Update the profile STIG for OL9 #12021

mrkanon · 2024-05-24T19:22:25Z

Description:

STIG profiles for OL9 are updated based on preliminary DISA requirements

Rationale:

This is a draft set variables and rules within the profile to better align with DISA STIG draft for OL9

Make the stig.profile use this control file Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

openshift-ci · 2024-05-24T19:22:37Z

Hi @mrkanon. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2024-05-24T19:23:54Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-05-24T19:53:44Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_installed_OS_is_FIPS_certified' differs.
--- oval:ssg-installed_OS_is_FIPS_certified:def:1
+++ oval:ssg-installed_OS_is_FIPS_certified:def:1
@@ -4,6 +4,7 @@
 extend_definition oval:ssg-installed_OS_is_rhcos4:def:1
 extend_definition oval:ssg-installed_OS_is_ol7:def:1
 extend_definition oval:ssg-installed_OS_is_ol8:def:1
+extend_definition oval:ssg-installed_OS_is_ol9:def:1
 extend_definition oval:ssg-installed_OS_is_sle12:def:1
 extend_definition oval:ssg-installed_OS_is_sle15:def:1
 extend_definition oval:ssg-installed_OS_is_ubuntu1604:def:1

github-actions · 2024-05-24T20:18:43Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12021
This image was built from commit: 5f7d160

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12021

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12021 make deploy-local

Xeicker · 2024-05-24T21:44:07Z

linux_os/guide/services/sssd/sssd_offline_cred_expiration/oval/shared.xml

@@ -4,7 +4,7 @@
    <criteria operator="OR">
      <criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf"
      test_ref="test_sssd_offline_cred_expiration" />
-      {{% if product in ["ol8", "rhel8"] %}}
+      {{% if product in ["ol8", "ol9", "rhel8", "rhel9"] %}}


Could someone of @ComplianceAsCode/red-hatters validate this is also applicable to rhel9

It seems like it should be from here: https://www.stigviewer.com/stig/red_hat_enterprise_linux_9/2023-12-01/finding/V-258133

I can confirm. Thanks

package_ypserv_removed, The package is not available in OL9 chronyd_specify_remote_server, This has a similar functionality to chronyd_server_directive sshd_disable_compression, For OpenSSH sshd 7.4 and newer 'Compression yes' should not trigger any warnings sshd_use_priv_separation, The parameter is not available in OL9 kerberos_disable_no_keytab, This requirement is not applicable. Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

Add the conditional for OL9 and RHEL9 Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

dconf_gdm_dir in product.yml var_accounts_tmout in stig_ol9.yml var_sudo_timestamp_timeout in stig_ol9.yml section stig_ol9 in stig.profile Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

marcusburghardt · 2024-05-28T20:46:53Z

@Xeicker the author sent a force-push after the approval. We have to review the whole PR again before merging it.

@mrkanon whenever possible, avoid overwriting existing commits after a review. It is fine to create an additional commit with the new changes. It also makes the review process easier.
In some cases it could be reasonable to rework an existing commit and force-pushing it. In this case, make it clear the reason and what was changed. Thanks for the contributions! 👍

codeclimate · 2024-05-28T20:55:37Z

Code Climate has analyzed commit 5f7d160 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

mrkanon · 2024-05-28T21:28:24Z

@marcusburghardt @Xeicker The changes in the push-force were to clean up the commit history since in the Adjust variables in product OL9 commit some lines with unresolved conflicts were published which were resolved in the Final commit of fix build problems, some have also been eliminated final spaces.
An apology for the rework.

Xeicker · 2024-05-28T21:28:57Z

@marcusburghardt Hi, sure I'll check it complete.
Edit: I see @mrkanon already commented on the rationale, we'll try to avoid this in the future

marcusburghardt · 2024-05-28T21:36:42Z

All good @mrkanon and @Xeicker . Thanks for the contributions and the information. 👍

Xeicker · 2024-05-29T00:05:05Z

The errors are not in the scope of this MR so I'll merge it

The errors are:

ERROR - Environment failed to prepare, skipping test

&

ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage 
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration'.

Create the control file stig_ol9.yml

40c662a

Make the stig.profile use this control file Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

mrkanon requested a review from a team as a code owner May 24, 2024 19:22

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label May 24, 2024

Xeicker approved these changes May 24, 2024

View reviewed changes

marcusburghardt added Oracle Linux Oracle Linux product related. STIG STIG Benchmark related. labels May 27, 2024

Xeicker requested a review from a team May 27, 2024 16:09

Xeicker added this to the 0.1.74 milestone May 27, 2024

mrkanon force-pushed the ol9-stig branch from c29935a to ebc5998 Compare May 27, 2024 21:23

marcusburghardt approved these changes May 28, 2024

View reviewed changes

marcusburghardt assigned Xeicker May 28, 2024

marcusburghardt added RHEL Red Hat Enterprise Linux product related. RHEL9 Red Hat Enterprise Linux 9 product related. and removed RHEL Red Hat Enterprise Linux product related. labels May 28, 2024

mrkanon force-pushed the ol9-stig branch from ebc5998 to f9fa106 Compare May 28, 2024 16:44

mrkanon added 4 commits May 28, 2024 11:03

Adjust jinja conditional in sssd_offline_cred_expiration

d36b6ae

Add the conditional for OL9 and RHEL9 Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

Adjust variables in product OL9

d725d0f

dconf_gdm_dir in product.yml var_accounts_tmout in stig_ol9.yml var_sudo_timestamp_timeout in stig_ol9.yml section stig_ol9 in stig.profile Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

Add OL9 to OS FIPS certified

5f7d160

Signed-off-by: Armando Acosta <armando.acosta@oracle.com>

mrkanon force-pushed the ol9-stig branch from f9fa106 to 5f7d160 Compare May 28, 2024 17:10

Xeicker merged commit 3e85148 into ComplianceAsCode:master May 29, 2024
106 of 108 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update the profile STIG for OL9 #12021

Update the profile STIG for OL9 #12021

mrkanon commented May 24, 2024

openshift-ci bot commented May 24, 2024

github-actions bot commented May 24, 2024

github-actions bot commented May 24, 2024

github-actions bot commented May 24, 2024 •

edited

Loading

Xeicker May 24, 2024

marcusburghardt May 28, 2024

marcusburghardt commented May 28, 2024

codeclimate bot commented May 28, 2024

mrkanon commented May 28, 2024

Xeicker commented May 28, 2024 •

edited

Loading

marcusburghardt commented May 28, 2024

Xeicker commented May 29, 2024

Update the profile STIG for OL9 #12021

Update the profile STIG for OL9 #12021

Conversation

mrkanon commented May 24, 2024

Description:

Rationale:

openshift-ci bot commented May 24, 2024

github-actions bot commented May 24, 2024

github-actions bot commented May 24, 2024

github-actions bot commented May 24, 2024 • edited Loading

Xeicker May 24, 2024

Choose a reason for hiding this comment

marcusburghardt May 28, 2024

Choose a reason for hiding this comment

marcusburghardt commented May 28, 2024

codeclimate bot commented May 28, 2024

mrkanon commented May 28, 2024

Xeicker commented May 28, 2024 • edited Loading

marcusburghardt commented May 28, 2024

Xeicker commented May 29, 2024

github-actions bot commented May 24, 2024 •

edited

Loading

Xeicker commented May 28, 2024 •

edited

Loading