-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add variable support to auditd_name_format
rule
#11019
Add variable support to auditd_name_format
rule
#11019
Conversation
470a352
to
e1c6eab
Compare
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format'.
--- xccdf_org.ssgproject.content_rule_auditd_name_format
+++ xccdf_org.ssgproject.content_rule_auditd_name_format
@@ -1,12 +1,16 @@
[title]:
-Set hostname as computer node name in audit logs
+Set type of computer node name logging in audit logs
[description]:
-To configure Audit daemon to use value returned by gethostname
-syscall as computer node name in the audit events,
-set name_format to hostname
+To configure Audit daemon to use a unique identifier
+as computer node name in the audit events,
+set name_format to 'xccdf_org.ssgproject.content_value_var_auditd_name_format'
in /etc/audit/auditd.conf.
+
+[warning]:
+Whenever the variable var_auditd_name_format uses a multiple value option, for example
+A|B|C, the first value will be used when remediating this rule.
[reference]:
CCI-001851
OCIL for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format' differs.
--- ocil:ssg-auditd_name_format_ocil:questionnaire:1
+++ ocil:ssg-auditd_name_format_ocil:questionnaire:1
@@ -1,7 +1,7 @@
-To verify that Audit Daemon is configured to record the hostname
-in audit events, run the following command:
+To verify that Audit Daemon is configured to record the computer node
+name in the audit events, run the following command:
$ sudo grep name_format /etc/audit/auditd.conf
The output should return the following:
-name_format = hostname
- Is it the case that name_format isn't set to hostname?
+name_format =
+ Is it the case that name_format isn't set to <sub idref="var_auditd_name_format" />?
bash remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_name_format
+++ xccdf_org.ssgproject.content_rule_auditd_name_format
@@ -1,5 +1,10 @@
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
+
+var_auditd_name_format=''
+
+
+var_auditd_name_format="$(echo $var_auditd_name_format | cut -d \| -f 1)"
if [ -e "/etc/audit/auditd.conf" ] ; then
@@ -12,7 +17,7 @@
cp "/etc/audit/auditd.conf" "/etc/audit/auditd.conf.bak"
# Insert at the end of the file
-printf '%s\n' "name_format = hostname" >> "/etc/audit/auditd.conf"
+printf '%s\n' "name_format = $var_auditd_name_format" >> "/etc/audit/auditd.conf"
# Clean up after ourselves.
rm "/etc/audit/auditd.conf.bak"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_name_format
+++ xccdf_org.ssgproject.content_rule_auditd_name_format
@@ -12,8 +12,32 @@
- medium_severity
- no_reboot_needed
- restrict_strategy
+- name: XCCDF Value var_auditd_name_format # promote to variable
+ set_fact:
+ var_auditd_name_format: !!str
+ tags:
+ - always
-- name: Set hostname as computer node name in audit logs
+- name: Set type of computer node name logging in audit logs - Define Value to Be
+ Used in the Remediation
+ ansible.builtin.set_fact: auditd_name_format_split="{{ var_auditd_name_format.split('|')[0]
+ }}"
+ when:
+ - '"audit" in ansible_facts.packages'
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ tags:
+ - CCE-82897-0
+ - DISA-STIG-RHEL-08-030062
+ - NIST-800-53-AU-3
+ - NIST-800-53-CM-6
+ - auditd_name_format
+ - low_complexity
+ - low_disruption
+ - medium_severity
+ - no_reboot_needed
+ - restrict_strategy
+
+- name: Set type of computer node name logging in audit logs
block:
- name: Check for duplicate values
@@ -39,7 +63,7 @@
path: /etc/audit/auditd.conf
create: true
regexp: (?i)^\s*name_format\s*=\s*
- line: name_format = hostname
+ line: name_format = {{ auditd_name_format_split }}
state: present
when:
- '"audit" in ansible_facts.packages' |
@ComplianceAsCode/suse-maintainers FYI: ad31112 Fixes:
From https://github.com/ComplianceAsCode/content/actions/runs/5953199333/job/16147057044 |
linux_os/guide/system/auditing/configure_auditd_data_retention/var_auditd_name_format.var
Show resolved
Hide resolved
4842c16
to
68cb73d
Compare
6fe28b7
to
d393c7a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have some comments about Ansible Style Guide and remediation approach.
.../guide/system/auditing/configure_auditd_data_retention/auditd_name_format/ansible/shared.yml
Outdated
Show resolved
Hide resolved
.../guide/system/auditing/configure_auditd_data_retention/auditd_name_format/ansible/shared.yml
Outdated
Show resolved
Hide resolved
.../guide/system/auditing/configure_auditd_data_retention/auditd_name_format/ansible/shared.yml
Outdated
Show resolved
Hide resolved
auditd_name_format
rule
d393c7a
to
daf4b13
Compare
@ggbecker , the pending itens are basically about Style Guide and an small improvement in Ansible remediation approach, to make it aligned with Bash. Could you take a look, please? |
daf4b13
to
d2e983e
Compare
.../guide/system/auditing/configure_auditd_data_retention/auditd_name_format/ansible/shared.yml
Outdated
Show resolved
Hide resolved
d2e983e
to
ceac6bf
Compare
I am testing the proposed changes from: #11111 To see if they actually work since this pull request should trigger the same situation. |
The PR worked fine in my local VMs, but the errors in Automatus tests should be investigated. |
Yes, I agree. I will take a look. |
85abb6a
to
99faa30
Compare
The issue with automatus CI is related to: notiz-dev/github-action-json-property#6 I'm trying the approach suggested there to see what happens. |
99faa30
to
66047e1
Compare
This multiple values can be defined in the variable as a regex for multiple options. The first item in the regex will be used for remediation.
This warning lets users know that the first value of the variable will be used when remediating the rule whenever the value selected is a multiple choice value.
66047e1
to
ad029b2
Compare
It seemed to work. It should be now ready for merge IMO. |
ad029b2
to
5ffe39f
Compare
Code Climate has analyzed commit 5ffe39f and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.8% (0.0% change). View more on Code Climate. |
@jan-cerny 5ffe39f seemed to fix the problem with the json single value array attribute |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great. Thanks for the investigation in this PR @ggbecker .
Description:
auditd_name_format
ruleRationale:
RHEL8 STIG should accept more than just
hostname
: https://stigaview.com/products/rhel8/v1r11/RHEL-08-030062/Fixes update linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml to accept more than hostname #5011