Remove protect kernel default and sysctl rules from CIS

[rhmdnd]

Upstream guidance in the Kubernetes benchmarks for protecting kernel
defaults and sysctl rules was removed. This removal affected the CIS
benchmark since it is rebased to pickup general guidance from the
Kubernetes CIS community.

This commit updates those rules and removes the CIS references from them
so that they're consistent with CIS OpenShift 1.4.0. The following is
the relevant upstream CIS discussion about the removal.

https://workbench.cisecurity.org/benchmarks/11107/tickets/17377

[rhmdnd]

Technically - this also means those rules will no longer be included in the fedramp or PCI-DSS profiles.

We can either add them explicitly under another control, or omit them like CIS did.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit 0f5ed45 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.2% (0.0% change).

View more on Code Climate.

[yuumasato]

LGTM, the rules are not used in the CIS profile.

[yuumasato]

Technically - this also means those rules will no longer be included in the fedramp or PCI-DSS profiles.

From what is described in https://workbench.cisecurity.org/benchmarks/11107/tickets/17377 the rules don't seem to bring any value, so I'd favor removing them.

We can either add them explicitly under another control, or omit them like CIS did.

Another option is to directly select the rules in profiles/pci-dss.profile.

[rhmdnd]

Another option is to directly select the rules in profiles/pci-dss.profile.

Correct. Since these rules were only pulled in as a side-effect of relying on CIS in the PCI-DSS benchmark, I'm curious if they "must" be included with PCI-DSS.

In other cases (like CIS 5.5.1), we pulled in additional rules (like the OCP allowed registry rules) and omit the general webhook rule, which would have affected the overall PCI-DSS rules, too.

If we apply that same principle here, we wouldn't be re-adding those rules to the PCI-DSS profile, which seems reasonable given the justification in the CIS Workbench discussion.