Allow audit syscall rules remediations to group the syscalls #7329

yuumasato · 2021-08-04T13:17:06Z

Description:

Improve and extend rule skeleton matching with more explicit rule options for action, list, arch, auid and other filters.
Make explicit the syscalls that can through the syscall_groupings parameter.
- When syscall_groupings is empty, it will always add a new rule if not found.
Make they key to use more explicit, instead of implicit through 'group'.
Update the Ansible remediations (8af4ced)
~~Add tests for fix_audit_syscall_rule~~ I think the unit tests are not suited for this function. The function directly edits the rule files in /etc/audit and would be better run on a VM. If will need a VM anyway, I'd rather check and improve the test scenarios if needed.
Improve/adapt test scenarios (I believe the current test scenarios served pretty well to find bugs).

Rationale:

The function actually separated the syscalls into individual lines.

openshift-ci · 2021-08-04T13:17:08Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

yuumasato · 2021-08-04T13:39:50Z

Given the '-F auid=0` changes in #6910, I'm considering bringing the input to the Bash template directly to the 'rule.yml'.

yuumasato · 2021-08-04T13:44:10Z

I think I'll rebase this PR on top of #6910 to take advantage of the rule selections in the profile.

pep8speaks · 2021-08-05T07:59:12Z

Hello @yuumasato! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! 🍻

Comment last updated at 2021-08-19 13:36:08 UTC

The function actually separated the syscalls into individual lines. * Improve and extend rule skeleton matching with more explicit rule options for action, arch, auid and other filters. * Make explicit the syscalls that can be grouped through the 'syscall_groupings' parameter. * Make they key to use more explicit, instead of implicit through 'group'.

The ";F" was not a typo! Hopefully this makes it more explicit the function of '-e "F"'.

When syscall is not set, just don't add the -S parameter. The audit privileged commands use the fix_audit_syscall_rule despite not adding a -S syscall. Same situation happens for directory_access_var_log_audit.

Some rules deal with single handedly with multiple profiles. These rules expect to use the fix_audit_syscall_rule to add a rule with muliple syscalls at a time.

Enhance the bash function to nicely handle calls without auid filters defined. And updated the remediations of rules calling fix_audit_syscall_rule to the new parameters.

The OVAL check was also updated to accept the key as a Field parameter.

Update rules audit_rules_time_clock_settime and bash shared remediation perform_audit_adjtimex_settimeofday_stime_remediation to group their syscalls.

yuumasato · 2021-08-06T09:53:02Z

I think the Bash remediations are in good shape and good for review.

The macros now group the syscall rule according to the grouping argument The Ansible macros follow same argument pattern as the Bash remediations (soon to become macros).

Use Ansible macro ansible_audit_augenrules_add_syscall_rule and ansible_audit_auditctl_add_syscall_rule that group the syscalls according to defined grouping.

…macro Use Ansible macro ansible_audit_augenrules_add_syscall_rule and ansible_audit_auditctl_add_syscall_rule that group the syscalls according to defined grouping.

The Ansible macros for audit syscall rules should check the target syscall and the groupable syscalls during 'find' task. When 'syscall_grouping' was empty, the remediation would simply execute the 'Add a new rule' task. If the key was different, a new duplicate rule would be added. Also removes extra syscalls declaration task.

JAORMX

Any chance this could be added to the kubernetes templates as well?

JAORMX · 2021-08-18T09:13:49Z

@yuumasato some of them are using straight up MachineConfigs... while we could now replace those entries with jinja to show the actual audit rule. I could help with that if you want.

shared/templates/audit_rules_dac_modification/ansible.template

yuumasato · 2021-08-18T12:35:36Z

Any chance this could be added to the kubernetes templates as well?

Do you mean to add the grouping capability to the kubernetes remediations?
I don't know how that could be done, but we can discuss it if you have any idea.

@yuumasato some of them are using straight up MachineConfigs... while we could now replace those entries with jinja to show the actual audit rule. I could help with that if you want.

@JAORMX You mean with url_encode()?

When running a playbook profile, they were accumulating over the entire run.

JAORMX · 2021-08-18T16:17:07Z

@yuumasato and I talked, and there's nothing to do for the kubernetes remediations as of now.

openshift-ci · 2021-08-19T12:40:24Z

@yuumasato: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-ocp4-moderate	`34a6691`	link	`/test e2e-aws-ocp4-moderate`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

shared/macros-ansible.jinja

Otherwise the rule will be added with two spaces between other_filters and auid_filters.

ggbecker

LGTM. Thank you for these changes. It was a really nice improvement to the project.

Variables should have spaces before and after

yuumasato requested a review from ggbecker August 4, 2021 13:17

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 4, 2021

yuumasato force-pushed the group_audit_syscalls branch from 0b35ab3 to 12636e2 Compare August 5, 2021 07:59

yuumasato mentioned this pull request Aug 5, 2021

Audit rhel8 stig #6910

Merged

5 tasks

yuumasato added 11 commits August 5, 2021 21:55

Set syscall grouping for chmod rules

4c682ea

Set syscall grouping for chown rules

eaaaa86

Set syscall groupings for set/remove xattr rules

b1d747c

Set syscall groupings for remove and delete rules

46a0879

Set syscall grouping for create, open and truncate rules

121afe1

Print filenames in sed command

9dd2d39

The ";F" was not a typo! Hopefully this makes it more explicit the function of '-e "F"'.

Handle cases where the rule has no syscall

56194ca

When syscall is not set, just don't add the -S parameter. The audit privileged commands use the fix_audit_syscall_rule despite not adding a -S syscall. Same situation happens for directory_access_var_log_audit.

Enhance fix_audit_syscall_rule to handle multiple syscalls

aa3b0ea

Some rules deal with single handedly with multiple profiles. These rules expect to use the fix_audit_syscall_rule to add a rule with muliple syscalls at a time.

Enhance fix_audit_syscall_rule to handle rules without auid

0b18f68

Enhance the bash function to nicely handle calls without auid filters defined. And updated the remediations of rules calling fix_audit_syscall_rule to the new parameters.

Move suid_privileged_function to new fix_audit_sycall_rule

8c49844

The OVAL check was also updated to accept the key as a Field parameter.

yuumasato force-pushed the group_audit_syscalls branch from 12636e2 to 8c49844 Compare August 5, 2021 20:05

Update remediarions for time syscalls rules

ed948b7

Update rules audit_rules_time_clock_settime and bash shared remediation perform_audit_adjtimex_settimeofday_stime_remediation to group their syscalls.

yuumasato marked this pull request as ready for review August 6, 2021 09:51

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 6, 2021

This was referenced Aug 11, 2021

Convert perform_audit_adjtimex_settimeofday_stime_remediation to Jinja macro #7360

Closed

Converted perform_audit_adjtimex_settimeofday_stime_remediation and fix_audit_syscall_rule bash functions and their calls to jinja macros #7375

Closed

yuumasato added 4 commits August 17, 2021 18:47

Improve audit syscall rule macro to group syscalls

8af4ced

The macros now group the syscall rule according to the grouping argument The Ansible macros follow same argument pattern as the Bash remediations (soon to become macros).

Move template audit_rules_path_syscall to Ansible macro

a355d5b

Move template audit_rules_dac_modification to Ansible macro

27d6432

Use Ansible macro ansible_audit_augenrules_add_syscall_rule and ansible_audit_auditctl_add_syscall_rule that group the syscalls according to defined grouping.

Move template audit_rules_unsuccessfull_file_modification to Ansible …

cd507f5

…macro Use Ansible macro ansible_audit_augenrules_add_syscall_rule and ansible_audit_auditctl_add_syscall_rule that group the syscalls according to defined grouping.

Python style fixes

78664de

yuumasato force-pushed the group_audit_syscalls branch from 4a7ca16 to 78664de Compare August 17, 2021 17:38

yuumasato mentioned this pull request Aug 17, 2021

SSG: Typo in auditd kernel module (un)loading remediation script #3833

Closed

yuumasato added 3 commits August 18, 2021 10:22

Fix typo in Ansible remediarion for unsuccessful_file_modification

16df697

Improve task titles of audit macros and templates

2a2697e

JAORMX reviewed Aug 18, 2021

View reviewed changes

ggbecker reviewed Aug 18, 2021

View reviewed changes

shared/templates/audit_rules_dac_modification/ansible.template Outdated Show resolved Hide resolved

ggbecker added this to the 0.1.58 milestone Aug 18, 2021

yuumasato added the DISA RHEL8 STIG Alignment label Aug 18, 2021

Fix typo in audit task block title

6dd2a03

yuumasato force-pushed the group_audit_syscalls branch from 8e3e3b9 to 6dd2a03 Compare August 18, 2021 12:24

Reset the tracking of syscalls found per file

fe88dfb

When running a playbook profile, they were accumulating over the entire run.

ggbecker self-assigned this Aug 18, 2021

Create audit rules without permissions for others

34a6691

yuumasato force-pushed the group_audit_syscalls branch from a6feeff to 34a6691 Compare August 19, 2021 11:23

ggbecker reviewed Aug 19, 2021

View reviewed changes

shared/macros-ansible.jinja Outdated Show resolved Hide resolved

yuumasato added 2 commits August 19, 2021 14:48

Remove trailing space from perm field

181a0f9

Otherwise the rule will be added with two spaces between other_filters and auid_filters.

Fix typos in task titles

c94454f

yuumasato force-pushed the group_audit_syscalls branch from db4f788 to c94454f Compare August 19, 2021 12:59

ggbecker approved these changes Aug 19, 2021

View reviewed changes

Fix Ansible linter issue

a5e9906

Variables should have spaces before and after

ggbecker merged commit 049506a into ComplianceAsCode:master Aug 19, 2021

yuumasato deleted the group_audit_syscalls branch August 19, 2021 14:44

marcusburghardt added RHEL8 Red Hat Enterprise Linux 8 product related. STIG STIG Benchmark related. labels Jun 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow audit syscall rules remediations to group the syscalls #7329

Allow audit syscall rules remediations to group the syscalls #7329

yuumasato commented Aug 4, 2021 •

edited

openshift-ci bot commented Aug 4, 2021

yuumasato commented Aug 4, 2021

yuumasato commented Aug 4, 2021

pep8speaks commented Aug 5, 2021 •

edited

yuumasato commented Aug 6, 2021

JAORMX left a comment

JAORMX commented Aug 18, 2021

yuumasato commented Aug 18, 2021

JAORMX commented Aug 18, 2021

openshift-ci bot commented Aug 19, 2021

ggbecker left a comment

Allow audit syscall rules remediations to group the syscalls #7329

Allow audit syscall rules remediations to group the syscalls #7329

Conversation

yuumasato commented Aug 4, 2021 • edited

Description:

Rationale:

openshift-ci bot commented Aug 4, 2021

yuumasato commented Aug 4, 2021

yuumasato commented Aug 4, 2021

pep8speaks commented Aug 5, 2021 • edited

Comment last updated at 2021-08-19 13:36:08 UTC

yuumasato commented Aug 6, 2021

JAORMX left a comment

Choose a reason for hiding this comment

JAORMX commented Aug 18, 2021

yuumasato commented Aug 18, 2021

JAORMX commented Aug 18, 2021

openshift-ci bot commented Aug 19, 2021

ggbecker left a comment

Choose a reason for hiding this comment

yuumasato commented Aug 4, 2021 •

edited

pep8speaks commented Aug 5, 2021 •

edited