-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable rsyslog_filecreatemode rule for RHEL #10328
Enable rsyslog_filecreatemode rule for RHEL #10328
Conversation
In RHEL7 the remediation was reporting "invalid arithmetic operator". This was fixed.
This rule covers the 4.2.1.4 CIS requirement for RHEL8 and RHEL9, and the 4.2.1.3 CIS requirement for RHEL7. The prodtype and references paramenters were updated and identifiers for RHEL were included. The CIS control files were updated.
Ansible remediation was included, aligned to the Bash remediation.
It is not necessary to restart the rsyslog for testing purposes since the OVAL checks the configuration files content regardless of the service state.
6f635c8
to
31bd17e
Compare
Automatus tests are failing because the the service can't be restarted with systemctl in the test containers. |
Code Climate has analyzed commit 31bd17e and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 51.7% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[jcerny@thinkpad scap-security-guide{pr/10328}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 rsyslog_filecreatemode
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-03-13-1457/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode
INFO - Script filecreatemode_0600.pass.sh using profile (all) OK
INFO - Script filecreatemode_0601.fail.sh using profile (all) OK
INFO - Script filecreatemode_0640.pass.sh using profile (all) OK
INFO - Script filecreatemode_0755.fail.sh using profile (all) OK
INFO - Script filecreatemode_duplicate.fail.sh using profile (all) OK
INFO - Script filecreatemode_missing.fail.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/10328}]$ python3 tests/automatus.py rule --remediate-using ansible --libvirt qemu:///system ssgts_rhel8 rsyslog_filecreatemode
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-03-13-1503/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode
INFO - Script filecreatemode_0600.pass.sh using profile (all) OK
INFO - Script filecreatemode_0601.fail.sh using profile (all) OK
INFO - Script filecreatemode_0640.pass.sh using profile (all) OK
INFO - Script filecreatemode_0755.fail.sh using profile (all) OK
INFO - Script filecreatemode_duplicate.fail.sh using profile (all) OK
INFO - Script filecreatemode_missing.fail.sh using profile (all) OK
Description:
This rule covers the
4.2.1.4
CIS requirement for RHEL8 and RHEL9, and the4.2.1.3
CIS requirement for RHEL7.The
prodtype
andreferences
parameters were updated andidentifiers
for RHEL were included.The CIS control files were updated and finally an Ansible remediation was included.
Rationale: