SLE15 add nftables ensure default deny policy

[teacup-on-rockingchair]

Description:

• Add rule definition and OVAL check for nftables ensure default deny policy

Rationale:

• Define the new rule to match CIS SLE15 requirement 3.5.2.8
• Add CCE and OVAL check

Review Hints:

• No remediation added due to danger of breaking a running system
• PR should be applied after SLE15 add implementation of nftables_rules_permanent rule #10201 due to dependancy on shared external var so setting to draft for now

[openshift-ci]

Hi @teacup-on-rockingchair. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

sle15 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[marcusburghardt]

I couldn't test it so for now I have some comments about Style Guide and we have some opportunities to improve the OVAL readability. Test scenario scripts would also be great.

[marcusburghardt]

I think an easier management is an argument, but not the strongest one for this requirement. Maybe the main argument here is to ensure that any traffic without an explicit rule is denied by default.

The first part seems to fit better in the description section:

    There are two policies: accept (Default) and drop. If the policy is set to accept, the
    firewall will accept any packet that is not configured to be denied and the packet will
    continue traversing the network stack.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent'.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,11 +1,11 @@
 
 [title]:
-Ensure nftables rules are permanent
+Ensure nftables Rules are Permanent
 
 [description]:
 nftables is a subsystem of the Linux kernel providing filtering and classification of
 network packets/datagrams/frames. The nftables service reads the
-'xccdf_org.ssgproject.content_value_var_nftable_master_config_file' file for a nftables file or files to
+'xccdf_org.ssgproject.content_value_var_nftables_master_config_file' file for a nftables file or files to
 include in the nftables ruleset. A nftables ruleset containing the input, forward, and output
 base chains allow network traffic to be filtered.
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent' differs.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,19 +1,19 @@
 
 
 
-var_nftable_master_config_file=''
+var_nftables_master_config_file=''
 
 
-if [ ! -f "${var_nftable_master_config_file}" ]; then
- touch "${var_nftable_master_config_file}"
+if [ ! -f "${var_nftables_master_config_file}" ]; then
+ touch "${var_nftables_master_config_file}"
 fi
 
 
-grep -qxF 'include "/etc/nftables/bridge-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/bridge-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/bridge-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/bridge-filter"' >> "${var_nftables_master_config_file}"
 
-grep -qxF 'include "/etc/nftables/arp-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/arp-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/arp-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/arp-filter"' >> "${var_nftables_master_config_file}"
 
-grep -qxF 'include "/etc/nftables/inet-filter"' "${var_nftable_master_config_file}" \
- || echo 'include "/etc/nftables/inet-filter"' >> "${var_nftable_master_config_file}"
+grep -qxF 'include "/etc/nftables/inet-filter"' "${var_nftables_master_config_file}" \
+ || echo 'include "/etc/nftables/inet-filter"' >> "${var_nftables_master_config_file}"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_nftables_rules_permanent' differs.
--- xccdf_org.ssgproject.content_rule_nftables_rules_permanent
+++ xccdf_org.ssgproject.content_rule_nftables_rules_permanent
@@ -1,12 +1,12 @@
-- name: XCCDF Value var_nftable_master_config_file # promote to variable
+- name: XCCDF Value var_nftables_master_config_file # promote to variable
 set_fact:
- var_nftable_master_config_file: !!str 
+ var_nftables_master_config_file: !!str 
 tags:
 - always
 
 - name: Check the top-level configuration file exists
 ansible.builtin.stat:
- path: '{{ var_nftable_master_config_file }}'
+ path: '{{ var_nftables_master_config_file }}'
 tags:
 - CCE-92485-2
 - low_complexity
@@ -18,7 +18,7 @@
 
 - name: Check the relevant file is included configuration
 ansible.builtin.lineinfile:
- path: '{{ var_nftable_master_config_file }}'
+ path: '{{ var_nftables_master_config_file }}'
 line: include "/etc/nftables/{{ item }}-filter"
 create: true
 loop:

[codeclimate]

Code Climate has analyzed commit 1e202ca and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

[marcusburghardt]

@teacup-on-rockingchair , do you plan to include test scenario scripts? I think it would be great.

[marcusburghardt]

Overriding CODEOWNERS as @teacup-on-rockingchair can't approve his own PR.