You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Improve the definitions for the AIDE rules for sle16 platform
Rationale:
all SUSE platforms use:
aide.service for checking aide DB
aide.timer for triggering aide.service
aidecheck-notify.service sending /var/log/aide-report.log to configured mail
xattrs is removed for sle16/opensuse16 since AIDE does not support it, aide_verify_ext_attributes rule is disabled also
Review Hints:
Here are some notes on how the changes were tested:
Remove system_with_kernel from aide group:
git diff linux_os/guide/system/software/integrity/software-integrity/aide/group.yml
diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/group.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/group.yml
index b7cabb3bc0..6320865b71 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/aide/group.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/group.yml
@@ -9,4 +9,3 @@ description: |-
software update. AIDE is highly configurable, with further configuration
information located in <tt>/usr/share/doc/aide-<i>VERSION</i></tt>.
-platform: system_with_kernel
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-68/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_package_aide_installed
INFO - Script package-installed.pass.sh using profile (all) OK
INFO - Script package-removed.fail.sh using profile (all) OK
INFO - Script package-installed-removed.fail.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-69/test_suite.log
WARNING - Script 'ubuntu_aide_timer_disabled.fail.sh' is not applicable on 'sle16' target because its platform is 'multi_platform_ubuntu'
WARNING - Script 'ubuntu_aide_service_masked.fail.sh' is not applicable on 'sle16' target because its platform is 'multi_platform_ubuntu'
WARNING - Script 'ubuntu_aide_timer_daily.pass.sh' is not applicable on 'sle16' target because its platform is 'multi_platform_ubuntu'
INFO - xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer
WARNING - Script aide_not_installed.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_aide_periodic_checking_systemd_timer evaluation resulted in notapplicable
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-70/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership
INFO - Script incorrect_groupowner.fail.sh using profile (all) OK
INFO - Script correct_groupowner.pass.sh using profile (all) OK
INFO - Script no_file.pass.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-71/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_audit_tools_ownership
INFO - Script correct_owner.pass.sh using profile (all) OK
INFO - Script incorrect_owner.fail.sh using profile (all) OK
INFO - Script no_file.pass.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-72/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_audit_tools_permissions
INFO - Script lenient_permissions.fail.sh using profile (all) OK
INFO - Script stricter_permisions.pass.sh using profile (all) OK
INFO - Script correct_permissions.pass.sh using profile (all) OK
INFO - Script missing_file_test.pass.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-73/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_check_audit_tools
INFO - Script correct_with_selinux.pass.sh using profile (all) OK
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script extra_suffix.fail.sh using profile (all) OK
INFO - Script not_config.fail.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-74/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_scan_notification
INFO - Script crontab_configured.pass.sh using profile (all) OK
INFO - Script crontab_just_periodic_checking.fail.sh using profile (all) OK
INFO - Script default.fail.sh using profile (all) OK
INFO - Script cron_weekly_configured.pass.sh using profile (all) OK
INFO - Script var_cron_configured.pass.sh using profile (all) OK
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into /tmp/logs_podman_tests-75/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_aide_verify_acls
INFO - Script wrong_value_inline.fail.sh using profile (all) OK
INFO - Script correct_value_inline.pass.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all
The OVAL state has the same product == sle16 limitation as the remediation macro. For openSUSE 16 the checker will continue requiring xattrs, so an xattrs-free configuration would be reported noncompliant even after the generated configuration is corrected. Keep this applicability condition synchronized with the openSUSE 16 handling.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
{{% else %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
{{% endif %}}
The SLE16 OVAL state requires p+i+n+u+g+s+b+acl+selinux+sha512, but the new SLE16 pass scenarios write p+i+n+u+g+s+b+acl+sha512 without selinux (and the expect_sbin_path scenario does the same). Those scenarios will therefore fail evaluation despite being marked pass. Please align the SLE16 test data, aide_string(), and this OVAL state on whether selinux is required.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
Adding multi_platform_sle makes both branches run against SUSE products, but the updated OVAL requires selinux for all SUSE states: sle16 expects ...+acl+selinux+sha512, while older SUSE expects ...+acl+selinux+xattrs+sha512. The pass scenario omits selinux in both branches, so it will fail on every SUSE product; include it in each expected string.
The quotes are part of the block scalar and will be written literally to /etc/aide_service.conf. Unlike the Bash remediation, this does not produce the AIDE @@include /etc/aide.conf directive, so the SLE16 service may not parse or use the intended configuration.
This test scenario is declared for RHEL, OL, SLE, SLMicro, Ubuntu, and other platforms, but the new variables unconditionally select aide.service and aide.timer. Once the shared remediation/checker preserves the existing aidecheck.* units for non-SUSE products, this setup will no longer establish the expected state on those platforms; make the test unit names use the same SUSE-family conditional.
{{% set aide_service = 'aide.service' %}}
{{% set aide_timer = 'aide.timer' %}}
lineinfile_present only appends the supplied line; its normal caller first removes existing matches (see shared/macros/10-bash.jinja:1334-1344). Calling it directly here makes repeated Bash remediation runs append duplicate report_url entries instead of being idempotent. Use an idempotent line-update path or remove the existing setting before appending.
The remediation enters the SUSE systemd branch for the opensuse product, but this OVAL criteria is gated only for sle15, sle16, and the SLMicro products. As a result, openSUSE 16 receives the new aide.service/notification setup while the check ignores those units and only evaluates the cron alternatives. Include openSUSE through the same version/applicability mechanism or keep its remediation on the cron path.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
This newly added sle16 branch still tells administrators to look for aidecheck.service in the dependency tree, but the implementation now wires aide.service to aidecheck-notify.service. The verification instructions are therefore wrong for sle16; refer to aide.service here.
<pre>$ sudo systemctl status aidecheck-notify|grep loaded</pre>
The output should return that the service is loaded.
Also we should make sure that notification service is started by the check:
<pre>$ sudo systemctl list-dependencies --reverse aidecheck-notify</pre>,
which should display the aidecheck.service in the dependency tree
The new systemd applicability branch only recognizes sle15, sle16, and the SLMicro products. Since openSUSE Leap 16 is represented by product: opensuse, it will take the package[aide] branch and the remediation will remain on the cron path instead of configuring aide.service/aidecheck-notify.service, despite the PR description including openSUSE16.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
platform: package[aide] and package[systemd]
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
…t review
- added check for setting report_url=file:/var/log/aide-report.log in /etc/aide.conf
- make sure we do not end up with duplicating report_url=file:/var/log/aide-report.log entries
- in the oval for sle15 use previous file regex
The OVAL state still requires xattrs for product == 'opensuse' because it falls into this else branch. As a result, an openSUSE 16 configuration using the new no-xattrs AIDE string will be reported noncompliant even if the generated configuration is correct.
The SLE16 test branch omits selinux, but the SLE16 OVAL state and aide_string() both require p+i+n+u+g+s+b+acl+selinux+sha512. Consequently, this expect_sbin_path.pass.sh scenario will be evaluated as non-compliant on SLE16; include +selinux in the generated value.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.
@teacup-on-rockingchair pls take a look at the failing CI and provide testing scenarios and verbose docs for the changes.
Thanks a lot 👍
Hey @macko1 , can you check the details I have added to the PR description. If they provide enough information ?
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AnsibleAnsible remediation update.BashBash remediation update.SLESSUSE Linux Enterprise Server product related.Update RuleIssues or pull requests related to Rules updates.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
teacup-on-rockingchair
added
Ansible
Description:
Rationale:
all SUSE platforms use:
xattrs is removed for sle16/opensuse16 since AIDE does not support it, aide_verify_ext_attributes rule is disabled also
Review Hints:
Here are some notes on how the changes were tested:
add rules to anssi profile:
build sle16 content:
./build_product sle16build podman image for sle16:
Output is :