Add template for zIPL boot entry option #5908

yuumasato · 2020-07-03T23:57:06Z

Description:

Add zipl_bls_entries_option template to check and configure BLS options for zIPL
- With support for Ansible, Bash and OVAL
Enables the new template in relevant rules

Rationale:

Templates for the win!

openshift-ci-robot · 2020-07-03T23:57:08Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

pep8speaks · 2020-07-03T23:57:09Z

Hello @yuumasato! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! 🍻

Comment last updated at 2020-07-10 15:16:05 UTC

Create initial version of zIPL specific BLS entries template by copying bls_entries_option template.

Extend zipl_bls_entries_option template to check that the kernel option is also configure in /etc/kernel/cmdline. The presence of the argument in /etc/kernel/cmdline ensures that newly installed kernels will be configure if the option.

Fix typo

Description about how to ensure that new boot entries continue compliant was incorrect due to copy-pasta mistake.

These rules check and ensure configuration of BLS boot options used by zIPL.

Just like rule selection, allows rule refinements to be unselected, or "undone".

Remove the zIPl rule refinementes from STIG profile

I just copied the resolved profile to profile_stability directory.

shared/templates/template_BASH_zipl_bls_entries_option

vojtapolasek

Thank you for thi new template and rules. I will try to run tests. See comments.

shared/templates/template_ANSIBLE_zipl_bls_entries_option

shared/templates/template_BASH_zipl_bls_entries_option

shared/templates/template_OVAL_zipl_bls_entries_option

The template shouldn't have any hardcoded values.

matejak · 2020-07-10T13:42:08Z

linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8


I wouldn't be so strict with the platform - it is a textfilecontent test, so actually any platform will do. The remediation requires grubby, but that can be installed into Fedora as well.

I enabled it for Fedora as well, and removed # remediation = none.

vojtapolasek · 2020-07-10T13:45:22Z

Thank you for tests. However, please count on the case that /etc/kernel/cmdline does not exist before test is run.

Let's not trust that /boot/loader/entries/ only contains *.conf files. Count the number of conf files and how many set the propper options.

linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh

Append "audit=1" space from last option.

These test scenarios can be run on any OS that supports BLS and provides grubby. But it will evaluate to not applicable if the OS doesn't use zIPL (i.e.: has s390utils-base installed).

Co-authored-by: vojtapolasek <krecoun@gmail.com>

yuumasato · 2020-07-10T14:38:39Z

@vojtapolasek @matejak Thank you for the review, gentleman. Hopefully all the issues have been addressed.

vojtapolasek · 2020-07-10T14:53:29Z

One last thing. Currently, when running tests, if /etc/kernel/cmdline does not exist, the grep gives an error because it can't grep... I don't know if it needs some fixing. Maybe I discovered it cause I was running tests manually.

yuumasato · 2020-07-10T15:01:07Z

One last thing. Currently, when running tests, if /etc/kernel/cmdline does not exist, the grep gives an error because it can't grep... I don't know if it needs some fixing. Maybe I discovered it cause I was running tests manually.

grep can suppress error messages with -s.. I could add that.

/etc/kernel/cmdline is not always present. Lest suppress any error message about absent file in the test scenarios.

mildas · 2020-07-10T15:16:26Z

Changes identified:
Profile ospp on rhel8:
Rule zipl_audit_argument, zipl_audit_backlog_limit_argument, zipl_page_poison_argument, zipl_vsyscall_argument, zipl_pti_argument, zipl_slub_debug_argument added to ospp profile.
Profile cui on rhel8:
CUI profile extends changed OSPP profile.
Profile stig on rhel8:
STIG profile extends changed OSPP profile.
Rule !zipl_vsyscall_argument, !zipl_slub_debug_argument, !zipl_page_poison_argument, !zipl_audit_backlog_limit_argument, !zipl_audit_argument, !zipl_pti_argument added to stig profile.
Profile rhelh-stig on rhel8:
RHELH-STIG profile extends changed STIG profile.
Profile rhelh-vpp on rhel8:
RHELH-VPP profile extends changed OSPP profile.
Profile ospp-mls on rhel8:
OSPP-MLS profile extends changed OSPP profile.
Profile ospp on tests:
Rule zipl_audit_argument, zipl_audit_backlog_limit_argument, zipl_page_poison_argument, zipl_vsyscall_argument, zipl_pti_argument, zipl_slub_debug_argument added to ospp profile.
Others:
Python abstract syntax tree change found in build-scripts/compile_profiles.py.
Python abstract syntax tree change found in ssg/templates.py.

Recommended tests to execute:
build_product tests
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-tests-ds.xml ospp
build_product rhel8
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml stig
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml cui
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml ospp-mls
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml rhelh-stig
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml rhelh-vpp
tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel8-ds.xml ospp
(cd build && cmake ../ && ctest -j4)

vojtapolasek · 2020-07-13T13:25:14Z

Thank you very much for this template. Merging.

openshift-ci-robot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 3, 2020

yuumasato force-pushed the zipl_bootloader_template branch from 924ae7b to ad5771b Compare July 9, 2020 09:54

yuumasato added 7 commits July 9, 2020 14:09

Kickstart zipl_bls_entries_option template

f37e40e

Create initial version of zIPL specific BLS entries template by copying bls_entries_option template.

zipl_bls_entries_option: check opts after install

f54c3c9

Extend zipl_bls_entries_option template to check that the kernel option is also configure in /etc/kernel/cmdline. The presence of the argument in /etc/kernel/cmdline ensures that newly installed kernels will be configure if the option.

zipl_bls_entries_option: Add Ansible and Bash

5b66eff

Enable zIPL in argument rules

fd2d807

zipl_audit_backlog_limit_argument: Fix OCIL typo

08db1a1

Fix typo

zipl_slub_debug_argument: Fix description

7795063

Description about how to ensure that new boot entries continue compliant was incorrect due to copy-pasta mistake.

Add CCEs to zIPL argument rules

6a3f2f6

yuumasato force-pushed the zipl_bootloader_template branch from ad5771b to 6a3f2f6 Compare July 9, 2020 12:28

yuumasato added 3 commits July 9, 2020 14:43

Select zipl BLS option rules in OSPP Profile

a7c3313

These rules check and ensure configuration of BLS boot options used by zIPL.

Extend Profile resolution to undo rule refinements

be070d5

Just like rule selection, allows rule refinements to be unselected, or "undone".

Undo rule refinements done to zIPL rules

2ea270b

Remove the zIPl rule refinementes from STIG profile

yuumasato force-pushed the zipl_bootloader_template branch from c192ecb to 2ea270b Compare July 9, 2020 20:34

yuumasato marked this pull request as ready for review July 9, 2020 20:35

openshift-ci-robot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 9, 2020

yuumasato requested review from matejak and vojtapolasek July 9, 2020 21:02

Update stable test for OSPP Profile

90d62ba

I just copied the resolved profile to profile_stability directory.

vojtapolasek self-assigned this Jul 10, 2020

matejak self-assigned this Jul 10, 2020

zipl_bls_entries_option: Add test scenarios

b5d5b0f

matejak reviewed Jul 10, 2020

View reviewed changes

shared/templates/template_BASH_zipl_bls_entries_option Outdated Show resolved Hide resolved

vojtapolasek requested changes Jul 10, 2020

View reviewed changes

zipl_bls_entries_option: Remove hardcoded values

3b52ab4

The template shouldn't have any hardcoded values.

matejak reviewed Jul 10, 2020

View reviewed changes

Improve conditional check for the grubby command

68bff71

Let's not trust that /boot/loader/entries/ only contains *.conf files. Count the number of conf files and how many set the propper options.

vojtapolasek reviewed Jul 10, 2020

View reviewed changes

linux_os/guide/system/bootloader-zipl/zipl_audit_argument/tests/correct_option.pass.sh Outdated Show resolved Hide resolved

yuumasato and others added 3 commits July 10, 2020 16:17

zipl_bls_entries_option: Fix sed in test scenario

79c60bb

Append "audit=1" space from last option.

Extend scenarios platform and allow remediation

d513177

These test scenarios can be run on any OS that supports BLS and provides grubby. But it will evaluate to not applicable if the OS doesn't use zIPL (i.e.: has s390utils-base installed).

Update comment in OVAL zipl_bls_entries_option

2e84172

Co-authored-by: vojtapolasek <krecoun@gmail.com>

zipl_bls_entries_option: Supress grep error messages

9bd0afb

/etc/kernel/cmdline is not always present. Lest suppress any error message about absent file in the test scenarios.

vojtapolasek approved these changes Jul 13, 2020

View reviewed changes

vojtapolasek merged commit 22cddf4 into ComplianceAsCode:master Jul 13, 2020

yuumasato deleted the zipl_bootloader_template branch July 13, 2020 13:38

yuumasato added this to the 0.1.52 milestone Jul 13, 2020

yuumasato mentioned this pull request Sep 30, 2020

Extend bls_entries_options to check for runtime and $kernelopts #5887

Closed

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add template for zIPL boot entry option #5908

Add template for zIPL boot entry option #5908

yuumasato commented Jul 3, 2020 •

edited

Loading

openshift-ci-robot commented Jul 3, 2020

pep8speaks commented Jul 3, 2020 •

edited

Loading

vojtapolasek left a comment

matejak Jul 10, 2020

yuumasato Jul 10, 2020

vojtapolasek commented Jul 10, 2020

yuumasato commented Jul 10, 2020

vojtapolasek commented Jul 10, 2020

yuumasato commented Jul 10, 2020

mildas commented Jul 10, 2020

vojtapolasek commented Jul 13, 2020

		@@ -0,0 +1,16 @@
		#!/bin/bash
		# platform = Red Hat Enterprise Linux 8

Add template for zIPL boot entry option #5908

Add template for zIPL boot entry option #5908

Conversation

yuumasato commented Jul 3, 2020 • edited Loading

Description:

Rationale:

openshift-ci-robot commented Jul 3, 2020

pep8speaks commented Jul 3, 2020 • edited Loading

Comment last updated at 2020-07-10 15:16:05 UTC

vojtapolasek left a comment

Choose a reason for hiding this comment

matejak Jul 10, 2020

Choose a reason for hiding this comment

yuumasato Jul 10, 2020

Choose a reason for hiding this comment

vojtapolasek commented Jul 10, 2020

yuumasato commented Jul 10, 2020

vojtapolasek commented Jul 10, 2020

yuumasato commented Jul 10, 2020

mildas commented Jul 10, 2020

vojtapolasek commented Jul 13, 2020

yuumasato commented Jul 3, 2020 •

edited

Loading

pep8speaks commented Jul 3, 2020 •

edited

Loading