Changing regex for aide.db file to support absolute path#13915
Conversation
|
Hi @Arden97. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
jan-cerny
left a comment
There was a problem hiding this comment.
I have verified the test scenarios passed locally on RHEL 9.
jcerny@fedora:~/work/git/scap-security-guide (pr/13915)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 aide_build_database
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-09-24-1433/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_build_database
INFO - Script db_not_present.fail.sh using profile (all) OK
INFO - Script new_db_not_present.pass.sh using profile (all) OK
INFO - Script get_db_path_absolute.pass.sh using profile (all) OK
INFO - Script get_db_path_dbdir.pass.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/13915)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible aide_build_database
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2025-09-24-1437/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_build_database
INFO - Script db_not_present.fail.sh using profile (all) OK
INFO - Script new_db_not_present.pass.sh using profile (all) OK
INFO - Script get_db_path_absolute.pass.sh using profile (all) OK
INFO - Script get_db_path_dbdir.pass.sh using profile (all) OK
Description:
Rationale:
The regular expression in the OVAL tag, which is responsible for creating an object to collect the file name for the Aide build database, needs to be extended. At the customer's request, the path to the Aide database must also be acceptable via an absolute path.
Fixes "Build and Test AIDE Database" should accept an absolute path name in aide.conf #13801 : extending a matching range for
object_aide_operational_database_filenameto match an absolute path to file as well as viaDBDIRvariableReview Hints:
Some examples of file paths that MATCH the new regular expression:
database_in=file:@@{DBDIR}/aide.db.gzdatabase=file:/etc/aide/aide.db.gzdatabase=file:@@{DBDIR}/aide/aide.db.gzSome examples of file paths that DO NOT MATCH the new regular expression:
database_in=file:@@{DBDIR}/Aide.db.gzdatabase=file:/etc/aide_dir/aide.db.gzdatabase=file:@@{DBDIR}/aide/database=file:/etc/aide_dir/NOTE: In my opinion, we should not expect Aide file and directory names to contain only lowercase letters. But these changes go beyond the scope of the issue.