Skip to content

Change OCP4 (RHCOS) audit=1 kernel option rule to check only the latest entry #6088

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jan-cerny merged 1 commit into from
Sep 21, 2020
Merged

Change OCP4 (RHCOS) audit=1 kernel option rule to check only the latest entry #6088

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
0 ...ng/bls_audit_option/kubernetes/shared.yml → ...coreos_audit_option/kubernetes/shared.yml
View file
Open in desktop
File renamed without changes.
2 changes: 1 addition & 1 deletion ...system/auditing/bls_audit_option/rule.yml → ...tem/auditing/coreos_audit_option/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ ocil: |-
<br />

template:
name: bls_entries_option
name: coreos_kernel_option
vars:
arg_name: audit
arg_value: '1'
2 changes: 1 addition & 1 deletion rhcos4/profiles/moderate.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -548,8 +548,8 @@ selections:

# AU-3
- package_audit_installed
- bls_audit_option
- grub2_audit_backlog_limit_argument
- coreos_audit_option
#- grub2_slub_debug_argument
- grub2_page_poison_argument
- grub2_vsyscall_argument
Expand Down
71 changes: 71 additions & 0 deletions shared/templates/template_OVAL_coreos_kernel_option
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
<def-group>
<definition class="compliance" id="{{{ _RULE_ID }}}" version="2">
<metadata>
<title>Ensure that the most recent (default) CoreOS boot loader entry is configured to run Linux operating system with argument {{{ ARG_NAME_VALUE }}}</title>
{{{- oval_affected(products) }}}
<description>Ensure {{{ ARG_NAME_VALUE }}} option is configured in the 'options' line in /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if the second version does not exists).</description>
</metadata>
<criteria operator="OR">
<criteria operator="AND">
<criterion test_ref="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_options"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the 'options' line in /boot/loader/entries/ostree-2-*.conf (if it does exists)" />
</criteria>
<criteria operator="AND">
<criterion test_ref="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_options"
comment="Check if {{{ ARG_NAME_VALUE }}} is present in the 'options' line in /boot/loader/entries/ostree-1-*.conf" />
<criterion test_ref="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_does_not_exists"
comment="Check if /boot/loader/entries/ostree-2-*.conf is not present" />
</criteria>
Comment on lines +13 to +18
Copy link
Member

@yuumasato yuumasato Sep 17, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This whole criteria is here to check the case when there wasn't a kernel update yet, thus entry 2 doesn't exist yet, right?
I would add a comment to the criteria, I was a bit confused a first, why ensure that entry 2 doesn't exist.

Copy link
Member Author

@evgenyz evgenyz Sep 18, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I continued working on these rules in #6100, let's move there.

</criteria>
</definition>

<ind:textfilecontent54_test id="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_options"
comment="check for kernel option {{{ ARG_NAME_VALUE }}} in /boot/loader/entries/ostree-2-*.conf"
check="all" check_existence="all_exist" version="1">
<ind:object object_ref="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_options" />
<ind:state state_ref="state_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_option" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_options"
version="1">
<ind:filepath operation="pattern match">^/boot/loader/entries/ostree-2-*\.conf$</ind:filepath>
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_state id="state_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_option"
version="1">
<ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?{{{ ESCAPED_ARG_NAME_VALUE }}}(?:\s.*)?$</ind:subexpression>
</ind:textfilecontent54_state>

<ind:textfilecontent54_test id="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_options"
comment="check for kernel option {{{ ARG_NAME_VALUE }}} in /boot/loader/entries/ostree-1-*.conf"
check="all" check_existence="all_exist" version="1">
<ind:object object_ref="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_options" />
<ind:state state_ref="state_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_option" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_options"
version="1">
<ind:filepath operation="pattern match">^/boot/loader/entries/ostree-1-*\.conf$</ind:filepath>
<ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>

<ind:textfilecontent54_state id="state_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_1_option"
version="1">
<ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?{{{ ESCAPED_ARG_NAME_VALUE }}}(?:\s.*)?$</ind:subexpression>
</ind:textfilecontent54_state>

<unix:file_test id="test_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_does_not_exists" check="all" check_existence="none_exist"
comment="Check if /boot/loader/entries/ostree-2-*.conf is not present"
version="1">
<unix:object object_ref="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_does_not_exists" />
</unix:file_test>

<unix:file_object id="object_coreos_{{{ SANITIZED_ARG_NAME }}}_entry_2_does_not_exists"
version="1">
<unix:filepath operation="pattern match">^/boot/loader/entries/ostree-2-*\.conf</unix:filepath>
</unix:file_object>

</def-group>
Copy link
Contributor

@JAORMX JAORMX Sep 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For completeness; what about checking /proc/cmdline as well? That would ensure that the current configuration is compliant.

Copy link
Member Author

@evgenyz evgenyz Sep 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still not sure if it should be a part of this check. Other bootloader-related rules don't have the runtime counterpart (because runtime check might be different even when bootloaders are the same). While this is not really applicable to this particular hackish rule, it would definitely be a problem for generic BLS-compatible check bls_entries_option in the future.

Copy link
Member Author

@evgenyz evgenyz Sep 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest creating a proc_cmdline_option template and a new rule based on this. It might be more preferable to have composite rules that could combine multiple templates into a single runtime+configuration check, but there is no way to make such a thing ATM, AFAIK.

Copy link
Contributor

@JAORMX JAORMX Sep 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right; however, this is already a coreos specificy check. So maybe in this case it would make sense to add the proc/cmdline check here.

Copy link
Collaborator

@jhrozek jhrozek Sep 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

btw contrary to applying remediations on RHEL, applying a MachineConfig remediation through MachineConfigOperator always reboots the nodes, so when you apply this remediation, the machines in the cluster would automatically reboot into the approved config and at that point the /proc/cmdline check should pass as well. There is no extra disruption for the admin.

Copy link
Member Author

@evgenyz evgenyz Sep 18, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm working on it in #6100.

5 changes: 5 additions & 0 deletions ssg/templates.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,6 +380,11 @@ def zipl_bls_entries_option(data, lang):
return bls_entries_option(data, lang)


@template(["oval"])
def coreos_kernel_option(data, lang):
return bls_entries_option(data, lang)


class Builder(object):
"""
Class for building all templated content for a given product.
Expand Down