-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update ANSSI R50 #11588
Update ANSSI R50 #11588
Conversation
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
@@ -24,6 +24,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.2.11
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership
@@ -22,6 +22,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.2.11
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -27,6 +27,9 @@
RHEL-08-010741
[reference]:
+BP28(R50)
+
+[reference]:
SV-244532r743845_rule
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -24,7 +24,13 @@
[reference]:
SRG-OS-000480-GPOS-00227
+[reference]:
+BP28(R50)
+
[rationale]:
If local interactive users do not own the files in their directories,
unauthorized users may be able to access them. Additionally, if files are not
owned by the user, this could be an indication of system compromise.
+
+[ident]:
+CCE-87040-2
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -3,6 +3,7 @@
database: passwd
split: ':'
tags:
+ - CCE-87040-2
- accounts_users_home_files_ownership
- low_complexity
- low_disruption
@@ -14,6 +15,7 @@
ansible.builtin.set_fact:
local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
tags:
+ - CCE-87040-2
- accounts_users_home_files_ownership
- low_complexity
- low_disruption
@@ -31,6 +33,7 @@
- item.value[1]|int >= 1000
- item.value[1]|int != 65534
tags:
+ - CCE-87040-2
- accounts_users_home_files_ownership
- low_complexity
- low_disruption
@@ -46,6 +49,7 @@
loop: '{{ local_users|zip(path_exists.results)|list }}'
when: item.1.stat is defined and item.1.stat.exists
tags:
+ - CCE-87040-2
- accounts_users_home_files_ownership
- low_complexity
- low_disruption
New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
@@ -19,6 +19,9 @@
RHEL-08-010731
[reference]:
+BP28(R50)
+
+[reference]:
SV-244531r743842_rule
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files'.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -17,6 +17,9 @@
RHEL-08-010770
[reference]:
+BP28(R50)
+
+[reference]:
6.2.11
[reference]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_group'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
@@ -171,6 +171,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.4
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
@@ -162,6 +162,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.8
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
@@ -171,6 +171,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.1
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
@@ -171,6 +171,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.6
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells
@@ -13,6 +13,9 @@
MP-2
[reference]:
+BP28(R50)
+
+[reference]:
6.1.10
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_group'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_group
@@ -174,6 +174,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.4
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_passwd'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
@@ -174,6 +174,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
6.1.1
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_shells
@@ -13,6 +13,9 @@
MP-2
[reference]:
+BP28(R50)
+
+[reference]:
6.1.10
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_permissions_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_permissions_etc_shells
@@ -13,6 +13,9 @@
MP-2
[reference]:
+BP28(R50)
+
+[reference]:
6.1.10
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
+++ xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
@@ -34,6 +34,9 @@
RHEL-08-010320
[reference]:
+BP28(R50)
+
+[reference]:
SV-230259r792864_rule
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs'.
--- xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
+++ xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
@@ -186,6 +186,9 @@
RHEL-08-010310
[reference]:
+BP28(R50)
+
+[reference]:
SV-230258r627750_rule
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs'.
--- xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
+++ xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
@@ -186,6 +186,9 @@
RHEL-08-010300
[reference]:
+BP28(R50)
+
+[reference]:
SV-230257r792862_rule
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config
@@ -166,6 +166,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
4.2.1
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
@@ -7,6 +7,9 @@
group-owned by ssh_keys group.
[reference]:
+BP28(R50)
+
+[reference]:
4.2.2
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
@@ -5,6 +5,9 @@
[description]:
SSH server public keys, files that match the /etc/ssh/*.pub glob, must be
group-owned by root group.
+
+[reference]:
+BP28(R50)
[reference]:
4.2.3
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_owner_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_owner_sshd_config
@@ -166,6 +166,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
4.2.1
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
@@ -7,6 +7,9 @@
by root user.
[reference]:
+BP28(R50)
+
+[reference]:
4.2.2
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
@@ -5,6 +5,9 @@
[description]:
SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned
by root user.
+
+[reference]:
+BP28(R50)
[reference]:
4.2.3
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_config
@@ -169,6 +169,9 @@
SRG-OS-000480-GPOS-00227
[reference]:
+BP28(R50)
+
+[reference]:
4.2.1
[rationale]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
@@ -183,6 +183,9 @@
RHEL-08-010480
[reference]:
+BP28(R50)
+
+[reference]:
4.2.3
[reference]: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm going to have pull my approval.
Please a take the Automatus failures, I'm able to reproduce locally in a VM.
Assign rules to components due to their XCCDF group membership.
/packit retest-failed |
2 similar comments
/packit retest-failed |
/packit retest-failed |
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
/packit retest-failed |
|
||
title: Verify Permissions On /etc/selinux Directory | ||
|
||
description: '{{{ describe_file_permissions(file="/etc/selinux", perms="0644") }}}' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is a directory should this be 0755?
|
||
title: Verify Permissions On /etc/nftables Directory | ||
|
||
description: '{{{ describe_file_permissions(file="/etc/nftables", perms="0600") }}}' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is a directory should the permissions be 0700?
In this commit we will change the permissions required by rules directory_permissions_etc_nftables and directory_permissions_etc_selinux to the actual values of respective directories.
/packit retest-failed |
2 similar comments
/packit retest-failed |
/packit retest-failed |
|
||
title: Verify Permissions On /etc/ipsec.d Directory | ||
|
||
description: '{{{ describe_file_permissions(file="/etc/ipsec.d", perms="0644") }}}' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this be 0755 as well?
Code Climate has analyzed commit c70338b and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.1% (-0.1% change). View more on Code Climate. |
Waving the code coverage check as no Python code was changed. |
Description:
Add existing rules to R50 and create new rules checking permissions and access rights on important system files and directories.
Rationale:
Align the ANSSI profiles with ANSSI 2.0