Update ANSSI R50 #11588

jan-cerny · 2024-02-14T09:46:52Z

Description:

Add existing rules to R50 and create new rules checking permissions and access rights on important system files and directories.

Rationale:

Align the ANSSI profiles with ANSSI 2.0

github-actions · 2024-02-14T09:48:29Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-02-14T09:50:59Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
@@ -24,6 +24,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.2.11
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_user_ownership
@@ -22,6 +22,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.2.11
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -27,6 +27,9 @@
 RHEL-08-010741
 
 [reference]:
+BP28(R50)
+
+[reference]:
 SV-244532r743845_rule
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -24,7 +24,13 @@
 [reference]:
 SRG-OS-000480-GPOS-00227
 
+[reference]:
+BP28(R50)
+
 [rationale]:
 If local interactive users do not own the files in their directories,
 unauthorized users may be able to access them. Additionally, if files are not
 owned by the user, this could be an indication of system compromise.
+
+[ident]:
+CCE-87040-2

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -3,6 +3,7 @@
     database: passwd
     split: ':'
   tags:
+  - CCE-87040-2
   - accounts_users_home_files_ownership
   - low_complexity
   - low_disruption
@@ -14,6 +15,7 @@
   ansible.builtin.set_fact:
     local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
   tags:
+  - CCE-87040-2
   - accounts_users_home_files_ownership
   - low_complexity
   - low_disruption
@@ -31,6 +33,7 @@
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
   tags:
+  - CCE-87040-2
   - accounts_users_home_files_ownership
   - low_complexity
   - low_disruption
@@ -46,6 +49,7 @@
   loop: '{{ local_users|zip(path_exists.results)|list }}'
   when: item.1.stat is defined and item.1.stat.exists
   tags:
+  - CCE-87040-2
   - accounts_users_home_files_ownership
   - low_complexity
   - low_disruption

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
@@ -19,6 +19,9 @@
 RHEL-08-010731
 
 [reference]:
+BP28(R50)
+
+[reference]:
 SV-244531r743842_rule
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files'.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -17,6 +17,9 @@
 RHEL-08-010770
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.2.11
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_group'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
@@ -171,6 +171,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.4
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
@@ -162,6 +162,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.8
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
@@ -171,6 +171,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
@@ -171,6 +171,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.6
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shells
@@ -13,6 +13,9 @@
 MP-2
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.10
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_group'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_group
@@ -174,6 +174,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.4
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_passwd'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
@@ -174,6 +174,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_shells
@@ -13,6 +13,9 @@
 MP-2
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.10
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_etc_shells'.
--- xccdf_org.ssgproject.content_rule_file_permissions_etc_shells
+++ xccdf_org.ssgproject.content_rule_file_permissions_etc_shells
@@ -13,6 +13,9 @@
 MP-2
 
 [reference]:
+BP28(R50)
+
+[reference]:
 6.1.10
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
+++ xccdf_org.ssgproject.content_rule_file_groupownership_system_commands_dirs
@@ -34,6 +34,9 @@
 RHEL-08-010320
 
 [reference]:
+BP28(R50)
+
+[reference]:
 SV-230259r792864_rule
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs'.
--- xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
+++ xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs
@@ -186,6 +186,9 @@
 RHEL-08-010310
 
 [reference]:
+BP28(R50)
+
+[reference]:
 SV-230258r627750_rule
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs'.
--- xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
+++ xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs
@@ -186,6 +186,9 @@
 RHEL-08-010300
 
 [reference]:
+BP28(R50)
+
+[reference]:
 SV-230257r792862_rule
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config
@@ -166,6 +166,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
@@ -7,6 +7,9 @@
 group-owned by ssh_keys group.
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.2
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
@@ -5,6 +5,9 @@
 [description]:
 SSH server public keys, files that match the /etc/ssh/*.pub glob, must be
 group-owned by root group.
+
+[reference]:
+BP28(R50)
 
 [reference]:
 4.2.3

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_owner_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_owner_sshd_config
@@ -166,6 +166,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
@@ -7,6 +7,9 @@
 by root user.
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.2
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
@@ -5,6 +5,9 @@
 [description]:
 SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned
 by root user.
+
+[reference]:
+BP28(R50)
 
 [reference]:
 4.2.3

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_config'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_config
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_config
@@ -169,6 +169,9 @@
 SRG-OS-000480-GPOS-00227
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
@@ -183,6 +183,9 @@
 RHEL-08-010480
 
 [reference]:
+BP28(R50)
+
+[reference]:
 4.2.3
 
 [reference]:

Mab879

I'm going to have pull my approval.

Please a take the Automatus failures, I'm able to reproduce locally in a VM.

Assign rules to components due to their XCCDF group membership.

jan-cerny · 2024-02-19T09:56:40Z

/packit retest-failed

jan-cerny · 2024-02-19T10:50:59Z

/packit retest-failed

jan-cerny · 2024-02-19T12:04:49Z

/packit retest-failed

github-actions · 2024-02-19T14:59:38Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11588

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11588

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11588 make deploy-local

jan-cerny · 2024-02-20T07:41:07Z

/packit retest-failed

Mab879 · 2024-02-20T12:56:24Z

linux_os/guide/system/selinux/directory_permissions_etc_selinux/rule.yml

+
+title: Verify Permissions On /etc/selinux Directory
+
+description: '{{{ describe_file_permissions(file="/etc/selinux", perms="0644") }}}'


Since this is a directory should this be 0755?

Mab879 · 2024-02-20T12:59:14Z

linux_os/guide/system/network/network-nftables/directory_permissions_etc_nftables/rule.yml

+
+title: Verify Permissions On /etc/nftables Directory
+
+description: '{{{ describe_file_permissions(file="/etc/nftables", perms="0600") }}}'


Since this is a directory should the permissions be 0700?

In this commit we will change the permissions required by rules directory_permissions_etc_nftables and directory_permissions_etc_selinux to the actual values of respective directories.

jan-cerny · 2024-02-21T08:23:06Z

/packit retest-failed

jan-cerny · 2024-02-21T09:03:17Z

/packit retest-failed

jan-cerny · 2024-02-21T10:01:49Z

/packit retest-failed

Mab879 · 2024-02-21T13:53:35Z

linux_os/guide/system/network/network-ipsec/directory_permissions_etc_ipsecd/rule.yml

+
+title: Verify Permissions On /etc/ipsec.d Directory
+
+description: '{{{ describe_file_permissions(file="/etc/ipsec.d", perms="0644") }}}'


Should this be 0755 as well?

codeclimate · 2024-02-21T17:17:22Z

Code Climate has analyzed commit c70338b and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.1% (-0.1% change).

View more on Code Climate.

Mab879 · 2024-02-21T19:00:44Z

Waving the code coverage check as no Python code was changed.

jan-cerny added New Rule Issues or pull requests related to new Rules. Update Profile Issues or pull requests related to Profiles updates. ANSSI ANSSI Benchmark related. labels Feb 14, 2024

jan-cerny added this to the 0.1.73 milestone Feb 14, 2024

jan-cerny force-pushed the ANSSI_R50 branch from d9713e7 to a7998f3 Compare February 14, 2024 10:01

Mab879 self-assigned this Feb 14, 2024

Mab879 approved these changes Feb 15, 2024

View reviewed changes

Mab879 requested changes Feb 15, 2024

View reviewed changes

jan-cerny added 20 commits February 16, 2024 15:32

Add RHEL 9 CCEs

1818d7e

Add missing rules to ANSSI R50

81b7b66

Create rule directory_owner_etc_selinux

7950ed8

Create rule directory_groupowner_etc_selinux

b3b0942

Create rule directory_permissions_etc_selinux

406d98f

Create rule file_owner_etc_sestatus_conf

ef6a684

Create rule file_groupowner_etc_sestatus_conf

d4c7616

Create rule file_permissions_etc_sestatus_conf

2f42688

Create rule directory_groupowner_etc_ipsecd

c5968c5

Create rule directory_owner_etc_ipsecd

7482ac7

Create rule directory_permissions_etc_ipsecd

ed0b373

Create rule directory_groupowner_etc_nftables

7d6c657

Create rule directory_owner_etc_nftables

788013b

Create rule directory_permissions_etc_nftables

2ead834

Create rule directory_groupowner_etc_sysctld

a8a6e99

Create rule directory_owner_etc_sysctld

109d84b

Create rule directory_permissions_etc_sysctld

956505a

Create rule directory_groupowner_etc_sudoersd

cdb5570

Create rule directory_owner_etc_sudoersd

e8db7de

Create rule directory_permissions_etc_sudoersd

66ddb70

jan-cerny added 10 commits February 16, 2024 15:32

Create rule file_permissions_etc_ipsec_secrets

e3b7cc1

Create rule file_groupowner_etc_sudoers

70255fe

Create rule file_owner_etc_sudoers

0cfe507

Create rule file_permissions_etc_sudoers

2a1ac46

Create rule directory_groupowner_etc_iptables

54d66f0

Create rule directory_owner_etc_iptables

107fd85

Create rule directory_permissions_etc_iptables

25d30ea

Clarify files and directories

65e8434

Assign rules to components

d09288c

Assign rules to components due to their XCCDF group membership.

Add missing CCEs

b19481d

jan-cerny force-pushed the ANSSI_R50 branch from c47c6cb to b19481d Compare February 16, 2024 14:41

Use correct permissions for /etc/sudoers.d

e6286ee

jan-cerny added 2 commits February 19, 2024 14:46

Use correct permissions in /etc/sysctl.d

612711a

Remove used CCEs from pool

2fec890

Mab879 reviewed Feb 20, 2024

View reviewed changes

Use correct directory permissions

87b0ba7

In this commit we will change the permissions required by rules directory_permissions_etc_nftables and directory_permissions_etc_selinux to the actual values of respective directories.

Mab879 requested changes Feb 21, 2024

View reviewed changes

Change permissions of /etc/ipsec.d

c70338b

Mab879 approved these changes Feb 21, 2024

View reviewed changes

Mab879 merged commit b895bce into ComplianceAsCode:master Feb 21, 2024
43 of 44 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ANSSI R50 #11588

Update ANSSI R50 #11588

jan-cerny commented Feb 14, 2024

github-actions bot commented Feb 14, 2024

github-actions bot commented Feb 14, 2024 •

edited

Loading

Mab879 left a comment

jan-cerny commented Feb 19, 2024

jan-cerny commented Feb 19, 2024

jan-cerny commented Feb 19, 2024

github-actions bot commented Feb 19, 2024

jan-cerny commented Feb 20, 2024

Mab879 Feb 20, 2024

Mab879 Feb 20, 2024

jan-cerny commented Feb 21, 2024

jan-cerny commented Feb 21, 2024

jan-cerny commented Feb 21, 2024

Mab879 Feb 21, 2024

codeclimate bot commented Feb 21, 2024

Mab879 commented Feb 21, 2024


		title: Verify Permissions On /etc/selinux Directory

		description: '{{{ describe_file_permissions(file="/etc/selinux", perms="0644") }}}'


		title: Verify Permissions On /etc/nftables Directory

		description: '{{{ describe_file_permissions(file="/etc/nftables", perms="0600") }}}'


		title: Verify Permissions On /etc/ipsec.d Directory

		description: '{{{ describe_file_permissions(file="/etc/ipsec.d", perms="0644") }}}'

Update ANSSI R50 #11588

Update ANSSI R50 #11588

Conversation

jan-cerny commented Feb 14, 2024

Description:

Rationale:

github-actions bot commented Feb 14, 2024

github-actions bot commented Feb 14, 2024 • edited Loading

Mab879 left a comment

Choose a reason for hiding this comment

jan-cerny commented Feb 19, 2024

jan-cerny commented Feb 19, 2024

jan-cerny commented Feb 19, 2024

github-actions bot commented Feb 19, 2024

jan-cerny commented Feb 20, 2024

Mab879 Feb 20, 2024

Choose a reason for hiding this comment

Mab879 Feb 20, 2024

Choose a reason for hiding this comment

jan-cerny commented Feb 21, 2024

jan-cerny commented Feb 21, 2024

jan-cerny commented Feb 21, 2024

Mab879 Feb 21, 2024

Choose a reason for hiding this comment

codeclimate bot commented Feb 21, 2024

Mab879 commented Feb 21, 2024

github-actions bot commented Feb 14, 2024 •

edited

Loading