Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Align wireless_disable_interfaces with Ubuntu 22.04 STIG #11886

Merged
merged 1 commit into from
Apr 26, 2024

Conversation

mpurg
Copy link
Contributor

@mpurg mpurg commented Apr 25, 2024

Description:

  • Created Ubuntu-specific OVAL to check /proc/net/wireless for enabled interfaces.
    The existing implementation relies on the interface name starting with
    "wl", which could be overriden.
  • Modified remediation to disable the driver modules as suggested by CIS and STIG,
    instead of disabling wifi using nmcli.

@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Apr 25, 2024
Copy link

openshift-ci bot commented Apr 25, 2024

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

github-actions bot commented Apr 25, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11886
This image was built from commit: a99b885

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11886

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11886 make deploy-local

@marcusburghardt marcusburghardt added the Ubuntu Ubuntu product related. label Apr 25, 2024
@dodys dodys self-assigned this Apr 26, 2024
@@ -1,8 +1,6 @@
# platform = multi_platform_ubuntu

if command -v nmcli >/dev/null 2>&1 ; then
nmcli radio all off
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please keep the nmcli, this aligns with CIS

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed, we can remove this since CIS 2.0.0 no longer uses nmcli in the remediation.

<ind:textfilecontent54_test check="all" check_existence="none_exist" comment="query /proc/net/wireless" id="test_wireless_disable_interfaces" version="1">
<ind:object object_ref="object_wireless_disable_interfaces" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_wireless_disable_interfaces" version="1">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this check is only identifying if there's any wireless interface, it is not checking if they are disabled.
The shared oval is better

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did this test to check if the interface is still listed:

# cat /proc/net/wireless 
Inter-| sta-|   Quality        |   Discarded packets               | Missed | WE
 face | tus | link level noise |  nwid  crypt   frag  retry   misc | beacon | 22
wlp2s0: 0000   45.  -65.  -256        0      0      0      0      1        0

# ip link set wlp2s0 down

# cat /proc/net/wireless 
Inter-| sta-|   Quality        |   Discarded packets               | Missed | WE
 face | tus | link level noise |  nwid  crypt   frag  retry   misc | beacon | 22

I did find an issue with the regex though.

@@ -93,6 +97,9 @@ ocil: |-

If a wireless interface is configured it must be documented and approved by
the local Authorizing Official.
{{% elif 'ubuntu' in product %}}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this if seems unnecessary as you already has the command introduced above and the note is already in the else below.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we don't make a special conditional for ubuntu it will show the nmcli in the else statement, which is not ideal since we are not relying on nmcli.

@@ -107,8 +114,26 @@ ocil: |-
{{% endif %}}

fixtext: |-
{{% if 'ubuntu' in product %}}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also mention the nmcli fix

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As decided, we are moving away from the nmcli fix.

@dodys dodys added ok-to-test Used by openshift-ci bot. and removed needs-ok-to-test Used by openshift-ci bot. labels Apr 26, 2024
- Created Ubuntu-specific OVAL to check /proc/net/wireless for enabled interfaces.
  The existing implementation relies on the interface name starting with
  "wl", which could be overriden.
- Modified remediation to disable the driver modules as suggested by CIS and STIG,
  instead of disabling wifi using nmcli.
@mpurg
Copy link
Contributor Author

mpurg commented Apr 26, 2024

Force pushed a fix to the OVAL regex and rebased to master. @dodys can you re-review?

Copy link

codeclimate bot commented Apr 26, 2024

Code Climate has analyzed commit a99b885 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

Copy link
Contributor

@dodys dodys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@dodys dodys merged commit 5d8bf7f into ComplianceAsCode:master Apr 26, 2024
113 checks passed
@Mab879 Mab879 added this to the 0.1.73 milestone Apr 26, 2024
@Mab879 Mab879 added the Bash Bash remediation update. label Apr 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bash Bash remediation update. ok-to-test Used by openshift-ci bot. Ubuntu Ubuntu product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants