-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
all_apparmor_profiles_in_enforce_complain_mode: Fix OVAL logic #11672
all_apparmor_profiles_in_enforce_complain_mode: Fix OVAL logic #11672
Conversation
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
@teacup-on-rockingchair is the tests you added to this rule actually working? they seem completely broken right now. I tried to fix it by adding the apparmor-utils to platform-packages-override and now it fails with something else. |
I am afraid for the aa-teardown, and apparmor_parser used in the tests you need to add also |
linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/oval/shared.xml
Outdated
Show resolved
Hide resolved
df2abe3
to
65e351b
Compare
in that case, we should waiver the test failures. Could you please check now if it works fine on sles? |
Current OVAL fails with unknown result because the variables are looking for a subexpression of the subject when there's none. Also remove check for unconfined as it is not needed
Code Climate has analyzed commit bbff647 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.8% (0.0% change). View more on Code Climate. |
Yes they work with the patches and are failing on master branch with my half baked commit so I guess we are ok there :) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the contribution and corrections @dodys 🙇 . If you decide to go with the suggested more simplistic approach just ping me to approve it again. Overall I think most important is that we have a working precedent of oval check working with apparmor ;)
I feel like this OVAL still doesn't implement the whole check from CIS. It only checks profiles, not processes. |
353e6e0
into
ComplianceAsCode:master
Description:
unknown
result because the variables are looking for asubexpression
field of the object when there's none. Instead usetext
part of the object. Also change how you seek for unconfined.Rationale:
subexpression
field from the object you would need to select some specific text with parenthesis, but that's not being done. Since we don't care about the actual pattern being matched but instead the number of matches, using thetext
field instead is enough.Review Hints: