-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
enhance OVAL for enable_fips_mode #10897
enhance OVAL for enable_fips_mode #10897
Conversation
rewritten according to grub2_argument template if RHEL8 or OL8, then the grubenv file is checked if RHEL9 or OL9, then expanded /boot/loader/entries are checked
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode' differs.
--- oval:ssg-enable_fips_mode:def:1
+++ oval:ssg-enable_fips_mode:def:1
@@ -4,6 +4,12 @@
extend_definition oval:ssg-enable_dracut_fips_module:def:1
extend_definition oval:ssg-configure_crypto_policy:def:1
criterion oval:ssg-test_system_crypto_policy_value:tst:1
+criterion oval:ssg-test_fips_1_argument_in_etc_kernel_cmdline:tst:1
criteria OR
+criteria AND
+extend_definition oval:ssg-system_info_architecture_s390_64:def:1
+criterion oval:ssg-test_fips_1_argument_in_boot_loader_entries_conf:tst:1
+criteria AND
+criteria None
extend_definition oval:ssg-system_info_architecture_s390_64:def:1
criterion oval:ssg-test_grubenv_fips_mode:tst:1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the update. It is difficult to test this rule and I believe this is the reason to not have test scenario scripts. I have some comments. Could you take a look on them, please?
linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
Outdated
Show resolved
Hide resolved
linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for updating this rule @vojtapolasek .
We have discussed privately on how to include test scenarios for this rule and concluded it would be possible but would not be simple. So we can merge this PR now to not block the fix and work on test scenarios in a separate PR.
Code Climate has analyzed commit 78f087f and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.2% (0.0% change). View more on Code Climate. |
dc450a8
into
ComplianceAsCode:master
The OVAL in rule enable_fips_mode contains multiple checks. One of these checks tests presence of `fips=1` in `/etc/kernel/cmdline`. Although this is useful for latest RHEL versions, this file doesn't exist on RHEL 8.6 and 9.0. This causes that the rule fails after remediation on these RHEL versions. We want the same OVAL behavior on all minor RHEL releases, therefore we will remove this test from the OVAL completely. Related to: ComplianceAsCode#10897
Description:
Rationale:
Review Hints: