-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Audit watch on /etc/sysconfig/network-scripts #11724
Conversation
This template will allow to easily create rules that check audit file system rules, also called watches.
This commit adds a new rule that checks if an audit watch is configured on /etc/sysconfig/network-scripts. Then, this rule is added to RHEL CIS profiles. The CIS Benchmarks require changes on /etc/sysconfig/network-scripts to be audited. We could add this audit rule to existing rule audit_rules_networkconfig_modification. However, we decided to create a new rule. The rule audit_rules_networkconfig_modification is already overloaded by having many items in a single rule. The rule is also used in many different profiles in many products so the rule scope change could cause unpredicted effects in some of these profiles. Also, we expect /etc/sysconfig/network-scripts to be deprecated in future RHEL so creating a separate rule will help us to easily exclude this audit rule from other products. Resolves: RHEL-29308
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
Code Climate has analyzed commit bdb5ce7 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.3% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Thanks for your work.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
Thanks!
Description:
This PR introduces a new rule
audit_rules_networkconfig_modification_network_scripts
that checks if an audit watch is configured on/etc/sysconfig/network-scripts
. Then, this rule is added to RHEL CIS profiles.We could add this audit rule to existing rule
audit_rules_networkconfig_modification
. However, we decided to create a new rule. The ruleaudit_rules_networkconfig_modification
is already overloaded by having many items in a single rule. The rule is also used in many different profiles in many products so the rule scope change could cause unpredicted effects in some of these profiles. Also, we expect/etc/sysconfig/network-scripts
to be deprecated in future RHEL so creating a separate rule will help us to easily exclude this audit rule from other products.The new rule uses a new template
audit_rules_watch
, which is also introduced in this PR. This template will allow to easily create rules that check audit file system rules, also called watches.For more details, please read commit messages of each commit.
Rationale:
RHEL 9 CIS Benchmark Section 4.1.3.5 requires that
/etc/sysconfig/network-scripts
is audited. Other CIS benchmarks are similar.Fixes: https://issues.redhat.com/browse/RHEL-29308