[Debian12] Add CIS Benchmark 1.1.0 profiles #13054
Conversation
|
Hi @Blasci. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| - service_timesyncd_disable | ||
| ## | ||
| # Choose systemd-timesyncd | ||
| # - package_timesyncd_installed # Not written in CIS documentation | ||
| - package_chrony_removed |
There was a problem hiding this comment.
FTBFS here.
ValueError: Control cis_debian12:2.3.1.1 contains nonexisting rule(s) package_chrony_removed, service_timesyncd_disable
Only existing rules can be added to cfile. The rule package_chrony_removed really doesn't exist, the service_timesyncd_disable should be service_timesyncd_disabled.
| - file_permission_user_init_files | ||
| - file_permission_user_bash_history | ||
| status: automated | ||
|
|
|
|
||
| reference_uris: | ||
| cis: 'https://www.cisecurity.org/benchmark/debian_linux/' | ||
|
|
| - var_network_filtering_service=nftables | ||
| # Define default ntp service | ||
| - var_timesync_service=systemd-timesyncd | ||
|
|
| - var_network_filtering_service=nftables | ||
| # Define default ntp service | ||
| - var_timesync_service=systemd-timesyncd |
There was a problem hiding this comment.
Why are the variables redefined in the profile file if they are defined cfile? They aren't set to different values than in the cfile so this seems superfluous.
| - var_network_filtering_service=nftables | ||
| # Define default ntp service | ||
| - var_timesync_service=systemd-timesyncd | ||
|
|
| - var_network_filtering_service=nftables | ||
| # Define default ntp service | ||
| - var_timesync_service=systemd-timesyncd | ||
|
|
| - configure_user_data_backups | ||
| - accounts_polyinstantiated_var_tmp | ||
| - dir_ownership_binary_dirs | ||
| - account_disable_post_pw_expiration |
There was a problem hiding this comment.
Why so many new rules are added to the default profile? Also, many of them are already present in other profiles.
Description:
Add new profiles for CIS Debian Linux 12 Benchmark 1.1.0 :
#### Rationale:
CIS Debian 12 version 1.1.0 was released in 2024-09-26.
(Working with branch ; previous closed PR : #13039)