SLES-15-030730 'Record Unsuccessul Delete Attempts to Files - renameat2'

[yarunachalam]

Description:

• SLES-15-030730 'Record Unsuccessul Delete Attempts to Files - renameat2'

Rationale:

'Record Unsuccessul Delete Attempts to Files - renameat2'

[openscap-ci]

Can one of the admins verify this patch?

[openscap-ci]

Can one of the admins verify this patch?

[openshift-ci-robot]

Hi @yarunachalam. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[vojtapolasek]

Thank you for the new rule, please see review comments.

[vojtapolasek]

Note that this template has hardcoded a different audit rule key. It adds

-F key=access

at the end istead of

-F key=unsuccessful-delete

which is specified in your rule description.
It depends if it is a problem for you as keys can be arbitrary values, they are more for humans than for computers.

[brett060102]

@vojtapolasek The key difference is not an issue. Our rule notes that the key maybe different and looking at other rules that use this template I saw that in most cases the keys in the description were not access.

[vojtapolasek]

Also you use CCE which is already used. It currently is in:

• linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml
• linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat2/rule.yml

[yarunachalam]

thanks, cce id fixed. still working on test.

[brett060102]

@vojtapolasek I think that @yarunachalam has covered what needed to be corrected.

[vojtapolasek]

Thank you, now it looks good.

[vojtapolasek]

@openscap-ci test this please

[ggbecker]

@openscap-ci add to whitelist

[openscap-ci]

Changes identified:
Profiles:
 stig on sle15

Show details

Profile stig on sle15:
 Rule audit_rules_unsuccessful_file_modification_renameat2 added to stig profile.

Recommended tests to execute:
 build_product sle15
 tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-sle15-ds.xml stig