Updates of the rule use_pam_wheel_group_for_su #10714

rumch-se · 2023-06-14T08:49:52Z

Description:

Added ansible part to the rule extend_use_pam_wheel_group_for_su and added logic for a creation of an empty group

Rationale:

According to the requirement /etc/pam.d/su has to include a line auth required pam_wheel.so use_uid group=sugroup, where sugroup is empty. The new changes fix this and add ansible part.

openshift-ci · 2023-06-14T08:50:03Z

Hi @rumch-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2023-06-14T08:51:36Z

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

jan-cerny · 2023-06-23T14:03:42Z

.../guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true

-prodtype: ubuntu2004,ubuntu2204
+prodtype: ubuntu2004,ubuntu2204,sle12,sle15


The prodtype isn't sorted which triggers the CI test.

jan-cerny · 2023-06-26T14:28:50Z

@rumch-se Please remove the "Merge" commit from this PR.

rumch-se · 2023-06-27T06:13:45Z

Hello @teacup-on-rockingchair
May you remove "Merge" commit from this PR, because there is a request for that.

Have a nice day
Rumen

jan-cerny · 2023-06-27T06:28:40Z

Why would @teacup-on-rockingchair do that? This PR is from a branch in @rumch-se 's fork.

rumch-se · 2023-06-27T06:40:27Z

Hello @jan-cerny,

There are 4 commits (3 of them done by me and the last one done by @teacup-on-rockingchair). The last one has "Merge" in its description. Are you talking about the last commit, aren't you?

Have a nice day
Rumen

jan-cerny · 2023-06-27T06:52:40Z

@rumch-se Yes, exactly! I'm talking about fca182e, please remove it from your PR. Pull request that contain merge commits can't be accepted, they would mess the git history.

Update order of prodtypes

rumch-se · 2023-06-27T07:48:41Z

Hello @jan-cerny and @teacup-on-rockingchair
I have removed the last commit.

Have a nice day
Rumen

wokis · 2023-06-27T15:24:31Z

.../system/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/bash/shared.sh

+if [ $(getent group ${var_pam_wheel_group_for_su}) ]; then
+  # group exists
+   groupdel -f ${var_pam_wheel_group_for_su}
+fi
+groupadd -f ${var_pam_wheel_group_for_su}
+
+


Isn't this handled by ensure_pam_wheel_group_empty already?

Hello @wokis

1/The rule https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/accounts/accounts-restrictions/root_logins/ensure_pam_wheel_group_empty - does not have ansible part.
According to this PR I am covering this part.

2/The rule is a part of ubuntu profile, and I am contribute for SLE 12/15.

Have a nice day
Rumen

Hello @wokis

1/The rule https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/accounts/accounts-restrictions/root_logins/ensure_pam_wheel_group_empty - does not have ansible part. According to this PR I am covering this part.

2/The rule is a part of ubuntu profile, and I am contribute for SLE 12/15.

As wokis mentioned, you should use the rule ensure_pam_wheel_group_empty together with use_pam_wheel_group_for_su otherwise you won't be checking through oval if the group is empty and the things you are adding to bash and ansible won't be needed here.

wokis · 2023-06-27T15:24:57Z

...tem/accounts/accounts-restrictions/root_logins/use_pam_wheel_group_for_su/ansible/shared.yml

+- name: {{{ rule_title }}} - Ensure group {{ var_pam_wheel_group_for_su }} is removed
+  group:
+    name: "{{ var_pam_wheel_group_for_su }}"
+    state: absent 
+
+- name: {{{ rule_title }}} - Ensure group {{ var_pam_wheel_group_for_su }} exist
+  group:
+    name: "{{ var_pam_wheel_group_for_su }}"
+    state: present


Isn't this handled by ensure_pam_wheel_group_empty already?

dodys

use ensure_pam_wheel_group_empty together with use_pam_wheel_group_for_su

rumch-se · 2023-06-29T07:33:06Z

Hello @dodys
I have modified both rules use_pam_wheel_group_for_su and ensure_pam_wheel_group_empty according to your recommendations.

Have a nice day
Rumen

dodys

lgtm, thanks for addressing our comments!
I will leave to @teacup-on-rockingchair to do the final review and merge it.

codeclimate · 2023-06-29T08:15:30Z

Code Climate has analyzed commit a6b6843 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.4% (0.0% change).

View more on Code Climate.

teacup-on-rockingchair

LGTM

rumch-se requested a review from a team as a code owner June 14, 2023 08:49

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jun 14, 2023

Mab879 added Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. CIS CIS Benchmark related. labels Jun 15, 2023

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jun 16, 2023

rumch-se force-pushed the extend_use_pam_wheel_group_for_su branch from fc3b154 to 90378e1 Compare June 19, 2023 07:36

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jun 19, 2023

marcusburghardt requested a review from a team June 21, 2023 09:36

marcusburghardt added the Ubuntu Ubuntu product related. label Jun 21, 2023

jan-cerny reviewed Jun 23, 2023

View reviewed changes

openshift-merge-robot added needs-rebase Used by openshift-ci bot. and removed needs-rebase Used by openshift-ci bot. labels Jun 23, 2023

rumch-se force-pushed the extend_use_pam_wheel_group_for_su branch from fca182e to c2cb156 Compare June 27, 2023 07:40

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jun 27, 2023

rumch-se and others added 3 commits June 27, 2023 09:46

Updates of the rule use_pam_wheel_group_for_su

b2871d1

A small correction in bash part of the rule

f6ce92c

Update rule.yml

b3e29ad

Update order of prodtypes

rumch-se force-pushed the extend_use_pam_wheel_group_for_su branch from c2cb156 to b3e29ad Compare June 27, 2023 07:47

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jun 27, 2023

wokis suggested changes Jun 27, 2023

View reviewed changes

Small correction in bash part

9a11550

dodys requested changes Jun 28, 2023

View reviewed changes

Modification of the rule ensure_pam_wheel_group_empty

a6b6843

dodys approved these changes Jun 29, 2023

View reviewed changes

teacup-on-rockingchair approved these changes Jul 5, 2023

View reviewed changes

teacup-on-rockingchair merged commit 90f35be into ComplianceAsCode:master Jul 5, 2023
30 of 33 checks passed

Mab879 added this to the 0.1.69 milestone Jul 5, 2023

marcusburghardt assigned teacup-on-rockingchair Aug 16, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updates of the rule use_pam_wheel_group_for_su #10714

Updates of the rule use_pam_wheel_group_for_su #10714

rumch-se commented Jun 14, 2023

openshift-ci bot commented Jun 14, 2023

github-actions bot commented Jun 14, 2023

jan-cerny Jun 23, 2023

jan-cerny commented Jun 26, 2023

rumch-se commented Jun 27, 2023

jan-cerny commented Jun 27, 2023

rumch-se commented Jun 27, 2023

jan-cerny commented Jun 27, 2023

rumch-se commented Jun 27, 2023

wokis Jun 27, 2023

rumch-se Jun 28, 2023

dodys Jun 28, 2023

wokis Jun 27, 2023

dodys left a comment

rumch-se commented Jun 29, 2023

dodys left a comment

codeclimate bot commented Jun 29, 2023

teacup-on-rockingchair left a comment

Updates of the rule use_pam_wheel_group_for_su #10714

Updates of the rule use_pam_wheel_group_for_su #10714

Conversation

rumch-se commented Jun 14, 2023

Description:

Rationale:

openshift-ci bot commented Jun 14, 2023

github-actions bot commented Jun 14, 2023

jan-cerny Jun 23, 2023

Choose a reason for hiding this comment

jan-cerny commented Jun 26, 2023

rumch-se commented Jun 27, 2023

jan-cerny commented Jun 27, 2023

rumch-se commented Jun 27, 2023

jan-cerny commented Jun 27, 2023

rumch-se commented Jun 27, 2023

wokis Jun 27, 2023

Choose a reason for hiding this comment

rumch-se Jun 28, 2023

Choose a reason for hiding this comment

dodys Jun 28, 2023

Choose a reason for hiding this comment

wokis Jun 27, 2023

Choose a reason for hiding this comment

dodys left a comment

Choose a reason for hiding this comment

rumch-se commented Jun 29, 2023

dodys left a comment

Choose a reason for hiding this comment

codeclimate bot commented Jun 29, 2023

teacup-on-rockingchair left a comment

Choose a reason for hiding this comment