fix aide_build_database rule and remediation to work with sles 12 and 15 #8287
Conversation
There were a number of issues: oval/shared.xml assumed aide.conf had: @@define DBDIR /path database_out=file:@@{DBDIR}/filename database=file:@@{DBDIR}/filename SLE 12 and 15 does not use: :@@{DBDIR} in remediation bash was not enabled for sle and sle uses /var/lib/aide/aide.db.new and /var/lib/aide/aide.db not /var/lib/aide/aide.db.new.gz and /var/lib/aide/aide.db.gz and path to aide is /usr/bin/aide as oppsed to /usr/sbin/aide --init in the rule.yml Need to make sle aware for file name and path differences.
|
Hi @brett060102. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Start a new ephemeral environment with changes proposed in this pull request: |
|
/ok-to-test |
openshift-ci
bot
added
ok-to-test
Mab879
added
SLES
...ide/system/software/integrity/software-integrity/aide/aide_build_database/ansible/shared.yml
Outdated
Show resolved
Hide resolved
…de/aide_build_database/ansible/shared.yml Co-authored-by: Matthew Burket <m@tthewburket.com>
|
Accepted suggestion. Thought about that initially, but don't like changing behavior for releases that I am not working on. |
|
@Mab879 requested change has been made. |
aide_build_database check and remediation which is in the cis profile for sle12 and sle15 does not work for SLE 12/15.
Description:
There were a number of issues:
oval/shared.xml
assumeed aide.conf had:
@@define DBDIR /path
database_out=file:@@{DBDIR}/filename
database=file:@@{DBDIR}/filename
SLE 12 and 15 does not use: :@@{DBDIR} it just has:
database_out=file:/pathfile
database=file:/path/file
in remediation
1: bash was not enabled for sle
2: sle uses /var/lib/aide/aide.db.new and /var/lib/aide/aide.db not /var/lib/aide/aide.db.new.gz and /var/lib/aide/aide.db.gz
3: path to aide is /usr/bin/aide as opposed to /usr/sbin/aide --init
in the rule.yml:
Need to make sle aware for file name and path differences.
Since .gx nv not gz also applied to ubuntu needed to re-code some
{{% if not in product %}} to
{{% if 'ubuntu' in product or 'sle' in product %}}
Rationale: