Create new rules for ANSSI R39

[jan-cerny]

Description:

ANSSI R39: Temporary directories dedicated to each account
Each user or service account must have its own temporary directory and dispose of it exclusively.

We can satisfy this requirement by setting up the temporary directories as polyinstantiated, according to https://access.redhat.com/blogs/766093/posts/3169121.

This PR adds new rules that check for the configuration changes.

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openscap-ci]

Changes identified:
Rules:
 enable_pam_namespace
 accounts_polyinstantiated_tmp
 accounts_polyinstantiated_var_tmp

Show details

Rule enable_pam_namespace:
 OVAL check is newly added.
 Ansible remediation newly added.
 The rule doesn't occur in any profile nor product.
 Bash remediation is newly added.
Rule accounts_polyinstantiated_tmp:
 OVAL check is newly added.
 Ansible remediation newly added.
 The rule doesn't occur in any profile nor product.
 Bash remediation is newly added.
Rule accounts_polyinstantiated_var_tmp:
 OVAL check is newly added.
 Ansible remediation newly added.
 The rule doesn't occur in any profile nor product.
 Bash remediation is newly added.

[yuumasato]

The rules look good and the test scenarios pass, but I think you forgot to enable the SELinux boolean polyinstantiation_enabled=1.
Without it the polyinstantiation didn't work, and no other user than root was able to login.

Nitick: please ensure the files have a newline at the end.

[DraugurHundur]

I'm confused why create the inst directory in /var/tmp under /var/tmp while you create the inst directory for /tmp under / (which may be a different partition) ?

[yuumasato]

That's a good point. I guess it would be safer (in terms of partition capacity) to have the instance in /tmp/tmp-inst?

[DraugurHundur]

I'm guessing because /tmp is wiped on reboot (whereas /var/tmp is not) this can cause an issue as the inst directory would have to be recreated on restart.

[openshift-merge-robot]

@jan-cerny: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-ocp4-cis	c77942e	link	/test e2e-aws-ocp4-cis

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[yuumasato]

Should the check and remediation for sebool polyinstantiation_enabled be present in multiple rules?
It makes more sense embed it on enable_pam_namespace.
It could also become a rule of its own.

[jan-cerny]

Yes, but we already have a rule for this selinux boolean, it's a templated rule, its ID is sebool_polyinstantiation_enabled https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/selinux/selinux-booleans/sebool_polyinstantiation_enabled/rule.yml. But we're adding this rule to the profile.

I like the idea about embedding the enable_pam_namespace, but I would even go firther and merge the check from enable_pam_namespace into accounts_polyinstantiated_tmp and accounts_polyinstantiated_var_tmp.

What is your advise?

[yuumasato]

Oh, I missed that a rule for sebool polyinstantiaion_enabled already existed, and it uses an XCCDF Value for the value.

In this case, just selecting it in the profile with the appropriate value should do, right?

[yuumasato]

Sorry for the confusion and extra work.

[jan-cerny]

It should be enough when the profile selects all 4 rules.

[yuumasato]

I'm confused why create the inst directory in /var/tmp under /var/tmp while you create the inst directory for /tmp under / (which may be a different partition) ?

@jan-cerny What do you think of the suggestion to create the instance dir in /tmp/tmp-inst? So that data intended for polyinstantiated /tmp, is actually put in the same partition as /tmp would.

[openshift-ci]

@jan-cerny: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-ocp4-cis-node	151c6bd	link	/test e2e-aws-ocp4-cis-node

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[yuumasato]

LGTM, thank you, @jan-cerny :)