generated from cisagov/ScubaGear
-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add policy group 5 in Classroom baseline stating that only verified t…
…eachers can create classes (#325) * Added Policy Group 19 * Added Class Creation Policy * Added Class Creation Policy * Added drift rules * Apply suggestions from code review Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com> * Revert gmail baseline * Reverse gmail drift rules * Fixed issue * Fixed Issues * Updated TOC * Update baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.2.md Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com> * Implemented 5.1 in rego * Update drift-rules/GWS Drift Monitoring Rules - Classroom.csv Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com> * Added TTP Mappings --------- Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com> Co-authored-by: Alden Hilton <adhilto@sandia.gov>
- Loading branch information
3 people
committed
Jul 3, 2024
1 parent
ac2f940
commit 29a3dae
Showing
4 changed files
with
294 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,188 @@ | ||
| package classroom | ||
| import future.keywords | ||
|
|
||
| # | ||
| # GWS.CLASSROOM.5.1v0.2 | ||
| #-- | ||
|
|
||
| test_ClassroomCreation_Correct_V1 if { | ||
| # Test only teachers can unenroll students when there's only one event | ||
| PolicyId := "GWS.CLASSROOM.5.1v0.2" | ||
| Output := tests with input as { | ||
| "classroom_logs": {"items": [ | ||
| { | ||
| "id": {"time": "2022-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "3"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| } | ||
| ]}, | ||
| "tenant_info": { | ||
| "topLevelOU": "Test Top-Level OU" | ||
| } | ||
| } | ||
|
|
||
| RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId] | ||
| count(RuleOutput) == 1 | ||
| RuleOutput[0].RequirementMet | ||
| not RuleOutput[0].NoSuchEvent | ||
| RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups." | ||
| } | ||
|
|
||
| test_ClassroomCreation_Correct_V2 if { | ||
| # Test when there's multiple events, with the chronological latest | ||
| # correct but not last in json list | ||
| PolicyId := "GWS.CLASSROOM.5.1v0.2" | ||
| Output := tests with input as { | ||
| "classroom_logs": {"items": [ | ||
| { | ||
| "id": {"time": "2022-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "3"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| }, | ||
| { | ||
| "id": {"time": "2021-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "2"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| } | ||
| ]}, | ||
| "tenant_info": { | ||
| "topLevelOU": "Test Top-Level OU" | ||
| } | ||
| } | ||
|
|
||
| RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId] | ||
| count(RuleOutput) == 1 | ||
| RuleOutput[0].RequirementMet | ||
| not RuleOutput[0].NoSuchEvent | ||
| RuleOutput[0].ReportDetails == "Requirement met in all OUs and groups." | ||
| } | ||
|
|
||
| # No tests for multiple OUs, inheritance, groups, etc as this setting can't be controlled at the OU or group level | ||
|
|
||
| test_ClassroomCreation_Incorrect_V1 if { | ||
| # Test when there's only one event and it's wrong | ||
| PolicyId := "GWS.CLASSROOM.5.1v0.2" | ||
| Output := tests with input as { | ||
| "classroom_logs": {"items": [ | ||
| { | ||
| "id": {"time": "2022-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "1"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| } | ||
| ]}, | ||
| "tenant_info": { | ||
| "topLevelOU": "Test Top-Level OU" | ||
| } | ||
| } | ||
|
|
||
| RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId] | ||
| count(RuleOutput) == 1 | ||
| not RuleOutput[0].RequirementMet | ||
| not RuleOutput[0].NoSuchEvent | ||
| RuleOutput[0].ReportDetails == concat("", [ | ||
| "The following OUs are non-compliant:<ul><li>Test Top-Level OU: ", | ||
| "Who can create classes is set to anyone in this domain</li></ul>" | ||
| ]) | ||
| } | ||
|
|
||
| test_ClassroomCreation_Incorrect_V2 if { | ||
| # Test when there's multiple events, with the chronological latest | ||
| # incorrect but not last in json list | ||
| PolicyId := "GWS.CLASSROOM.5.1v0.2" | ||
| Output := tests with input as { | ||
| "classroom_logs": {"items": [ | ||
| { | ||
| "id": {"time": "2022-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "2"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| }, | ||
| { | ||
| "id": {"time": "2021-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "TeacherPermissionsSettingProto who_can_create_class"}, | ||
| {"name": "NEW_VALUE", "value": "3"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| } | ||
| ]}, | ||
| "tenant_info": { | ||
| "topLevelOU": "Test Top-Level OU" | ||
| } | ||
| } | ||
|
|
||
| RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId] | ||
| count(RuleOutput) == 1 | ||
| not RuleOutput[0].RequirementMet | ||
| not RuleOutput[0].NoSuchEvent | ||
| RuleOutput[0].ReportDetails == concat("", [ | ||
| "The following OUs are non-compliant:<ul><li>Test Top-Level OU: ", | ||
| "Who can create classes is set to all pending and verified teachers</li></ul>" | ||
| ]) | ||
| } | ||
|
|
||
|
|
||
| test_ClassroomCreation_Incorrect_V3 if { | ||
| # Test when there no applicable event | ||
| PolicyId := "GWS.CLASSROOM.5.1v0.2" | ||
| Output := tests with input as { | ||
| "classroom_logs": {"items": [ | ||
| { | ||
| "id": {"time": "2022-12-20T00:02:28.672Z"}, | ||
| "events": [{ | ||
| "parameters": [ | ||
| {"name":"SETTING_NAME", | ||
| "value": "something else"}, | ||
| {"name": "NEW_VALUE", "value": "false"}, | ||
| {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}, | ||
| ] | ||
| }] | ||
| } | ||
| ]}, | ||
| "tenant_info": { | ||
| "topLevelOU": "Test Top-Level OU" | ||
| } | ||
| } | ||
|
|
||
| RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId] | ||
| count(RuleOutput) == 1 | ||
| not RuleOutput[0].RequirementMet | ||
| RuleOutput[0].NoSuchEvent | ||
| RuleOutput[0].ReportDetails == concat("", [ | ||
| "No relevant event in the current logs for the top-level OU, Test Top-Level OU. ", | ||
| "While we are unable to determine the state from the logs, the default setting ", | ||
| "is non-compliant; manual check recommended." | ||
| ]) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters