-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove protect kernel default and sysctl rules from CIS #10931
Remove protect kernel default and sysctl rules from CIS #10931
Conversation
Upstream guidance in the Kubernetes benchmarks for protecting kernel defaults and sysctl rules was removed. This removal affected the CIS benchmark since it is rebased to pickup general guidance from the Kubernetes CIS community. This commit updates those rules and removes the CIS references from them so that they're consistent with CIS OpenShift 1.4.0. The following is the relevant upstream CIS discussion about the removal. https://workbench.cisecurity.org/benchmarks/11107/tickets/17377
Technically - this also means those rules will no longer be included in the fedramp or PCI-DSS profiles. We can either add them explicitly under another control, or omit them like CIS did. |
Code Climate has analyzed commit 0f5ed45 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.2% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, the rules are not used in the CIS profile.
From what is described in https://workbench.cisecurity.org/benchmarks/11107/tickets/17377 the rules don't seem to bring any value, so I'd favor removing them.
Another option is to directly select the rules in |
Correct. Since these rules were only pulled in as a side-effect of relying on CIS in the PCI-DSS benchmark, I'm curious if they "must" be included with PCI-DSS. In other cases (like CIS 5.5.1), we pulled in additional rules (like the OCP allowed registry rules) and omit the general webhook rule, which would have affected the overall PCI-DSS rules, too. If we apply that same principle here, we wouldn't be re-adding those rules to the PCI-DSS profile, which seems reasonable given the justification in the CIS Workbench discussion. |
Upstream guidance in the Kubernetes benchmarks for protecting kernel
defaults and sysctl rules was removed. This removal affected the CIS
benchmark since it is rebased to pickup general guidance from the
Kubernetes CIS community.
This commit updates those rules and removes the CIS references from them
so that they're consistent with CIS OpenShift 1.4.0. The following is
the relevant upstream CIS discussion about the removal.
https://workbench.cisecurity.org/benchmarks/11107/tickets/17377