Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Why some controls are not in the AllControls framework? #537

Open
jeffmou787 opened this issue Oct 31, 2023 · 7 comments
Open

Why some controls are not in the AllControls framework? #537

jeffmou787 opened this issue Oct 31, 2023 · 7 comments

Comments

@jeffmou787
Copy link

For example, control C-0260 not in the framework, but C-0262 does.

The problem is that for air-gapped environment, user will add --use-artifacts-from flag, like

kubescape scan control C-0260 --use-artifacts-from=artifacts

For C-0262 it's totally fine, but C-0260 will failed with error controlID: C-0260: framework from file not matching

Seems like this is because of the C-0260 control not in the AllControls framework.

@jeffmou787 jeffmou787 changed the title Why are some controls not in the AllControls framework? Why some controls are not in the AllControls framework? Oct 31, 2023
@alegrey91
Copy link
Contributor

Hi and thanks for opening the issue!
Some controls are specific for the security framework, so we though for now of not including them into other frameworks like allcontrols.
They could be not "generic" enough to be used in other frameworks.
Is there some specific reason why you would use that control?
:)

@jeffmou787
Copy link
Author

@alegrey91 Thx for the reply. The problem is that I ran kubescape scan in the air-gapped environment, the report said control C-260 & C-262 was failed and could be specified by running
kubescape scan control C-260 --use-artifacts-from=my-air-gapped-artifacts-storage

However it was failed with error message 'controlID: C-0260: framework from file not matching'
After I added C-260 into allcontrol.json manually, the scan was successful then.

My problem is that this seem kind of confuse for users, since some controls can be scan but some cannot.
Also the description of allcontrol.json says "Contains all the controls from all the frameworks" but it seems not like this, like you said the control C-260 only locate in the security.json.

@alegrey91
Copy link
Contributor

alegrey91 commented Nov 7, 2023

@yuleib @YiscahLevySilas1 do you see problems of adding these controls into the allcontrols framework?
@jeffmou787 could you eventually provide your fix?

@yuleib
Copy link
Contributor

yuleib commented Nov 8, 2023

@slashben - please kindly advice here :)

@jeffmou787
Copy link
Author

@yuleib @YiscahLevySilas1 do you see problems of adding these controls into the allcontrols framework? @jeffmou787 could you eventually provide your fix?

I just added C-0260 infos in the arrays of ControlsIDs and controls in the allcontrols.json, just like other controls in the file.

@yuleib
Copy link
Contributor

yuleib commented Nov 8, 2023

@jeffmou787 - did you opened this fix via a new branch ?

@YiscahLevySilas1
Copy link
Collaborator

Hi @jeffmou787, thanks for raising this issue.
It was a conscious decision not to include some controls in the allcontrols framework such as the CIS controls and those of the security framework, but I agree that the name and description are misleading. @yuleib we should discuss with @yossi77 how to clarify this.
As for the issue - IMO what we should address here is the ability to run any control in an air-gapped environment, also those that are not in allcontrols framework, just as it works when running regularly: kubescape scan control C-0260
To do that we need to load the control not from any specific framework file but from the controls file which we currently don't download in the download artifacts command. Something to notice here is that the controls.json in the regolibrary release does not include the rules themselves to avoid creating a very large file, and in the usual flow (not air-gapped) the gitregostore handles filling the controls with the rules. @alegrey91 Perhaps we should expand the gitregostore to handle local files and then the air-gapped flow could be the same.
@dwertent cc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants