Add new rule for rootfiles package by Mab879 · Pull Request #13134 · ComplianceAsCode/content

Mab879 · 2025-03-03T17:07:26Z

Description:
Add rules to ensure that root's init files created by the rootfiles package are correctly configured.

Rationale:
Fixes #13100

openshift-ci · 2025-03-03T17:07:31Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Resolves ComplianceAsCode#13100

jan-cerny · 2025-03-04T09:04:33Z

+                }}}$
+            </ind:pattern>


All automatus tests fail. It's caused by the newline and spaces between the $ and </ind:pattern>.

jan-cerny · 2025-03-04T09:07:03Z

+<def-group>
+    <definition class="compliance" id="{{{ rule_id }}}" version="1">
+        {{{ oval_metadata("Ensure that tmpfiles for rootfiles is configured correctly.") }}}]
+        <criteria operator="AND" comment="Ensure that">


the comment is incomplete

jan-cerny · 2025-03-04T09:18:32Z

+C /root/.bash_profile  644 root root - /usr/share/rootfiles/.bash_profile
+C /root/.bashrc        644 root root - /usr/share/rootfiles/.bashrc
+C /root/.cshrc         644 root root - /usr/share/rootfiles/.cshrc
+C /root/.tcshrc        644 root root - /usr/share/rootfiles/.tcshrc


If the Bash remediation is applied, the result is the following:

[root@localhost ~]# cat /etc/tmpfiles.d/rootconf.conf C /root/.bash_logout 644 root root - /usr/share/rootfiles/.bash_logout C /root/.bash_profile 644 root root - /usr/share/rootfiles/.bash_profile C /root/.bashrc 644 root root - /usr/share/rootfiles/.bashrc C /root/.cshrc 644 root root - /usr/share/rootfiles/.cshrc C /root/.tcshrc 644 root root - /usr/share/rootfiles/.tcshrc C /root/.bash_logout 600 root root - /usr/share/rootfiles/.bash_logout C /root/.bash_profile 600 root root - /usr/share/rootfiles/.bash_profile C /root/.bashrc 600 root root - /usr/share/rootfiles/.bashrc C /root/.cshrc 600 root root - /usr/share/rootfiles/.cshrc C /root/.tcshrc 600 root root - /usr/share/rootfiles/.tcshrc

This isn't expected - the items should be replaced instead of added.

(Ansible remediation seems to work correctly).

jan-cerny · 2025-03-04T09:23:46Z

+    To set the mode of the root user initialization file <tt>/root/.bash_profile</tt>,
+    ensure the following line is is included in a file ending in <tt>.conf</tt> under
+    <tt>/etc/tmpfiles.d/</tt>.


This part of the description is about a single file and about a single line but then it adds multiple files and multiple lines. Please reword.

jan-cerny · 2025-03-04T09:23:59Z

@@ -0,0 +1,33 @@
+documentation_complete: true
+
+title: "Ensure rootfiles tmpfile.d is configured correctly"


* Ensure that only one configuration exists * Adjust PR based on feedback

jan-cerny · 2025-03-06T07:51:11Z

+references:
+    disa: CCI-000366
+    srg: SRG-OS-000480-GPOS-00227
+


Missing OCIL, OCIL clause and fixtext. This makes the thin data stream for this rule invalid. (It's unfortunate that we don't test this).

jan-cerny · 2025-03-06T07:53:03Z

+# strategy = configure
+# complexity = low
+# disruption = low
+


The test scenarios fail for me if Bash remediation is used:

jcerny@fedora:~/work/git/scap-security-guide (pr/13134)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 rootfiles_configured Setting console output to log level INFO INFO - The base image option has not been specified, choosing libvirt-based test environment. INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-06-0845/test_suite.log INFO - xccdf_org.ssgproject.content_rule_rootfiles_configured INFO - Script configured_wrong.fail.sh using profile (all) OK ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_rootfiles_configured'. INFO - Script conflicting.fail.sh using profile (all) OK ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_rootfiles_configured'. INFO - Script file_not_there.fail.sh using profile (all) OK INFO - Script missing_some.fail.sh using profile (all) OK INFO - Script valid.pass.sh using profile (all) OK

I can see this suspicious message in the results:

sed: no input files sed: no input files sed: no input files sed: no input files sed: no input files

qlty-cloud-legacy · 2025-03-06T17:58:48Z

Code Climate has analyzed commit 2dcb09a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.1% (0.0% change).

View more on Code Climate.

Mab879 · 2025-03-07T13:15:57Z

/packit build

jan-cerny

I have run automatus tests on RHEL 9.

jcerny@fedora:~/work/git/scap-security-guide (pr/13134)$ python3  tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 rootfiles_configured
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-10-1306/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rootfiles_configured
INFO - Script configured_wrong.fail.sh using profile (all) OK
INFO - Script conflicting.fail.sh using profile (all) OK
INFO - Script file_not_there.fail.sh using profile (all) OK
INFO - Script missing_some.fail.sh using profile (all) OK
INFO - Script valid.pass.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13134)$ python3  tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible rootfiles_configured
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-03-10-1309/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rootfiles_configured
INFO - Script configured_wrong.fail.sh using profile (all) OK
INFO - Script conflicting.fail.sh using profile (all) OK
INFO - Script file_not_there.fail.sh using profile (all) OK
INFO - Script missing_some.fail.sh using profile (all) OK
INFO - Script valid.pass.sh using profile (all) OK

Mab879 added RHEL Red Hat Enterprise Linux product related. New Rule Issues or pull requests related to new Rules. Update Profile Issues or pull requests related to Profiles updates. STIG STIG Benchmark related. labels Mar 3, 2025

Mab879 added this to the 0.1.77 milestone Mar 3, 2025

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 3, 2025

Mab879 mentioned this pull request Mar 3, 2025

Add new rules for rootfiles package #13123

Closed

Mab879 added 4 commits March 3, 2025 12:37

Add new rule rootfiles_configured

d2ed23f

Add rootfiles_configured to RHEL STIGs

ac9df24

Resolves ComplianceAsCode#13100

Add rootfiles_configured to stable profiles

d138ca8

Add references to rootfiles_configured

773cebc

Mab879 force-pushed the fix_13100_2 branch from 70b8978 to 773cebc Compare March 3, 2025 18:37

Mab879 marked this pull request as ready for review March 3, 2025 18:40

Mab879 requested a review from a team as a code owner March 3, 2025 18:40

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 3, 2025

jan-cerny requested changes Mar 4, 2025

View reviewed changes

jan-cerny self-assigned this Mar 4, 2025

Mab879 added 2 commits March 5, 2025 12:51

Adjust rootfiles_configured

d2dfbbd

* Ensure that only one configuration exists * Adjust PR based on feedback

Fix shellcheck in rootfiles_configure

35ebd40

jan-cerny requested changes Mar 6, 2025

View reviewed changes

Mab879 added 2 commits March 6, 2025 11:28

Fix bug in rootfiles_configured bash remediation

8923027

Add OCIL and fix text to rootfiles_configured

2dcb09a

jan-cerny approved these changes Mar 10, 2025

View reviewed changes

jan-cerny merged commit 398b847 into ComplianceAsCode:master Mar 10, 2025

Mab879 deleted the fix_13100_2 branch March 10, 2025 13:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add new rule for rootfiles package #13134

Add new rule for rootfiles package #13134
jan-cerny merged 8 commits into
ComplianceAsCode:masterfrom
Mab879:fix_13100_2

Mab879 commented Mar 3, 2025

Uh oh!

openshift-ci Bot commented Mar 3, 2025

Uh oh!

jan-cerny Mar 4, 2025

Uh oh!

jan-cerny Mar 4, 2025

Uh oh!

jan-cerny Mar 4, 2025

Uh oh!

jan-cerny Mar 4, 2025

Uh oh!

jan-cerny Mar 4, 2025

Uh oh!

jan-cerny Mar 6, 2025

Uh oh!

jan-cerny Mar 6, 2025

Uh oh!

qlty-cloud-legacy Bot commented Mar 6, 2025

Uh oh!

Mab879 commented Mar 7, 2025

Uh oh!

jan-cerny left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,33 @@
		documentation_complete: true

		title: "Ensure rootfiles tmpfile.d is configured correctly"

Conversation

Mab879 commented Mar 3, 2025

Uh oh!

openshift-ci Bot commented Mar 3, 2025

Uh oh!

jan-cerny Mar 4, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 4, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 4, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 4, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 4, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

jan-cerny Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

qlty-cloud-legacy Bot commented Mar 6, 2025

Uh oh!

Mab879 commented Mar 7, 2025

Uh oh!

jan-cerny left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants