Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SLE15 prefer systemd unit handling of AIDE checks and notifications #11178

Merged
merged 6 commits into from
Nov 2, 2023
Merged

SLE15 prefer systemd unit handling of AIDE checks and notifications #11178

merged 6 commits into from
Nov 2, 2023

Conversation

teacup-on-rockingchair
Copy link
Contributor

Description:

  • Make sure that for SLE15 platform the AIDE periodic check is done via systemd unit and also improve the notification rule so it can be done via systemd unit also

Rationale:

  • Make sure to use aide_periodic_checking_systemd_timer for sle15 platform
  • Add OVAL checks that allow notification to be implemented via systemd unit
  • Add SLE15 specific BASH and Ansible remediation for aide check notification

@teacup-on-rockingchair teacup-on-rockingchair added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. labels Oct 5, 2023
@github-actions
Copy link

github-actions bot commented Oct 5, 2023

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@github-actions
Copy link

github-actions bot commented Oct 5, 2023 •
edited
Loading

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff 
OCIL for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- ocil:ssg-aide_scan_notification_ocil:questionnaire:1
+++ ocil:ssg-aide_scan_notification_ocil:questionnaire:1
@@ -1,4 +1,5 @@
 To determine that periodic AIDE execution has been scheduled, run the following command:
+
 $ grep aide /etc/crontab
 The output should return something similar to the following:
 05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost

bash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -5,6 +5,7 @@
     yum install -y "aide"
 fi
 var_aide_scan_notification_email=''
+
 
 
 CRONTAB=/etc/crontab

jan-cerny
jan-cerny approved these changes Oct 9, 2023
View reviewed changes
...ide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
@@ -39,5 +50,37 @@
<ind:pattern operation="pattern match">^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_test check="all" check_existence="all_exist"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new part isn't described in rule.yml at all. You should extend the rule description and other artifacts.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

got you will do 🙇

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK

...ide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml
test_ref="test_aide_var_cron_notification" />
<criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)"
test_ref="test_aide_crontabs_notification" />
<criteria operator="AND">
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this new criteria be guarded as SLE-only? The new code in Bash and Ansible remediations is marked as SLE-only.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well I prefer to be SLE only for now and other maintainers to adopt it if consider viable, therefore the bash and ansible remediations aer platform dependant

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for reply. But, if you think that this part should be SLE-only for now, would it be better to put it inside a Jinja if product in ... block?

@jan-cerny jan-cerny self-assigned this Oct 27, 2023
@jan-cerny jan-cerny added this to the 0.1.71 milestone Oct 27, 2023
@jan-cerny
Copy link
Collaborator

/packit build

jan-cerny
jan-cerny reviewed Oct 27, 2023
View reviewed changes
...uide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh Outdated
Comment on lines 6 to 8
CRONTAB=/etc/crontab
CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly'

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@teacup-on-rockingchair I think this shouldn't be removed, these variables are used below (lines 37-38). I think this might be the reason why this rule fails the CI.

@codeclimate CodeClimate
Copy link

codeclimate bot commented Nov 2, 2023

Code Climate has analyzed commit 10173f5 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

jan-cerny
jan-cerny approved these changes Nov 2, 2023
View reviewed changes
Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CI fail of Automatus on SLE15 is fixed by #11212 and isn't related to this PR.

Notice the Automatus CS9 job pass because the rule is evaluated as notapplicable in a container environment. I have run the test scenarios locally with a RHEL 9 virtual machine as a back end. Both Ansible and Bash are passing:

jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1432/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1437/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK

@jan-cerny jan-cerny merged commit 16e43c7 into ComplianceAsCode:master Nov 2, 2023
37 of 38 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes

Assignees

@jan-cerny jan-cerny

Labels
Ansible Ansible remediation update. Bash Bash remediation update. OVAL OVAL update. Related to the systems assessments. SLES SUSE Linux Enterprise Server product related.
Projects
None yet
Milestone
0.1.71
Development

Successfully merging this pull request may close these issues.
2 participants
@teacup-on-rockingchair @jan-cerny