-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SLE15 add nftables ensure default deny policy #10249
SLE15 add nftables ensure default deny policy #10249
Conversation
Hi @teacup-on-rockingchair. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
0b02ab9
to
a09610f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I couldn't test it so for now I have some comments about Style Guide and we have some opportunities to improve the OVAL readability. Test scenario scripts would also be great.
..._os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/oval/sle15.xml
Show resolved
Hide resolved
..._os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/oval/sle15.xml
Outdated
Show resolved
Hide resolved
..._os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/oval/sle15.xml
Show resolved
Hide resolved
..._os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/oval/sle15.xml
Outdated
Show resolved
Hide resolved
..._os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/oval/sle15.xml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/rule.yml
Outdated
Show resolved
Hide resolved
rationale: |- | ||
There are two policies: accept (Default) and drop. If the policy is set to accept, the | ||
firewall will accept any packet that is not configured to be denied and the packet will | ||
continue traversing the network stack. It is easier to allow acceptable usage than to block |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think an easier management is an argument, but not the strongest one for this requirement. Maybe the main argument here is to ensure that any traffic without an explicit rule is denied by default.
The first part seems to fit better in the description section:
There are two policies: accept (Default) and drop. If the policy is set to accept, the
firewall will accept any packet that is not configured to be denied and the packet will
continue traversing the network stack.
linux_os/guide/system/network/network-nftables/nftables_ensure_default_deny_policy/rule.yml
Outdated
Show resolved
Hide resolved
var_nftable_master_config_file changed to var_nftables_master_config_file
…_default_deny_policy/oval/sle15.xml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…_default_deny_policy/oval/sle15.xml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…_default_deny_policy/oval/sle15.xml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…_default_deny_policy/oval/sle15.xml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent'.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,11 +1,11 @@
[title]:
-Ensure nftables rules are permanent
+Ensure nftables Rules are Permanent
[description]:
nftables is a subsystem of the Linux kernel providing filtering and classification of
network packets/datagrams/frames. The nftables service reads the
-'xccdf_org.ssgproject.content_value_var_nftable_master_config_file' file for a nftables file or files to
+'xccdf_org.ssgproject.content_value_var_nftables_master_config_file' file for a nftables file or files to
include in the nftables ruleset. A nftables ruleset containing the input, forward, and output
base chains allow network traffic to be filtered.
bash remediation for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent' differs.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,19 +1,19 @@
-var_nftable_master_config_file=''
+var_nftables_master_config_file=''
-if [ ! -f "${var_nftable_master_config_file}" ]; then
- touch "${var_nftable_master_config_file}"
+if [ ! -f "${var_nftables_master_config_file}" ]; then
+ touch "${var_nftables_master_config_file}"
fi
-grep -qxF 'include "/etc/nftables/bridge-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/bridge-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/bridge-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/bridge-filter"' >> "${var_nftables_master_config_file}"
-grep -qxF 'include "/etc/nftables/arp-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/arp-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/arp-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/arp-filter"' >> "${var_nftables_master_config_file}"
-grep -qxF 'include "/etc/nftables/inet-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/inet-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/inet-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/inet-filter"' >> "${var_nftables_master_config_file}"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent' differs.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,12 +1,12 @@
-- name: XCCDF Value var_nftable_master_config_file # promote to variable
+- name: XCCDF Value var_nftables_master_config_file # promote to variable
set_fact:
- var_nftable_master_config_file: !!str
+ var_nftables_master_config_file: !!str
tags:
- always
- name: Check the top-level configuration file exists
ansible.builtin.stat:
- path: '{{ var_nftable_master_config_file }}'
+ path: '{{ var_nftables_master_config_file }}'
tags:
- CCE-92485-2
- low_complexity
@@ -18,7 +18,7 @@
- name: Check the relevant file is included configuration
ansible.builtin.lineinfile:
- path: '{{ var_nftable_master_config_file }}'
+ path: '{{ var_nftables_master_config_file }}'
line: include "/etc/nftables/{{ item }}-filter"
create: true
loop: |
Also re-word description and rationale sections Thanks to @marcusburghardt for the feedback on that
…_default_deny_policy/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
2b8d8ee
to
1e202ca
Compare
Code Climate has analyzed commit 1e202ca and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 52.4% (0.0% change). View more on Code Climate. |
@teacup-on-rockingchair , do you plan to include test scenario scripts? I think it would be great. |
Overriding CODEOWNERS as @teacup-on-rockingchair can't approve his own PR. |
Description:
Rationale:
Review Hints: