-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SLE AIDE periodic check and remediation via systemd timer #10589
SLE AIDE periodic check and remediation via systemd timer #10589
Conversation
Nice. I wonder if other distros already use or tend to use systemd timer with AIDE. If so, it would be interesting to extend the existing remediation so other distros can also benefit on this. I will take a look in Fedora and RHEL. @dodys @freddieRv @Xeicker FYI |
...ystem/software/integrity/software-integrity/aide/aide_periodic_cron_checking/oval/shared.xml
Outdated
Show resolved
Hide resolved
I wonder if this should be a new rule instead. |
Well my motivation with the sle15 specific files was exactly this not to imply SLE policy and not make too many conditions in the shared files. On the other hand, putting is as totally different rule in my opinion would duplicate too much of the logic. I agree the name is confusing, but if you say cron these days, I personally do not understand it as exact package or service, rather than type of functionality for scheduled execution of tasks. |
Thanks for the more context you both provided. I just tried to investigate this case and didn't find any package defining the After thinking more about it, I am more inclined to agree with @dodys in creating a new rule for this. As the benefits of creating this new rule I see:
If in the future, for example, CIS drops cron approach in favor of systemd timer, we can simply update the profile by removing the cron rule. Otherwise, the rule would demand changes again and likely be split in any case. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice rule. I believe it might be useful for other products in the future. Besides some minor suggestion to descriptions, I only have some comments to make its adoption easier and some considerations in the Ansible remediation.
...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/sle15.yml
Outdated
Show resolved
Hide resolved
...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/sle15.yml
Outdated
Show resolved
Hide resolved
...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/sle15.yml
Outdated
Show resolved
Hide resolved
...are/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/sle15.yml
Outdated
Show resolved
Hide resolved
...oftware/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/sle15.sh
Outdated
Show resolved
Hide resolved
...tem/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml
Outdated
Show resolved
Hide resolved
...tem/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml
Outdated
Show resolved
Hide resolved
...tem/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml
Outdated
Show resolved
Hide resolved
...oftware-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_not_installed.fail.sh
Outdated
Show resolved
Hide resolved
...software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh
Outdated
Show resolved
Hide resolved
Define new rule aide_periodic_checking_systemd_timer
…de/aide_periodic_checking_systemd_timer/ansible/sle15.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/ansible/sle15.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/bash/sle15.sh Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/oval/sle15.xml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/tests/aide_not_installed.fail.sh Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
…de/aide_periodic_checking_systemd_timer/rule.yml Co-authored-by: Marcus Burghardt <2074099+marcusburghardt@users.noreply.github.com>
Thanks to @marcusburghardt for the feedback on those - Dropped paide package installation on remediation no need to duplicate that - Improved service definition procs by setting ownership, mode and forcing daemon_reload on systemd unit definition
940d2c5
to
2b07368
Compare
@teacup-on-rockingchair , this PR is almost ready to be merged, but cause of failures in CI tests should be fixed: You should include this new rule in the components mapping, in the |
Code Climate has analyzed commit c9da482 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.2% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Thanks
Overriding CODEOWNERS as @teacup-on-rockingchair can't approve his own PR. |
I double-checked the failed CI tests and confirmed they can be waived. Tests successfully passed in my local VMs. |
b484c46
into
ComplianceAsCode:master
Description:
Rationale: