Update ol7 stig references and severity values #5575

iokomin · 2020-04-08T18:48:41Z

Description:

This large commit is mostly ol7 stig references and severity update according to DISA OL7 STIG v1r1.
Changes:

where differ added ol7 stigid, disa, srg references
adjusted severity for ol7 prodtype in rules according to STIG values
added ol support to rules configure_firewalld_rate_limiting, sysctl_net_ipv4_tcp_invalid_ratelimit, install_antivirus

Rationale:

DISA OL7 STIG v1r1 released, rules need to be updated to match STIG references and severity.

Testing:

checked ol and rhel builds to pass
verified generated content to provide expected references and severity values for ol7 stig rules
checked introduced severity ol7 conditions didn't break existing values for e.g. rhel7
checked added rules to be applicable for ol prodtypes

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

openshift-ci-robot · 2020-04-08T18:48:50Z

Hi @iokomin. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

matejak · 2020-04-09T08:51:15Z

/ok-to-test

matejak

I trust you that you know what you are doing with those IDs, so the only thing I comment on are severity overrides.
I think that there is no reason to protect an "unknown" severity, but I feel that severity of a rule is generally context-dependent, and it's best handled in the profile that selects the rule.

matejak · 2020-04-09T08:53:43Z

linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/rule.yml

@@ -10,14 +10,19 @@ rationale: |-
    Removing the <tt>vsftpd</tt> package decreases the risk of its
    accidental activation.

-severity: low
+severity: {{% if product == "ol7" -%}}


Another way how to do things like this is a rule refinement in a profile - for example here: https://github.com/ComplianceAsCode/content/blob/master/rhel8/profiles/ospp.profile#L125 I find refinements preferable, as changing the default severity of the rule may have consequences down the road.

@matejak thanks for the hint, makes sense to me. Really, I've seen this adjustment as an example and profile looks like more reasonable place for it. I'll update this PR to move severity refinement to the profile.

Note: Making this change I just followed another existing approach:

content/linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml

Line 19 in c4100ac

severity: {{% if product == "rhel7" -%}}

Probably it's worth to update places like these as well to avoid confusion and note severity adjustment howto in the Developers Guide (if not done already:))?

@matejak I've noticed refined severity taken into account in eval scan results/report only. Generated guide uses rule default value. Is it by design, as it sounds reasonable to see refinements in generated guides as well?

As guides are profile-specific, I would expect them to show the same severity as the scanner does during the scan. In other words, it looks like to be a bug in the scanner.

Opened new issue for tracking: OpenSCAP/openscap#1512

redhatrises · 2020-04-09T13:22:59Z

linux_os/guide/system/software/updating/security_patches_up_to_date/rule.yml

+medium
+{{%- else -%}}
+high
+{{%- endif %}}


I wouldn't make this change at all. This severity has to be high.

@redhatrises thanks for your guidance.
I don't mind to have it "high" and was confused by "medium" for this rule as well. However latter is in use in DISAs OL7 STIG v1r1. Do you think this was a mistake on their side and expected to be fixed in the next STIG update?

redhatrises · 2020-04-09T13:24:02Z

linux_os/guide/system/permissions/partitions/mount_option_nosuid_removable_partitions/rule.yml

+medium
+{{%- else -%}}
+unknown
+{{%- endif %}}


Always replace unknown.

@redhatrises acked, I'll update PR.

Does it make sense to mention it in the Developer Guide?
As not being the rule contributor, change it's default severity value to one from prodtype specific security guide just looks not obvious.

redhatrises · 2020-04-09T13:24:19Z

linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml

+medium
+{{%- else -%}}
+unknown
+{{%- endif %}}


Always replace unknown

redhatrises · 2020-04-09T13:25:28Z

linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml

+medium
+{{%- else -%}}
+unknown
+{{%- endif %}}


Always replace unknown

redhatrises · 2020-04-09T13:26:23Z

linux_os/guide/system/network/network_configure_name_resolution/rule.yml

+low
+{{%- else -%}}
+unknown
+{{%- endif %}}


Always replace unknown

redhatrises · 2020-04-09T13:26:25Z

linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml

+medium
+{{%- else -%}}
+unknown
+{{%- endif %}}


Always replace unknown

Per review severity refinment moved to the profile, unknown severities replaced with values according to OL7 STIG v1r1. Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

redhatrises · 2020-04-13T15:47:32Z

@iokomin both DISA CCIs and SRGs shouldn't be product specific. The should be merged into the top-level SRG and CCI references.

iokomin · 2020-04-13T16:14:50Z

@redhatrises product specific srg, disa items product specific in places where OL7 ids differ from values in rules now, taking existing rhel6 approach as an example.
Please confirm that I need just to add list of OL7 STIG specific values to the current srg and disa references if they are different?

redhatrises · 2020-04-13T16:29:10Z

@redhatrises product specific srg, disa items product specific in places where OL7 ids differ from values in rules now, taking existing rhel6 approach as an example.
Please confirm that I need just to add list of OL7 STIG specific values to the current srg and disa references if they are different?

There is actually no such thing as product specific SRGs and CCIs. The rhel6 example is from very old SRGs vs the new SRGs that are in use in operating systems version 7+. They are high-level generic references which is why they can all be merged together. STIGIDs, on the other hand, are product specific.

redhatrises · 2020-04-13T16:30:03Z

Please confirm that I need just to add list of OL7 STIG specific values to the current srg and disa references if they are different?

Yes..... just adding them (non-duplicates) is fine.

iokomin · 2020-04-13T17:34:36Z

Ack, I'll make suggested changes and update this request.

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

iokomin · 2020-04-15T02:56:13Z

@redhatrises please find requested change implemented.

redhatrises · 2020-04-15T18:37:23Z

@redhatrises please find requested change implemented.

@iokomin looks good to me.

iokomin · 2020-04-16T16:09:13Z

@redhatrises I noticed "Changes requested" status still enabled. Is there anything else I should work on or this PR can be merged in master?

redhatrises · 2020-04-16T21:51:46Z

It can be merged as is. Thanks!

iokomin added 6 commits April 8, 2020 13:45

Update references with ol7 stig ids

46a17af

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Add ol product support to install_antivirus rule

143aa52

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Add ol product support to configure_firewalld_rate_limiting rule

2f6b5c5

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Add ol product support to sysctl_net_ipv4_tcp_invalid_ratelimit rule

9063211

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Update references and severity for ol7

2c11d43

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Adjust ol7 stig rules severity and srg

bd3c24e

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

openshift-ci-robot added the needs-ok-to-test Used by openshift-ci bot. label Apr 8, 2020

openshift-ci-robot added ok-to-test Used by openshift-ci bot. and removed needs-ok-to-test Used by openshift-ci bot. labels Apr 9, 2020

matejak requested changes Apr 9, 2020

View reviewed changes

matejak self-assigned this Apr 9, 2020

redhatrises reviewed Apr 9, 2020

View reviewed changes

Update ol7 severity refinement

5787069

Per review severity refinment moved to the profile, unknown severities replaced with values according to OL7 STIG v1r1. Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

Merge ol7 srg and disa refs with global

8eeae5e

Signed-off-by: Ilya Okomin <ilya.okomin@oracle.com>

redhatrises added this to the 0.1.50 milestone Apr 16, 2020

redhatrises merged commit 6a689c5 into ComplianceAsCode:master Apr 16, 2020

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ol7 stig references and severity values #5575

Update ol7 stig references and severity values #5575

iokomin commented Apr 8, 2020

openshift-ci-robot commented Apr 8, 2020

matejak commented Apr 9, 2020

matejak left a comment

matejak Apr 9, 2020

iokomin Apr 9, 2020 •

edited

Loading

iokomin Apr 9, 2020

matejak Apr 15, 2020

iokomin Apr 15, 2020

redhatrises Apr 9, 2020

iokomin Apr 9, 2020

redhatrises Apr 9, 2020

iokomin Apr 9, 2020

redhatrises Apr 9, 2020

redhatrises Apr 9, 2020

redhatrises Apr 9, 2020

redhatrises Apr 9, 2020

redhatrises commented Apr 13, 2020

iokomin commented Apr 13, 2020

redhatrises commented Apr 13, 2020

redhatrises commented Apr 13, 2020

iokomin commented Apr 13, 2020

iokomin commented Apr 15, 2020

redhatrises commented Apr 15, 2020

iokomin commented Apr 16, 2020

redhatrises commented Apr 16, 2020

Update ol7 stig references and severity values #5575

Update ol7 stig references and severity values #5575

Conversation

iokomin commented Apr 8, 2020

Description:

Rationale:

Testing:

openshift-ci-robot commented Apr 8, 2020

matejak commented Apr 9, 2020

matejak left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iokomin Apr 9, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

redhatrises commented Apr 13, 2020

iokomin commented Apr 13, 2020

redhatrises commented Apr 13, 2020

redhatrises commented Apr 13, 2020

iokomin commented Apr 13, 2020

iokomin commented Apr 15, 2020

redhatrises commented Apr 15, 2020

iokomin commented Apr 16, 2020

redhatrises commented Apr 16, 2020

iokomin Apr 9, 2020 •

edited

Loading