-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix #11895 issue #11897
Fix #11895 issue #11897
Conversation
Hi @marcofortina. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
Please fix the description, aide_build_database has nothing to do with audisp |
/packit retest-failed |
I think I already fixed the description. Am I wrong? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm, thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
just a small improvement
Code Climate has analyzed commit e489309 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.4% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm, thanks!
@@ -1,4 +1,4 @@ | |||
aide_also_checks_audispd: 'yes' | |||
aide_also_checks_audispd: 'no' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like there is a difference between CIS and STIG with respect to this variable.
According to Ubuntu 22.04 STIG, rule UBTU-22-651030, aide should also check the integrity of audispd
.
I suggest we re-set the var to yes
, enabling the check for all benchmarks, and thus introducing an (negligible) extra check in CIS, instead of having a missing check in STIG.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mpurg audispd doesn't exist on 22.04. DISA needs to update their benchmark.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ooops, mybad, should've read the original issue 🤦
All good then, I'll inform DISA.
Description:
This PR fixes wrong check on /sbin/audispd on Debian >= 11 and Ubuntu >= 22.04.
Rationale:
Review Hints:
Build the product:
To test these changes with Ansible:
To test changes with bash, run the remediation sections:
xccdf_org.ssgproject.content_rule_aide_check_audit_tools
Expected output: