Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update few sysctl rules to accept multiple compliant values #9286

Conversation

yuumasato
Copy link
Member

Description:

  • Update the rules listed below to accept multiple values as compliant.
    • sysctl_net_ipv4_conf_all_rp_filter
    • sysctl_kernel_kptr_restrict

Rationale:

  • Better align the rules with the RHEL and OL STIGs.

This also removes value '0' from the list of possible configurations.
This change aligns the rule better with STIG.
This also removes value '0' from the list of possible configurations.
This change aligns the rule better with STIG.
The rule only accepts values 1 or 2 as compliant, the XCCDF Variable
cannot have the value 0, it will never result in pass.
For now, the only STIGs I see that adopted this change were RHEL's and
OL's.
@yuumasato yuumasato added Update Rule Issues or pull requests related to Rules updates. RHEL8 Red Hat Enterprise Linux 8 product related. STIG STIG Benchmark related. labels Aug 3, 2022
@yuumasato yuumasato added this to the 0.1.64 milestone Aug 3, 2022
@github-actions
Copy link

github-actions bot commented Aug 3, 2022

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@jan-cerny jan-cerny self-assigned this Aug 3, 2022
Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CI fail is probably caused by the container environment, when I execute it on a virtual machine backend, they all pass:

[jcerny@thinkpad scap-security-guide{pr/9283}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 sysctl_kernel_kptr_restrict,sysctl_net_ipv4_conf_all_rp_filter
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2022-08-03-1315/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
INFO - Script two_sysctls_on_same_file_name.fail.sh using profile (all) OK
INFO - Script symlinks_to_same_file.pass.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file.pass.sh using profile (all) OK
INFO - Script symlink_repeated_sysctl_conf.pass.sh using profile (all) OK
INFO - Script symlink_same_option.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_d.fail.sh using profile (all) OK
INFO - Script symlink_root_incompliant.fail.sh using profile (all) OK
INFO - Script wrong_runtime.fail.sh using profile (all) OK
INFO - Script one_sysctl_conf_one_sysctl_d.fail.sh using profile (all) OK
INFO - Script symlink_different_option.pass.sh using profile (all) OK
INFO - Script wrong_value_d_directory.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script symlink_root_duplicate.fail.sh using profile (all) OK
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/9286}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible sysctl_kernel_kptr_restrict,sysctl_net_ipv4_conf_all_rp_filter
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2022-08-03-1321/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
INFO - Script one_sysctl_conf_one_sysctl_d.fail.sh using profile (all) OK
INFO - Script symlink_root_duplicate.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_d.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file.pass.sh using profile (all) OK
INFO - Script symlink_repeated_sysctl_conf.pass.sh using profile (all) OK
INFO - Script symlink_same_option.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script symlink_root_incompliant.fail.sh using profile (all) OK
INFO - Script wrong_runtime.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script symlink_different_option.pass.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file_name.fail.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script symlinks_to_same_file.pass.sh using profile (all) OK
INFO - Script wrong_value_d_directory.fail.sh using profile (all) OK
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK

@github-actions
Copy link

github-actions bot commented Aug 3, 2022

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff
OCIL for rule 'xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter' differs:
--- old datastream
+++ new datastream
@@ -1,7 +1,25 @@
-The runtime status of the net.ipv4.conf.all.rp_filter kernel parameter can be queried
+The runtime status of the net.ipv4.conf.all.rp_filter parameter can be queried
 by running the following command:
 $ sysctl net.ipv4.conf.all.rp_filter
-1.
+The output of the command should indicate either:
+net.ipv4.conf.all.rp_filter = 1
+or:
+net.ipv4.conf.all.rp_filter = 2
+The output of the command should not indicate:
+net.ipv4.conf.all.rp_filter = 0
 
- Is it the case that the correct value is not returned?
+The preferable way how to assure the runtime compliance is to have
+correct persistent configuration, and rebooting the system.
+
+The persistent sysctl parameter configuration is performed by specifying the appropriate
+assignment in any file located in the /etc/sysctl.d directory.
+Verify that there is not any existing incorrect configuration by executing the following command:
+$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
+The command should not find any assignments other than:
+net.ipv4.conf.all.rp_filter = 1
+or:
+net.ipv4.conf.all.rp_filter = 2
+
+Conflicting assignments are not allowed.
+ Is it the case that the net.ipv4.conf.all.rp_filter is not set to 1 or 2 or is configured to be 0?
 
OCIL for rule 'xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict' differs:
--- old datastream
+++ new datastream
@@ -1,7 +1,25 @@
 The runtime status of the kernel.kptr_restrict kernel parameter can be queried
 by running the following command:
 $ sysctl kernel.kptr_restrict
-1.
+The output of the command should indicate either:
+kernel.kptr_restrict = 1
+or:
+kernel.kptr_restrict = 2
+The output of the command should not indicate:
+kernel.kptr_restrict = 0
 
- Is it the case that the correct value is not returned?
+The preferable way how to assure the runtime compliance is to have
+correct persistent configuration, and rebooting the system.
+
+The persistent kernel parameter configuration is performed by specifying the appropriate
+assignment in any file located in the /etc/sysctl.d directory.
+Verify that there is not any existing incorrect configuration by executing the following command:
+$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
+The command should not find any assignments other than:
+kernel.kptr_restrict = 1
+or:
+kernel.kptr_restrict = 2
+
+Conflicting assignments are not allowed.
+ Is it the case that the kernel.kptr_restrict is not set to 1 or 2 or is configured to be 0?

The OCIL should should mention both compliant values.
@yuumasato yuumasato force-pushed the update_sysctl_rules_with_new_compliant_values branch from 5f4b2f7 to a159f7d Compare August 3, 2022 12:22
@codeclimate
Copy link

codeclimate bot commented Aug 3, 2022

Code Climate has analyzed commit a159f7d and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 42.7% (0.0% change).

View more on Code Climate.

@openshift-ci
Copy link

openshift-ci bot commented Aug 3, 2022

@yuumasato: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-rhcos4-moderate a159f7d link true /test e2e-aws-rhcos4-moderate
ci/prow/e2e-aws-rhcos4-high a159f7d link true /test e2e-aws-rhcos4-high

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[jcerny@thinkpad scap-security-guide{pr/9286}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 sysctl_kernel_kptr_restrict
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2022-08-04-1402/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict
INFO - Script one_sysctl_conf_one_sysctl_d.fail.sh using profile (all) OK
INFO - Script symlink_repeated_sysctl_conf.pass.sh using profile (all) OK
INFO - Script symlink_same_option.fail.sh using profile (all) OK
INFO - Script symlink_root_incompliant.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file.pass.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script symlink_root_duplicate.fail.sh using profile (all) OK
INFO - Script symlinks_to_same_file.pass.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_d.fail.sh using profile (all) OK
INFO - Script wrong_runtime.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file_name.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_value_d_directory.fail.sh using profile (all) OK
INFO - Script symlink_different_option.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/9286}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 sysctl_net_ipv4_conf_all_rp_filter
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2022-08-04-1408/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter
INFO - Script two_sysctls_on_same_file.pass.sh using profile (all) OK
INFO - Script one_sysctl_conf_one_sysctl_d.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script symlink_repeated_sysctl_conf.pass.sh using profile (all) OK
INFO - Script wrong_runtime.fail.sh using profile (all) OK
INFO - Script symlink_root_duplicate.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_d.fail.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script symlink_same_option.fail.sh using profile (all) OK
INFO - Script symlink_root_incompliant.fail.sh using profile (all) OK
INFO - Script two_sysctls_on_same_file_name.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script symlinks_to_same_file.pass.sh using profile (all) OK
INFO - Script symlink_different_option.pass.sh using profile (all) OK
INFO - Script wrong_value_d_directory.fail.sh using profile (all) OK
INFO - Script value_1.pass.sh using profile (all) OK
INFO - Script value_2.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/9286}]$ 

@jan-cerny jan-cerny merged commit 8e15641 into ComplianceAsCode:master Aug 4, 2022
@yuumasato yuumasato deleted the update_sysctl_rules_with_new_compliant_values branch August 4, 2022 12:55
@ggbecker
Copy link
Member

ggbecker commented Aug 4, 2022

Unfortunately there are issues with the build using OVAL 5.10:

Traceback (most recent call last):
  File "/home/ggasparb/workspace/github/content/build-scripts/relabel_ids.py", line 65, in <module>
    main()
  File "/home/ggasparb/workspace/github/content/build-scripts/relabel_ids.py", line 52, in main
    oval_linker.link_xccdf()
  File "/home/ggasparb/workspace/github/content/ssg/build_renumber.py", line 93, in link_xccdf
    self.add_missing_check_exports(check, checkcontentref)
  File "/home/ggasparb/workspace/github/content/ssg/build_renumber.py", line 221, in add_missing_check_exports
    for def_id in self.get_nested_definitions(check_name):
  File "/home/ggasparb/workspace/github/content/ssg/build_renumber.py", line 207, in get_nested_definitions
    extensions = find_extending_defs(self.oval_groups, definition_tree)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 98, in find_extending_defs
    return _find_attr(oval_groups, defn, "extend_definition", "definition_ref")
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 89, in _find_attr
    finder.find_element(defn, elem, attr)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 35, in find_element
    self._recurse(start_element)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 44, in _recurse
    self._recurse(child)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 44, in _recurse
    self._recurse(child)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 42, in _recurse
    self._examine_element(element)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 61, in _examine_element
    self._recurse(new_root)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 44, in _recurse
    self._recurse(child)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 42, in _recurse
    self._examine_element(element)
  File "/home/ggasparb/workspace/github/content/ssg/parse_oval.py", line 58, in _examine_element
    new_root = self.oval_groups[reference_target][entity_id]
KeyError: 'object_sysctl_kernel_unprivileged_bpf_disabled_accept_default_static_set_sysctls'
[10/20] [rhel9-content] generating ssg-rhel9-cpe-dictionary.xml, ssg-rhel9-cpe-oval.xml
ninja: build stopped: subcommand failed.

More code here should be applicable only to OVAL 5.11:
https://github.com/ComplianceAsCode/content/blob/master/shared/templates/sysctl/oval.template#L156-L186

This problem was probably introduced in the PR that introduced support to multiple values, not this one.

yuumasato pushed a commit to yuumasato/scap-security-guide that referenced this pull request Aug 8, 2022
…_rules_with_new_compliant_values

Update few sysctl rules to accept multiple compliant values

Patch-name: scap-security-guide-0.1.64-add_multivalue_compliance_kptr_rp_filter.patch
Patch-status: Update few sysctl rules to accept multiple compliant values
yuumasato pushed a commit to yuumasato/scap-security-guide that referenced this pull request Aug 11, 2022
…_rules_with_new_compliant_values

Update few sysctl rules to accept multiple compliant values

Patch-name: scap-security-guide-0.1.64-add_multivalue_compliance_kptr_rp_filter-PR_9286.patch
Patch-status: Update few sysctl rules to accept multiple compliant values
yuumasato pushed a commit to yuumasato/scap-security-guide that referenced this pull request Aug 11, 2022
…_rules_with_new_compliant_values

Update few sysctl rules to accept multiple compliant values

Patch-name: scap-security-guide-0.1.64-add_multivalue_compliance_kptr_rp_filter-PR_9286.patch
Patch-status: Update few sysctl rules to accept multiple compliant values
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
RHEL8 Red Hat Enterprise Linux 8 product related. STIG STIG Benchmark related. Update Rule Issues or pull requests related to Rules updates.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants