa3e and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

Mab879 · 2023-04-06T12:42:29Z

Please also propose this to the stabilization branch as well.

Mab879

Looks good to me, thanks!

Co-authored-by: Evgeny Kolesnikov <ekolesni@redhat.com>

marcusburghardt · 2023-04-06T18:23:19Z

Before the fix:

rhel8 - mount_option_tmp_nodev - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
INFO - Script fstab.fail.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script runtime.pass.sh using profile (all) OK

rhel8 - mount_option_tmp_noexec - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
INFO - Script fstab.fail.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script runtime.pass.sh using profile (all) OK

rhel8 - mount_option_tmp_nosuid - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
INFO - Script runtime.pass.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script fstab.fail.sh using profile (all) OK

rhel8 - mount_option_var_tmp_nodev - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
INFO - Script fstab.fail.sh using profile (all) OK
INFO - Script runtime.pass.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script notapplicable.pass.sh using profile (all) OK

rhel8 - mount_option_var_tmp_noexec - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
INFO - Script runtime.pass.sh using profile (all) OK
INFO - Script fstab.fail.sh using profile (all) OK
INFO - Script separate.pass.sh using profile (all) OK

rhel8 - mount_option_var_tmp_nosuid - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
INFO - Script separate.pass.sh using profile (all) OK
INFO - Script fstab.fail.sh using profile (all) OK
INFO - Script runtime.pass.sh using profile (all) OK

After the fix:

rhel8 - mount_option_tmp_nodev - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev evaluation resulted in notapplicable
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev evaluation resulted in notapplicable
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev evaluation resulted in notapplicable

rhel8 - mount_option_tmp_noexec - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec evaluation resulted in notapplicable
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec evaluation resulted in notapplicable
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec evaluation resulted in notapplicable

rhel8 - mount_option_tmp_nosuid - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid evaluation resulted in notapplicable
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid evaluation resulted in notapplicable
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid evaluation resulted in notapplicable

rhel8 - mount_option_var_tmp_nodev - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev evaluation resulted in notapplicable
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev evaluation resulted in notapplicable
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev evaluation resulted in notapplicable
WARNING - Script notapplicable.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev evaluation resulted in notapplicable

rhel8 - mount_option_var_tmp_noexec - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec evaluation resulted in notapplicable
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec evaluation resulted in notapplicable
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec evaluation resulted in notapplicable

rhel8 - mount_option_var_tmp_nosuid - bash VM
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
WARNING - Script separate.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid evaluation resulted in notapplicable
WARNING - Script fstab.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid evaluation resulted in notapplicable
WARNING - Script runtime.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid evaluation resulted in notapplicable

marcusburghardt

LGTM

Backport of #10431

evgenyz mentioned this pull request Apr 6, 2023

Ensure checks on mount options return 'notapplicable' when mount does not exist #10295

Closed

evgenyz added 2 commits April 6, 2023 04:06

shared/applicability: Replace partition-tmp and partition-var-tmp with

018bbe2

a new templated platform mount[] The platform conditionals now check for the /etc/fstab entries in addition to active mountpoint presence. Also the name better reflects the nature of the check.

permissions/partitions: Add mount[] platform to mount_option_tmp*

442aa3e

and mount_option_var_tmp* rules This restores previously removed 'not applicable' behavior of these rules for systems where mountpoints have not been configured.

evgenyz force-pushed the fix_mount_options_not_applicable branch from e7ec398 to 442aa3e Compare April 6, 2023 02:06

evgenyz added usability Enhancements related to usability. bugfix Fixes to reported bugs. labels Apr 6, 2023

evgenyz changed the title ~~Add mount[] paltform and use it for /tmp and /var/tmp mount option rules~~ Add mount[] platform and use it for /tmp and /var/tmp mount option rules Apr 6, 2023

This was referenced Apr 6, 2023

Fix dev shm noexec #10436

Closed

Fix mount options not applicable #10437

Closed

Mab879 self-assigned this Apr 6, 2023

Mab879 approved these changes Apr 6, 2023

View reviewed changes

Mab879 added a commit to Mab879/content that referenced this pull request Apr 6, 2023

Backport of ComplianceAsCode#10431

f92ffd6

Co-authored-by: Evgeny Kolesnikov <ekolesni@redhat.com>

Mab879 mentioned this pull request Apr 6, 2023

Backport of #10431 #10438

Merged

Mab879 added the backported-into-stabilization PRs which were cherry-picked during stabilization process. label Apr 6, 2023

Mab879 added this to the 0.1.67 milestone Apr 6, 2023

marcusburghardt approved these changes Apr 6, 2023

View reviewed changes

marcusburghardt added a commit that referenced this pull request Apr 6, 2023

Merge pull request #10438 from Mab879/backport_10431

0313d3b

Backport of #10431

marcusburghardt merged commit ffc50a9 into ComplianceAsCode:master Apr 6, 2023
44 of 49 checks passed

Mab879 mentioned this pull request Apr 6, 2023

mount_option_* References an Undefined CPE Check #10440

Closed

jan-cerny mentioned this pull request Apr 27, 2023

Add the mount platform to all relevant rules #10504

Closed

j-ode mentioned this pull request Apr 27, 2023

Mount option rules have inconsistent results after remediation #10508

Open

Add mount[] platform and use it for /tmp and /var/tmp mount option rules #10431

Add mount[] platform and use it for /tmp and /var/tmp mount option rules #10431

evgenyz commented Apr 6, 2023 •

edited

github-actions bot commented Apr 6, 2023

codeclimate bot commented Apr 6, 2023

Mab879 commented Apr 6, 2023

Mab879 left a comment

marcusburghardt commented Apr 6, 2023

marcusburghardt left a comment

Add mount[] platform and use it for /tmp and /var/tmp mount option rules #10431

Add mount[] platform and use it for /tmp and /var/tmp mount option rules #10431

Conversation

evgenyz commented Apr 6, 2023 • edited

Description:

Rationale:

Review Hints:

github-actions bot commented Apr 6, 2023

codeclimate bot commented Apr 6, 2023

Mab879 commented Apr 6, 2023

Mab879 left a comment

Choose a reason for hiding this comment

marcusburghardt commented Apr 6, 2023

marcusburghardt left a comment

Choose a reason for hiding this comment

evgenyz commented Apr 6, 2023 •

edited