Add new rule file_cron_allow_exists

[jan-cerny]

Add new rule file_cron_allow_exists and add it to CIS profiles because the CIS RHEL Benchmark requires the file /etc/cron.allow to exist.

The other rules within the control that check the ownership and permissions on /etc/cron.allow are passing if this file doesn't exist. The file doesn't exist by default. To ensure the file exists, we add a new rule that creates it.

Resolves: https://issues.redhat.com/browse/RHEL-1314

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[marcusburghardt]

Is the name dne.fail.sh intentional? Maybe we can rename the file to more easily reflect the test?

[jan-cerny]

dne is acronym for "does not exist"

[marcusburghardt]

Ah ok. Thanks. It was not obvious to me. : ) So, all fine to keep this name if you prefer.

[marcusburghardt]

It would be great to extend this template to also accept mode and ownership properties as parameters for the remediation when creating the file. This would avoid the rules file_groupowner_cron_allow, file_owner_cron_allow and file_permissions_cron_allow to fail after creating the file.

[jan-cerny]

yes, that'd be amazing!

[jan-cerny]

Now there is a problem with the dependency between rules - during the initial scan, the file_permissions_cron_allow passed because /etc/cron.allow doesn't exist but then in the remediation phase the remediation for the rule file_cron_allow_exists creates /etc/cron.allow but remediation for file_permissions_cron_allow isn't executed because it passed during the inital scan so consequently in the final scan the file exists but with default permissions so the rule file_permissions_cron_allow fails.

[marcusburghardt]

Now there is a problem with the dependency between rules - during the initial scan, the file_permissions_cron_allow passed because /etc/cron.allow doesn't exist but then in the remediation phase the remediation for the rule file_cron_allow_exists creates /etc/cron.allow but remediation for file_permissions_cron_allow isn't executed because it passed during the inital scan so consequently in the final scan the file exists but with default permissions so the rule file_permissions_cron_allow fails.

I recently commented about this: #11441 (comment)
It seems a better alternative to extend the template. Otherwise the user would need to scan and remediate the system twice.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_at_deny_not_exist' differs.
--- xccdf_org.ssgproject.content_rule_file_at_deny_not_exist
+++ xccdf_org.ssgproject.content_rule_file_at_deny_not_exist
@@ -1,11 +1,7 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-#!/bin/bash
-
-
-
-    if [[ -f  /etc/at.deny ]]; then
+if [[ -f  /etc/at.deny ]]; then
         rm /etc/at.deny
     fi
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist' differs.
--- xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist
+++ xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist
@@ -1,11 +1,7 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-#!/bin/bash
-
-
-
-    if [[ -f  /etc/cron.deny ]]; then
+if [[ -f  /etc/cron.deny ]]; then
         rm /etc/cron.deny
     fi
 

[codeclimate]

Code Climate has analyzed commit ed654d2 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5% (0.0% change).

View more on Code Climate.

[jan-cerny]

I have improved the file_existence template so that the remediations will create files with given uid and permissions and I have used this in the rule file_cron_allow_exists to help avoid the aforementioned remediation time conflict.

[Mab879]

LGTM.

Thanks for the PR!

Waving the SLES Automatus failure as this rule is only applicable to RHEL currently.