Import SRG content for RHEL9 #9574

Mab879 · 2022-09-27T16:50:11Z

Description:

Import SRG content for RHEL9 STIG.

Rationale:

Sync content to the repo.

github-actions · 2022-09-27T16:51:19Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

linux_os/guide/services/base/service_kdump_disabled/policy/stig/shared.yml

jan-cerny · 2022-09-30T08:39:51Z

linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/policy/stig/shared.yml

+vuldiscussion: |-
+    Service configuration files enable or disable features of their respective services that if configured incorrectly
+    can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
+    correct group to prevent unauthorized changes.


For some reason the VulDiscussion column is empty in the generated HTML. Can you investigate this problem?

This should be fixed now.

jan-cerny · 2022-09-30T08:47:15Z

linux_os/guide/services/base/service_kdump_disabled/policy/stig/shared.yml

@@ -0,0 +1,45 @@
+srg_requirement: |-


Why does the content of the policy file appear in the resolved rule yaml when I build a different product than RHEL 9, for example RHEL 8, for example I can see this text in policy_specific_content key build/rhel8/rules/service_kdump_disabled.yml. Is that expected behavior or not?

It is. Since the content is in the shared.yml file all products will get the content. Products can override this by adding their own files. For example, rhel8.yml. Currently, family files (e.g., rhel.yml) are not supported.

jan-cerny · 2022-10-03T14:40:18Z

Hi @Mab879 , we should make sure that the imported data are the same data as in the DISA spreadsheet. We need to do it in an automated way because it's a large amount of data that isn't possible to be reviewed. So I think we need to write some simple test script. We can leverage our script that can create the SRG export spreadsheet. We can then compare the spreadsheet created from the project data with the original spreadsheet. For example, we can convert both of them to CSVs and run some sore of diff on these CSVs. What do you think? Is it feasible to write a test like that?

Mab879 · 2022-10-03T20:26:34Z

Hi @Mab879 , we should make sure that the imported data are the same data as in the DISA spreadsheet. We need to do it in an automated way because it's a large amount of data that isn't possible to be reviewed. So I think we need to write some simple test script. We can leverage our script that can create the SRG export spreadsheet. We can then compare the spreadsheet created from the project data with the original spreadsheet. For example, we can convert both of them to CSVs and run some sore of diff on these CSVs. What do you think? Is it feasible to write a test like that?

It is! See the new utils/srg_diff.py script.

Mab879 · 2022-10-03T23:02:48Z

There is still some more tweaking to be done on the script. I will get that pushed tomorrow.

In some cases env_yaml can be `None`, don't assume it always be defined. This commit adds some guarding to prevent errors around working with `None`. Also adds a test case for this as well.

This occurs when loading from rendered YAML files.

This also cleaned up import_srg_spreadsheet script as well.

Mab879 · 2022-10-04T21:33:44Z

This is ready for review, the last Code Climate issue is existing code, and I don't feel the need to change it.

Mab879 · 2022-10-05T14:53:26Z

Attached is an example of the output, diff.html.txt

jan-cerny

The utils/srg_diff.py tool is amazing and very helpful. I generated the HTML diff. Are all the differences that are shown in my HTML diff expected? Some of them seem that there was some change meanwhile. See comments below.

jan-cerny · 2022-10-05T15:19:44Z

...physical/screen_locking/console_screen_locking/package_tmux_installed/policy/stig/shared.yml

+    The "tmux" package allows for a session lock to be implemented and configured.
+
+checktext: |-
+    Verify that {{{ full_name }}} has the tmux package installed with the following command:$ sudo dnf list --installed tmuxtmux.x86_64  3.2a-4.el9If the tmux package is not installed, this is a finding.


Missing newlines

jan-cerny · 2022-10-05T15:20:13Z

...nts-physical/screen_locking/smart_card_login/package_opensc_installed/policy/stig/shared.yml

+    The DoD has mandated the use of the Common Access Card (CAC) to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems.
+
+checktext: |-
+    Verify that {{{ full_name }}} has the opensc package installed with the following command:$ sudo dnf list --installed openscopensc.x86_64  0.22.0-2.el9If the opensc package is not installed, this is a finding.


missing newlines

jan-cerny · 2022-10-05T15:21:41Z

...trictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/policy/stig/shared.yml

+    Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory:
+
+    kernel.randomize_va_space = 2
+


Why is the The system configuration files need to be reloaded for the changes to take effect. missing here?

jan-cerny · 2022-10-05T15:22:46Z

linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/policy/stig/shared.yml

+
+    fs.protected_symlinks = 1
+
+    Load settings from all system configuration files with the following command:


Why is the The system configuration files need to be reloaded for the changes to take effect. removed from hrer?

It appears to be a style change from the external reviewer.

jan-cerny · 2022-10-05T15:23:21Z

linux_os/guide/system/logging/package_rsyslog-gnutls_installed/policy/stig/shared.yml

+    for the rsyslog daemon, which enables secure remote logging.
+
+checktext: |-
+    Verify that {{{ full_name }}} has the rsyslog-gnutls package installed with the following command:$ sudo dnf list --installed rsyslog-gnutlsrsyslog-gnutls.x86_64  8.2102.0-101.el9_0.1If the rsyslog-gnutls package is not installed, this is a finding.


missing newlines inside

jan-cerny · 2022-10-05T15:24:10Z

docs/manual/developer/05_tools_and_utilities.md

+
+Example:
+
+```basj


Mab879 · 2022-10-05T17:28:47Z

The utils/srg_diff.py tool is amazing and very helpful. I generated the HTML diff. Are all the differences that are shown in my HTML diff expected? Some of them seem that there was some change meanwhile. See comments below.

There are going some deltas, the plan is to fix those up in a follow-up PR.

codeclimate · 2022-10-05T17:56:33Z

Code Climate has analyzed commit b1d853f and detected 3 issues on this pull request.

Here's the issue category breakdown:

Category	Count
Complexity	2
Style	1

The test coverage on the diff in this pull request is 83.3% (50% is the threshold).

This pull request will bring the total coverage in the repository to 40.9% (0.1% change).

View more on Code Climate.

jan-cerny · 2022-10-06T11:21:26Z

Hi @Mab879, I have discussed this with @vojtapolasek and I have some questions.

Can you explain what is the meaning of the "Missing in DISA" and "Missing in CaC sections in the HTML report? I think that "Missing in DISA" is a list of rues in our STIG profile that don't have their counterpart in the DISA spreadsheet. But "Missing in CaC" contains a list of rules that exist in our project, so I'm confused. What is actually listed there? And how should I react as a reviewer when I see these lists are non-empty?

There are going some deltas, the plan is to fix those up in a follow-up PR.

What would be the reason of fixing the differences in follow up PRs? Is it because the fixes will be complex? In general, I would prefer having the delta as minimal as possible before merging and fix everything in this PR.

Also, we noticed that there are basically 3 categories of diffs in the HTML diff:

whitespace differences
typos
serious diffs like in partition_for_var_tmp

What would be the action plan for addressing diffs of each of these 3 categories?

Side note: It seems that the HTML output isn't accessible. Do you know whether it's possible to generate a text diff instead? Or configure the library to generate some different HTML tags? This is not a blocker issue, but if the script would be used more frequently, it would be nice to make it accessible later.

vojtapolasek · 2022-10-06T11:23:21Z

Accessibility note: would it be possible to use and ~~tags instead / together with colors to mark diffs? In this way, it would make review much easier for screenreader users.~~

Mab879 · 2022-10-06T12:50:06Z

Hi @Mab879, I have discussed this with @vojtapolasek and I have some questions.

Can you explain what is the meaning of the "Missing in DISA" and "Missing in CaC sections in the HTML report? I think that "Missing in DISA" is a list of rues in our STIG profile that don't have their counterpart in the DISA spreadsheet. But "Missing in CaC" contains a list of rules that exist in our project, so I'm confused. What is actually listed there? And how should I react as a reviewer when I see these lists are non-empty?

Rules that are in the spreadsheet and not in the control file will be Missing in CaC.
Rules that are in the control file and not in the spreadsheet will be ender Missing in DISA.
For this review, that is expected, as dropped rules from the STIG are still in the spreadsheet.
The plan is to get this better synced in an upcoming PR.

There are going some deltas, the plan is to fix those up in a follow-up PR.

What would be the reason of fixing the differences in follow-up PRs? Is it because the fixes will be complex? In general, I would prefer having the delta as minimal as possible before merging and fix everything in this PR.

So we have another round of feedback that is happening right now.
Spending time getting this perfect doesn't seem like the best of use of time.

Also, we noticed that there are basically 3 categories of diffs in the HTML diff:
1. whitespace differences

2. typos

3. serious diffs like in partition_for_var_tmp
What would be the action plan for addressing diffs of each of these 3 categories?

The whitespace differences are in the spreadsheet there isn't much we can do about it.
typos in which direction? Remember that the left is in the spreadsheet from DISA. If the right is correct, it should be ignored.
Some serious changes are fixing issues from the spreadsheet, again if the right is correct, it should be ignored.

Side note: It seems that the HTML output isn't accessible. Do you know whether it's possible to generate a text diff instead? Or configure the library to generate some different HTML tags? This is not a blocker issue, but if the script would be used more frequently, it would be nice to make it accessible later.

Accessibility is not going to be easy. I will have to change what library I use to create the diffs. Currently, I'm just using the Python standard library.

jan-cerny

We have discussed this with @ggbecker .

The main thing that I was missing was that in future there will be another import of the DISA spreadsheet data and after that import we can easily git diff to analyse differences between data that we have in our repo and new version of the spreadsheet. That will greatly help us with our STIG alignement process.

The diff created by the srg_diff.py serves to verify that the data is imported correctly. In theory, there should be no diff between the imported data and exported data. However, the spreadsheet changes and I don't have the exact version that was used for the import available at hand. Therefore, there is some diff.

However, this diff is small. As we will do another import of the data in future we will slowly converge to no diff produced by srg_diff.py.

The expected next import(s) of data also means why we don't insist on making the diff empty - insinsiting on it would make sense only if we are given final version of the spreadsheet that will never change.

Mab879 added this to the 0.1.65 milestone Sep 27, 2022

jan-cerny reviewed Sep 30, 2022

View reviewed changes

Mab879 requested a review from jan-cerny September 30, 2022 14:26

Mab879 added 6 commits October 4, 2022 15:30

Import STIG content for RHEL9

2e2af47

Update Rule.read_policy_specific_content to handle None env_yaml

5b5309d

In some cases env_yaml can be `None`, don't assume it always be defined. This commit adds some guarding to prevent errors around working with `None`. Also adds a test case for this as well.

Only load policy specific content if the rule doesn't already have it

8b20249

This occurs when loading from rendered YAML files.

Fix vuldiscussion in SRG export

8757f97

Add SRG Diff script

28476e7

This also cleaned up import_srg_spreadsheet script as well.

Add docs for utils/srg_diff.py

d80ac04

Mab879 force-pushed the psc_import branch 5 times, most recently from 10c7152 to a8d31ce Compare October 4, 2022 21:07

Mab879 force-pushed the psc_import branch from 591dbaa to 8d777da Compare October 5, 2022 03:58

Mab879 added 5 commits October 4, 2022 23:26

Add some more formatting to 05_tools_and_utilities.md

fc93eaa

Fix handling of < and > in the import_srg script

ed7c8f1

Reduce the pickyness of radon for codeclimate

5a1c005

Fix Code Climate issues

8ccdb0c

Fix up mdl findings docs/manual/developer/05_tools_and_utilities.md

d106fa0

Mab879 force-pushed the psc_import branch from 8d777da to d106fa0 Compare October 5, 2022 04:26

Mab879 added 4 commits October 5, 2022 07:40

Fix more Code Climate issues

b164193

Fix SRG Diff html to be smaller

963563b

Use rule id in SRG Diff for missing rules

97b2396

Minor bug fix for srg diff

c222df9

Add rule id to titles for srg_diff

8d0bd2d

Mab879 added the Infrastructure Our content build system label Oct 5, 2022

jan-cerny requested changes Oct 5, 2022

View reviewed changes

jan-cerny self-assigned this Oct 5, 2022

Fix issues found in code review for ComplianceAsCode#9574

b1d853f

matejak mentioned this pull request Oct 7, 2022

Summarize a rule and its contents in an HTML #9650

Merged

Mab879 requested a review from jan-cerny October 10, 2022 12:43

jan-cerny approved these changes Oct 11, 2022

View reviewed changes

jan-cerny merged commit 638fee7 into ComplianceAsCode:master Oct 11, 2022

jan-cerny added the STIG STIG Benchmark related. label Oct 11, 2022

Mab879 deleted the psc_import branch October 14, 2022 15:25

matejak mentioned this pull request Nov 2, 2022

Update aide-related rules to align with RHEL9 STIG #9498

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Import SRG content for RHEL9 #9574

Import SRG content for RHEL9 #9574

Mab879 commented Sep 27, 2022 •

edited

Loading

github-actions bot commented Sep 27, 2022

jan-cerny Sep 30, 2022

Mab879 Sep 30, 2022

jan-cerny Sep 30, 2022

Mab879 Sep 30, 2022

jan-cerny commented Oct 3, 2022

Mab879 commented Oct 3, 2022

Mab879 commented Oct 3, 2022

Mab879 commented Oct 4, 2022

Mab879 commented Oct 5, 2022

jan-cerny left a comment

jan-cerny Oct 5, 2022

jan-cerny Oct 5, 2022

jan-cerny Oct 5, 2022

jan-cerny Oct 5, 2022

Mab879 Oct 5, 2022

jan-cerny Oct 5, 2022

jan-cerny Oct 5, 2022

Mab879 commented Oct 5, 2022

codeclimate bot commented Oct 5, 2022

jan-cerny commented Oct 6, 2022

vojtapolasek commented Oct 6, 2022

Mab879 commented Oct 6, 2022

jan-cerny left a comment

		Add or edit the following line in a system configuration file in the "/etc/sysctl.d/" directory:

		kernel.randomize_va_space = 2


		fs.protected_symlinks = 1

		Load settings from all system configuration files with the following command:


		Example:

		```basj

Import SRG content for RHEL9 #9574

Import SRG content for RHEL9 #9574

Conversation

Mab879 commented Sep 27, 2022 • edited Loading

Description:

Rationale:

github-actions bot commented Sep 27, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jan-cerny commented Oct 3, 2022

Mab879 commented Oct 3, 2022

Mab879 commented Oct 3, 2022

Mab879 commented Oct 4, 2022

Mab879 commented Oct 5, 2022

jan-cerny left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mab879 commented Oct 5, 2022

codeclimate bot commented Oct 5, 2022

jan-cerny commented Oct 6, 2022

vojtapolasek commented Oct 6, 2022

Mab879 commented Oct 6, 2022

jan-cerny left a comment

Choose a reason for hiding this comment

Mab879 commented Sep 27, 2022 •

edited

Loading