align ospp audit rules with the latest upstream release #8152

vojtapolasek · 2022-02-04T16:09:04Z

Description:

unify the file content for rhel9 and rhel8 products
remove extra test scenarios and test data for rhel9
align files with sample-rules shipped in Audit 3.0.7

Rationale:

Both rhel8 and rhel9 content of audit rules related to ospp got updated.

github-actions · 2022-02-04T16:09:52Z

Start a new ephemeral environment with changes proposed in this pull request:

github-actions · 2022-02-04T16:13:05Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_access_failed' differs:
--- old datastream
+++ new datastream
@@ -2,9 +2,9 @@
 cat /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
 The output has to be exactly as follows:
 ## Unsuccessful file access (any other opens) This has to go last.
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access 
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access 
 Is it the case that the file does not exist or the content differs?
 
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_access_failed' differs:
--- old datastream
+++ new datastream
@@ -3,10 +3,10 @@
 
 cat << 'EOF' > /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
 ## Unsuccessful file access (any other opens) This has to go last.
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
 EOF
 
 chmod o-rwx /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_access_failed' differs:
--- old datastream
+++ new datastream
@@ -4,10 +4,10 @@
 dest: /etc/audit/rules.d/30-ospp-v42-3-access-failed.rules
 content: |
 ## Unsuccessful file access (any other opens) This has to go last.
- -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
- -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
- -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
- -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+ -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+ -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+ -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
+ -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-access
 force: true
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_access_success' differs:
--- old datastream
+++ new datastream
@@ -3,7 +3,7 @@
 The output has to be exactly as follows:
 ## Successful file access (any other opens) This has to go last.
 ## These next two are likely to result in a whole lot of events
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access 
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access 
 Is it the case that the file does not exist or the content differs?
 
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_access_success' differs:
--- old datastream
+++ new datastream
@@ -4,8 +4,8 @@
 cat << 'EOF' > /etc/audit/rules.d/30-ospp-v42-3-access-success.rules
 ## Successful file access (any other opens) This has to go last.
 ## These next two are likely to result in a whole lot of events
--a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
--a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+-a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
 EOF
 
 chmod o-rwx /etc/audit/rules.d/30-ospp-v42-3-access-success.rules

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_access_success' differs:
--- old datastream
+++ new datastream
@@ -5,8 +5,8 @@
 content: |
 ## Successful file access (any other opens) This has to go last.
 ## These next two are likely to result in a whole lot of events
- -a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
- -a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+ -a always,exit -F arch=b32 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
+ -a always,exit -F arch=b64 -S open,openat,openat2,open_by_handle_at -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-access
 force: true
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_ospp_general' differs:
--- old datastream
+++ new datastream
@@ -60,6 +60,10 @@
 
 ## Privilege escalation via su or sudo. This is entirely handled by pam.
 
+## Watch for configuration changes to privilege escalation.
+-a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
+-a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
+
 ## Audit log access
 -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
 ## Attempts to Alter Process and Session Initiation Information

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_ospp_general' differs:
--- old datastream
+++ new datastream
@@ -61,6 +61,10 @@
 
 ## Privilege escalation via su or sudo. This is entirely handled by pam.
 
+## Watch for configuration changes to privilege escalation.
+-a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
+-a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
+
 ## Audit log access
 -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
 ## Attempts to Alter Process and Session Initiation Information

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_ospp_general' differs:
--- old datastream
+++ new datastream
@@ -61,6 +61,10 @@
 
 ## Privilege escalation via su or sudo. This is entirely handled by pam.
 
+ ## Watch for configuration changes to privilege escalation.
+ -a always,exit -F path=/etc/sudoers -F perm=wa -F key=special-config-changes
+ -a always,exit -F dir=/etc/sudoers.d/ -F perm=wa -F key=special-config-changes
+
 ## Audit log access
 -a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail
 ## Attempts to Alter Process and Session Initiation Information

jan-cerny · 2022-02-07T12:49:40Z

@mildas @vojtapolasek @ggbecker The test scenarios are all notapplicable, that's a similar problem we hit in #8146.

jan-cerny · 2022-02-07T13:07:15Z

@vojtapolasek If executed locally, starting from which version of the audit rpm package will the test scenario rules_from_audit_package.pass.sh pass?

ggbecker · 2022-02-07T17:06:22Z

@mildas @vojtapolasek @ggbecker The test scenarios are all notapplicable, that's a similar problem we hit in #8146.

Found the problem, newer versions of the build system is generating cpe name for machine as simply: #machine whereas previously it generated #cpe_platform_machine thus the test_suite.py needs to be updated accordingly here:

content/tests/ssg_test_suite/xml_operations.py

Lines 102 to 103 in 0d7ac62

    
           remove_platforms_from_element(root, "xccdf-1.2:Rule", "#cpe_platform_machine") 
        
           remove_platforms_from_element(root, "xccdf-1.2:Group", "#cpe_platform_machine")

I'm going to submit a PR for that, but I wonder if any other place should be updated as well.

vojtapolasek · 2022-02-08T12:24:36Z

I will rebase to reflect the changes in the test suite.

vojtapolasek · 2022-02-09T17:50:09Z

The tests are now updated to be aligned with Audit 3.0.7 upstream version. I think these are final changes.

Mab879 · 2022-02-09T20:32:28Z

/retest

vojtapolasek · 2022-02-10T11:30:03Z

/retest

vojtapolasek added bugfix Fixes to reported bugs. Test Scenario Update Rule Issues or pull requests related to Rules updates. labels Feb 4, 2022

vojtapolasek added this to the 0.1.61 milestone Feb 4, 2022

ggbecker mentioned this pull request Feb 7, 2022

Fix SSGTS platform machine overriding mechanism #8175

Merged

vojtapolasek added 2 commits February 8, 2022 13:25

unify content of file for rhel9 and rhel8

90430c0

remove extra tests for rhel9 case

ac8a9ce

vojtapolasek force-pushed the rhel86_ospp_fix_audit_ospp_general branch from 47ec298 to ac8a9ce Compare February 8, 2022 12:25

modify remaining files to be in sync with audit 3.0.7 upstream release

66a64fb

vojtapolasek changed the title ~~update audit_ospp_general for rhel 8~~ align ospp audit rules with the latest upstream release Feb 10, 2022

yuumasato self-assigned this Feb 11, 2022

yuumasato approved these changes Feb 11, 2022

View reviewed changes

yuumasato merged commit 95cd193 into ComplianceAsCode:master Feb 11, 2022

marcusburghardt added the Test Suite Update in Test Suite. label Jun 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

align ospp audit rules with the latest upstream release #8152

align ospp audit rules with the latest upstream release #8152

vojtapolasek commented Feb 4, 2022 •

edited

Loading

github-actions bot commented Feb 4, 2022 •

edited

Loading

github-actions bot commented Feb 4, 2022 •

edited

Loading

jan-cerny commented Feb 7, 2022

jan-cerny commented Feb 7, 2022

ggbecker commented Feb 7, 2022

vojtapolasek commented Feb 8, 2022

vojtapolasek commented Feb 9, 2022

Mab879 commented Feb 9, 2022

vojtapolasek commented Feb 10, 2022

align ospp audit rules with the latest upstream release #8152

align ospp audit rules with the latest upstream release #8152

Conversation

vojtapolasek commented Feb 4, 2022 • edited Loading

Description:

Rationale:

github-actions bot commented Feb 4, 2022 • edited Loading

github-actions bot commented Feb 4, 2022 • edited Loading

jan-cerny commented Feb 7, 2022

jan-cerny commented Feb 7, 2022

ggbecker commented Feb 7, 2022

vojtapolasek commented Feb 8, 2022

vojtapolasek commented Feb 9, 2022

Mab879 commented Feb 9, 2022

vojtapolasek commented Feb 10, 2022

vojtapolasek commented Feb 4, 2022 •

edited

Loading

github-actions bot commented Feb 4, 2022 •

edited

Loading

github-actions bot commented Feb 4, 2022 •

edited

Loading