Audit watch on /etc/sysconfig/network-scripts #11724
Conversation
This template will allow to easily create rules that check audit file system rules, also called watches.
This commit adds a new rule that checks if an audit watch is configured on /etc/sysconfig/network-scripts. Then, this rule is added to RHEL CIS profiles. The CIS Benchmarks require changes on /etc/sysconfig/network-scripts to be audited. We could add this audit rule to existing rule audit_rules_networkconfig_modification. However, we decided to create a new rule. The rule audit_rules_networkconfig_modification is already overloaded by having many items in a single rule. The rule is also used in many different profiles in many products so the rule scope change could cause unpredicted effects in some of these profiles. Also, we expect /etc/sysconfig/network-scripts to be deprecated in future RHEL so creating a separate rule will help us to easily exclude this audit rule from other products. Resolves: RHEL-29308
jan-cerny
added
bugfix
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
|
Code Climate has analyzed commit bdb5ce7 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.3% (0.0% change). View more on Code Climate. |
Description:
This PR introduces a new rule
audit_rules_networkconfig_modification_network_scriptsthat checks if an audit watch is configured on/etc/sysconfig/network-scripts. Then, this rule is added to RHEL CIS profiles.We could add this audit rule to existing rule
audit_rules_networkconfig_modification. However, we decided to create a new rule. The ruleaudit_rules_networkconfig_modificationis already overloaded by having many items in a single rule. The rule is also used in many different profiles in many products so the rule scope change could cause unpredicted effects in some of these profiles. Also, we expect/etc/sysconfig/network-scriptsto be deprecated in future RHEL so creating a separate rule will help us to easily exclude this audit rule from other products.The new rule uses a new template
audit_rules_watch, which is also introduced in this PR. This template will allow to easily create rules that check audit file system rules, also called watches.For more details, please read commit messages of each commit.
Rationale:
RHEL 9 CIS Benchmark Section 4.1.3.5 requires that
/etc/sysconfig/network-scriptsis audited. Other CIS benchmarks are similar.Fixes: https://issues.redhat.com/browse/RHEL-29308