-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SLE15 prefer systemd unit handling of AIDE checks and notifications #11178
SLE15 prefer systemd unit handling of AIDE checks and notifications #11178
Conversation
This datastream diff is auto generated by the check Click here to see the full diffOCIL for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- ocil:ssg-aide_scan_notification_ocil:questionnaire:1
+++ ocil:ssg-aide_scan_notification_ocil:questionnaire:1
@@ -1,4 +1,5 @@
To determine that periodic AIDE execution has been scheduled, run the following command:
+
$ grep aide /etc/crontab
The output should return something similar to the following:
05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost
bash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -5,6 +5,7 @@
yum install -y "aide"
fi
var_aide_scan_notification_email=''
+
CRONTAB=/etc/crontab |
@@ -39,5 +50,37 @@ | |||
<ind:pattern operation="pattern match">^.*{{{ aide_bin_path }}}[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*.+@.+$</ind:pattern> | |||
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance> | |||
</ind:textfilecontent54_object> | |||
|
|||
<ind:textfilecontent54_test check="all" check_existence="all_exist" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This new part isn't described in rule.yml at all. You should extend the rule description and other artifacts.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
got you will do 🙇
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK
test_ref="test_aide_var_cron_notification" /> | ||
<criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" | ||
test_ref="test_aide_crontabs_notification" /> | ||
<criteria operator="AND"> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this new criteria be guarded as SLE-only? The new code in Bash and Ansible remediations is marked as SLE-only.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well I prefer to be SLE only for now and other maintainers to adopt it if consider viable, therefore the bash and ansible remediations aer platform dependant
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for reply. But, if you think that this part should be SLE-only for now, would it be better to put it inside a Jinja if product in ...
block?
…ions Drop some extra whitespaces. Thanks to @jan-cerny for the feedback on this 🙇
6229a3f
to
8fd0786
Compare
/packit build |
CRONTAB=/etc/crontab | ||
CRONDIRS='/etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly' | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@teacup-on-rockingchair I think this shouldn't be removed, these variables are used below (lines 37-38). I think this might be the reason why this rule fails the CI.
Thanks to @jan-cerny for the note 🙇
Code Climate has analyzed commit 10173f5 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The CI fail of Automatus on SLE15 is fixed by #11212 and isn't related to this PR.
Notice the Automatus CS9 job pass because the rule is evaluated as notapplicable in a container environment. I have run the test scenarios locally with a RHEL 9 virtual machine as a back end. Both Ansible and Bash are passing:
jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1432/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11178) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible aide_periodic_cron_checking
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-11-02-1437/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
INFO - Script aide_not_installed.fail.sh using profile (all) OK
INFO - Script cron_daily.pass.sh using profile (all) OK
INFO - Script cron_daily_complex.pass.sh using profile (all) OK
INFO - Script crontab_daily.pass.sh using profile (all) OK
INFO - Script crontab_daily_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_monthly.fail.sh using profile (all) OK
INFO - Script crontab_two_days_week.pass.sh using profile (all) OK
INFO - Script crontab_weekly_on_exact_day.pass.sh using profile (all) OK
INFO - Script crontab_weekly_shortcut.pass.sh using profile (all) OK
INFO - Script crontab_weekly_word.pass.sh using profile (all) OK
INFO - Script crontab_yearly.fail.sh using profile (all) OK
INFO - Script not_in_cron.fail.sh using profile (all) OK
Description:
Rationale: