Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Simplify output of ip link show command #11657

Conversation

marcusburghardt
Copy link
Member

Description:

In network_sniffer_disabled rule this command is used to collect the interface names.
This can be simplified using the -o (oneline) option from ip command instead of filtering the output with other commands.

This was noticed when investigating failures in CI tests for #11248

Rationale:

Simplify command output so Bash and Ansible remediation are more robust.
Less is more. : )

@marcusburghardt marcusburghardt added bugfix Fixes to reported bugs. Ansible Ansible remediation update. Bash Bash remediation update. labels Mar 6, 2024
@marcusburghardt marcusburghardt added this to the 0.1.73 milestone Mar 6, 2024
Copy link

github-actions bot commented Mar 6, 2024

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

github-actions bot commented Mar 6, 2024

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff
bash remediation for rule 'xccdf_org.ssgproject.content_rule_network_sniffer_disabled' differs.
--- xccdf_org.ssgproject.content_rule_network_sniffer_disabled
+++ xccdf_org.ssgproject.content_rule_network_sniffer_disabled
@@ -1,7 +1,7 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-for interface in $(ip link show | grep -E '^[0-9]' | cut -d ":" -f 2); do
+for interface in $(ip -o link show | cut -d ":" -f 2); do
     ip link set dev $interface multicast off promisc off
 done
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_network_sniffer_disabled' differs.
--- xccdf_org.ssgproject.content_rule_network_sniffer_disabled
+++ xccdf_org.ssgproject.content_rule_network_sniffer_disabled
@@ -1,6 +1,6 @@
 - name: Ensure System is Not Acting as a Network Sniffer - Gather network interfaces
   ansible.builtin.command:
-    cmd: ip link show
+    cmd: ip -o link show
   register: network_interfaces
   when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   tags:
@@ -25,7 +25,7 @@
   loop: '{{ network_interfaces.stdout_lines }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
-  - item.split(':') | length == 3
+  - item.split(':')
   tags:
   - CCE-82283-3
   - DISA-STIG-RHEL-08-040330

Copy link

github-actions bot commented Mar 6, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11657
This image was built from commit: d0724ed

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11657

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11657 make deploy-local

@marcusburghardt
Copy link
Member Author

Automatus tests are expected to fail because the containers used in these tests are not allowing to set an interface in promisc mode:

ip link set dev lo promisc on
RTNETLINK answers: Operation not permitted

This could probably be solved managing the container capabilities. However, for the scope of this PR, testin-farm and automatus tests in local VMs should be enough.

In network_sniffer_disabled rule this command is used to collect the
interface names. This can be simplified using the -o (oneline) option
from ip command instead of filtering the output with other commands.
@marcusburghardt marcusburghardt force-pushed the network_sniffer_disabled_short_output branch from 833800c to d0724ed Compare March 6, 2024 11:17
Copy link

codeclimate bot commented Mar 6, 2024

Code Climate has analyzed commit d0724ed and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.8% (0.0% change).

View more on Code Climate.

@Mab879 Mab879 self-assigned this Mar 7, 2024
@Mab879
Copy link
Member

Mab879 commented Mar 7, 2024

Automatus tests are expected to fail because the containers used in these tests are not allowing to set an interface in promisc mode:

ip link set dev lo promisc on
RTNETLINK answers: Operation not permitted

This could probably be solved managing the container capabilities. However, for the scope of this PR, testin-farm and automatus tests in local VMs should be enough.

Agreed. Tests pass locally in a VM.

@Mab879 Mab879 merged commit 923a2bd into ComplianceAsCode:master Mar 7, 2024
40 of 44 checks passed
@marcusburghardt marcusburghardt deleted the network_sniffer_disabled_short_output branch March 7, 2024 07:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Ansible Ansible remediation update. Bash Bash remediation update. bugfix Fixes to reported bugs.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants