New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add CIS Agent for automated CIS compliance checking #2881

Merged

stmcginnis merged 27 commits into bottlerocket-os:develop from stmcginnis:cis-agent

Jun 21, 2023

Contributor

stmcginnis commented Mar 10, 2023 •

edited

Loading

Issue number:

Closes #2731

Description of changes:

This adds tooling to be able to run Bottlerocket CIS compliance checks.

This is made up of three parts:

Add command line that can check the various system settings and report the results
Wire up apiserver to be able to call this CLI and get its results
Wire up apiclient as the user interface for someone to get compliance status from a running system

Testing done:

Built and deployed image, verified level 1 and level 2 checks were performed correctly with the bloodhound CLI.

Removed from this PR, but just for the sake of showing test coverage, also did:

Tested apiserver endpoint by using apiclient raw -m GET -u /cis-report and apiclient raw -m GET -u /cis-report?level=2&format=json.
Test apiclient interface.
- Ran apiclient and verified help output contained information about new subcommand.
- Ran apiclient cisreport and verified default level 1 text report was output.
- Ran apiclient cisreport -l 2 and verified level 2 report generated.
- Ran apiclient cisreport -f json and verified json report generated. Ran through jq to view pretty-print view.
- Ran apiclient cisreport -f invalid and verified error message returned.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

stmcginnis marked this pull request as draft

March 10, 2023 23:47

Contributor Author

stmcginnis commented Mar 10, 2023 •

edited

Loading

This is already quite large, so I've broken each checker into separate commits to try to make it a little easier to review.

We may want to consider merging this one first to get the CLI on the system, then have a separate PR for the API plumbing just to keep things simple. For now, marking as draft until we decide on an approach.

API wiring was relatively small, so just included it here.

stmcginnis requested a review from bcressey

March 10, 2023 23:48

stmcginnis force-pushed the cis-agent branch from 794b585 to e0679d0 Compare

March 15, 2023 15:20

stmcginnis marked this pull request as ready for review

March 15, 2023 15:49

arnaldo2792 reviewed

View reviewed changes

Contributor

arnaldo2792 left a comment

I'm still going through it but here are a few things that caught my eye.

sources/bloodhound/src/main.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/main.rs Show resolved Hide resolved

sources/bloodhound/src/main.rs Show resolved Hide resolved

sources/bloodhound/src/main.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/main.rs Show resolved Hide resolved

sources/bloodhound/src/main.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/main.rs Outdated Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch 2 times, most recently from e98bff1 to 4a0cd1f Compare

March 18, 2023 16:15

Contributor Author

stmcginnis commented Mar 18, 2023

Improved report information by adding a metadata file to be included in the checkers directory. This gives a little more flexibility if we want to have multiple types of compliance checks by just pointing bloodhound at a different checks directory where it can discover metadata about the checks being performed.

stmcginnis force-pushed the cis-agent branch from 4a0cd1f to 9db4926 Compare

March 20, 2023 14:44

jpculp previously requested changes

View reviewed changes

sources/bloodhound/Cargo.toml Outdated Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch from 9db4926 to 1703be0 Compare

March 23, 2023 21:46

jpculp self-requested a review

March 23, 2023 22:00

stmcginnis force-pushed the cis-agent branch from 1703be0 to 4c962b8 Compare

March 28, 2023 22:12

Contributor Author

stmcginnis commented Mar 28, 2023

Force pushed a refactoring of the code to make it better organized.

stmcginnis force-pushed the cis-agent branch 2 times, most recently from 446505c to a0e4f32 Compare

March 28, 2023 22:33

Contributor Author

stmcginnis commented Mar 28, 2023

And a couple more force-pushes to get rid of commits that are already in develop but GitHub somehow thinks they are new. :/

jpculp dismissed their stale review

March 29, 2023 23:15

Chrono feature setting was resolved.

bcressey reviewed

View reviewed changes

sources/api/apiclient/README.md Outdated Show resolved Hide resolved

sources/api/apiclient/src/cisreport.rs Outdated Show resolved Hide resolved

sources/api/apiserver/src/server/mod.rs Outdated Show resolved Hide resolved

sources/bloodhound/README.md Outdated Show resolved Hide resolved

sources/bloodhound/src/args.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/lib.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch from a0e4f32 to f392321 Compare

April 10, 2023 21:23

Contributor Author

stmcginnis commented Apr 10, 2023

Removed apiclient and apiserver commits for now to keep this smaller and to work through some of the suggestions there.

stmcginnis force-pushed the cis-agent branch from f392321 to 3ca8584 Compare

April 11, 2023 19:55

stmcginnis commented

View reviewed changes

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch from 3ca8584 to 50b8314 Compare

May 17, 2023 14:18

arnaldo2792 reviewed

View reviewed changes

sources/bloodhound/src/output.rs Show resolved Hide resolved

packages/os/Cargo.toml Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch from 50b8314 to 6e52c21 Compare

May 18, 2023 16:59

arnaldo2792 reviewed

View reviewed changes

sources/bloodhound/src/results.rs Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/lib.rs Show resolved Hide resolved

stmcginnis force-pushed the cis-agent branch from 6e52c21 to 42efd99 Compare

June 14, 2023 18:34

bcressey reviewed

View reviewed changes

sources/bloodhound/README.md Outdated Show resolved Hide resolved

sources/bloodhound/src/lib.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/lib.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/args.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/main.rs Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

bcressey approved these changes

View reviewed changes

sources/bloodhound/src/bin/bottlerocket-checks/checks.rs Outdated Show resolved Hide resolved

stmcginnis added 24 commits

June 19, 2023 21:38


          bloodhound: Add Bottlerocket 1.1.1.1 check

dd8cf97

This adds the 1.1.1.1 check for the UDF module.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.3.1 check

7498f5b

This adds the 1.3.1 benchmark to ensure dm-verity is in use.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.4.1 check

a97a714

This adds a check for CIS 1.4.1 to verify setuid core dumps are
disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.4.2 check

da61450

This adds a CIS check for 1.4.2 to verify ASLR is enabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.4.3 check

ffb8d7b

This adds CIS check 1.4.3 to verify unprivileged eBPF is disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.4.4 check

5960d4d

This add CIS check 1.4.4 to verify user namespaces are disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.5.1 check

c33e6dc

This adds CIS 1.5.1 to verify selinux enforcement.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 1.5.2 check

0547c6b

This adds CIS 1.5.2 to verify kernel lockdown mode is enabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 2.1.1.1 check

fb17462

This adds CIS 2.1.1.1 to verify ntp is configured.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.1.1 check

eefc119

This adds CIS 3.1.1 to verify send_redirects are disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.1 check

516ad25

Adds CIS 3.2.1 to verify source routed packets are disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.2 check

7afc7c3

This adds CIS 3.2.2 to verify ICMP redirects are not accepted.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.3 check

f916474

This adds CIS 3.2.3 to verify secure ICMP redirects are not accepted.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.4 check

07deba6

This add CIS 3.2.4 to verify suspicious packets are logged.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.5 check

ec7da76

This adds CIS 3.2.5 to verify broadcast ICMP requests are ignored.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.6 check

0c50604

Adds CIS 3.2.6 to verify bogus ICMP responses are ignored.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.2.7 check

8ef2f6f

Adds CIS 3.2.7 to verify TCP SYN cookies are enabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.3.1 check

cf5e86f

This adds CIS 3.3.1 to verify SCTP is disabled.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.4.1.1 check

71e5c2d

This adds CIS 3.4.1.1 to verify default deny firewall policy.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.4.1.2 check

a673517

Adds CIS 3.4.1.2 to verify IPv4 loopback traffic policy.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.4.2.1 check

cb081d6

This adds CIS 3.4.2.1 to verify IPv6 default deny firewall policy.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 3.4.2.2 check

e4229f4

Adds CIS 3.4.2.2 to verify IPv6 koopback traffic is configured.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 4.1.1.1 check

450ab90

Adds CIS 4.1.1.1 to verify journald configuration.

Signed-off-by: Sean McGinnis <[email protected]>


          bloodhound: Add Bottlerocket 4.1.2 check

63efa64

This adds CIS 4.1.2 to verify file permissions on journal files.

Signed-off-by: Sean McGinnis <[email protected]>

stmcginnis force-pushed the cis-agent branch from a0a7620 to 63efa64 Compare

June 19, 2023 21:38

yeazelm approved these changes

View reviewed changes

sources/bloodhound/src/output.rs Show resolved Hide resolved

stmcginnis merged commit a4a1039 into bottlerocket-os:develop

stmcginnis deleted the cis-agent branch

June 21, 2023 14:24

stmcginnis mentioned this pull request

.featureGates.RotateKubeletServerCertificate dropped from kubelet config in k8s 1.28 #3506

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet