-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RHCOS4 STIG: Cover controls that correspond to NIST AC #10727
Conversation
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -286,6 +286,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -286,6 +286,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
CCI-000130
@@ -62,6 +62,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+[reference]:
+SRG-APP-000029-CTR-000085
+
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -286,6 +286,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check
@@ -9,12 +9,12 @@
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/pam_timestamp_check
--F auid>=1000 -F auid!=unset -F key=privileged
+-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/sbin/pam_timestamp_check
--F auid>=1000 -F auid!=unset -F key=privileged
+-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -258,6 +258,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -286,6 +286,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign
@@ -260,6 +260,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+[reference]:
+SRG-APP-000029-CTR-000085
+
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -265,6 +265,9 @@
[reference]:
SRG-OS-000466-GPOS-00210
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
BP28(R19)
@@ -265,6 +265,9 @@
[reference]:
SRG-OS-000466-GPOS-00210
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -256,6 +256,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
@@ -8,11 +8,11 @@
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
If the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
[reference]:
1
@@ -307,6 +307,9 @@
[reference]:
SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
[rationale]:
Misuse of privileged functions, either intentionally or unintentionally by |
@ggbecker @yuumasato I'm at loss to debug the CI issues:
what is a rule-component mapping? and then this test fails:
why does it fail? What does the test do? |
@jhrozek I'm not sure, but I think you need to add the new rules into any file in CC @matejak and @jan-cerny |
thanks, let's see how the new CI run goes |
@jhrozek Yes, @yuumasato is correct, from now on the components are mandatory, that means you need to add a rule ID to a component file if you add a new rule to RHEL7, RHEL8, RHEL9 or Fedora products. |
/test help |
@jhrozek: The specified target(s) for
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/test e2e-aws-rhcos4-stig |
RHCOS STIG CI succeeded. |
/test e2e-aws-rhcos4-stig |
/test e2e-aws-ocp4-stig |
/test e2e-aws-ocp4-stig-node |
/test e2e-aws-ocp4-stig |
/test e2e-aws-ocp4-stig-node |
/test e2e-aws-rhcos4-stig |
/test e2e-aws-ocp4-stig |
1 similar comment
/test e2e-aws-ocp4-stig |
lol oops I really should get into the habit of running some local checks :-) |
/test e2e-aws-ocp4-stig |
Some CCEs were not unique, hopefully now all CI runs will be green |
/test e2e-aws-ocp4-stig |
@jhrozek e2e passed. |
…e covered by audit_rules_suid_privilege_function
…inaries on RHCOS4
nice catch, done |
Code Climate has analyzed commit f5b3474 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.5% (0.0% change). View more on Code Climate. |
The Automatus CS8 and CS9 tests fail because some rules are only available for rhcos. Automatus Fedora is failing to prepare environment for tests, for some reason. |
Description:
audit_rules_suid_privilege_function
- this one is quite easyRationale:
Review Hints:
AC
and looking forMachineConfig
in column I (Fix).