Update select rules for RHEL not to modify systemd units in /usr #12486

Mab879 · 2024-10-10T21:32:25Z

Description:

Update require_singleuser_auth to use drop in files
Update require_emergency_target_auth to use drop in files

Rationale:

Help with RPM verify pass.

github-actions · 2024-10-10T21:34:15Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-10-10T21:36:39Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_require_emergency_target_auth' differs.
--- oval:ssg-require_emergency_target_auth:def:1
+++ oval:ssg-require_emergency_target_auth:def:1
@@ -1,5 +1,9 @@
+criteria OR
 criteria AND
 criterion oval:ssg-test_require_emergency_service:tst:1
 criterion oval:ssg-test_require_emergency_service_emergency_target:tst:1
 criterion oval:ssg-test_no_custom_emergency_target:tst:1
 criterion oval:ssg-test_no_custom_emergency_service:tst:1
+criterion oval:ssg-test_require_emergency_target_auth_drop_in_config_exist:tst:1
+criteria ONE
+criterion oval:ssg-test_require_emergency_service_drop_in:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_require_emergency_target_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_emergency_target_auth
+++ xccdf_org.ssgproject.content_rule_require_emergency_target_auth
@@ -1,17 +1,16 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel; then
 
-service_file="/usr/lib/systemd/system/emergency.service"
+service_dropin_cfg_dir="/etc/systemd/system/emergency.service.d"
+service_dropin_file="${service_dropin_cfg_dir}/10-oscap.conf"
 
 
 sulogin="/usr/lib/systemd/systemd-sulogin-shell emergency"
 
 
-if grep "^ExecStart=.*" "$service_file" ; then
-    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
-else
-    echo "ExecStart=-$sulogin" >> "$service_file"
-fi
+mkdir -p "${service_dropin_cfg_dir}"
+echo "[Service]" >> "${service_dropin_file}"
+echo "ExecStart=-$sulogin" >> "${service_dropin_file}"
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_require_emergency_target_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_emergency_target_auth
+++ xccdf_org.ssgproject.content_rule_require_emergency_target_auth
@@ -17,11 +17,12 @@
   - restrict_strategy
 
 - name: Require emergency mode password
-  lineinfile:
+  ansible.builtin.blockinfile:
     create: true
-    dest: /usr/lib/systemd/system/emergency.service
-    regexp: ^#?ExecStart=
-    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
+    dest: /etc/systemd/system/emergency.service.d/10-oscap.conf
+    block: |-
+      [Service]
+      ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
   when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-82186-8

bash remediation for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_singleuser_auth
+++ xccdf_org.ssgproject.content_rule_require_singleuser_auth
@@ -1,14 +1,37 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q kernel; then
 
-service_file="/usr/lib/systemd/system/rescue.service"
+found=false
 
-sulogin="/usr/lib/systemd/systemd-sulogin-shell rescue"
+# set value in all files if they contain section or key
+for f in $(echo -n "/etc/systemd/system/rescue.service.d/10-oscap.conf"); do
+    if [ ! -e "$f" ]; then
+        continue
+    fi
 
-if grep "^ExecStart=.*" "$service_file" ; then
-    sed -i "s%^ExecStart=.*%ExecStart=-$sulogin%" "$service_file"
-else
-    echo "ExecStart=-$sulogin" >> "$service_file"
+    # find key in section and change value
+    if grep -qzosP "[[:space:]]*\[Service\]([^\n\[]*\n+)+?[[:space:]]*ExecStart" "$f"; then
+
+            sed -i "s/ExecStart[^(\n)]*/ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue/" "$f"
+
+            found=true
+
+    # find section and add key = value to it
+    elif grep -qs "[[:space:]]*\[Service\]" "$f"; then
+
+            sed -i "/[[:space:]]*\[Service\]/a ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" "$f"
+
+            found=true
+    fi
+done
+
+# if section not in any file, append section with key = value to FIRST file in files parameter
+if ! $found ; then
+    file=$(echo "/etc/systemd/system/rescue.service.d/10-oscap.conf" | cut -f1 -d ' ')
+    mkdir -p "$(dirname "$file")"
+
+    echo -e "[Service]\nExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" >> "$file"
+
 fi
 
 else

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_singleuser_auth
+++ xccdf_org.ssgproject.content_rule_require_singleuser_auth
@@ -16,12 +16,13 @@
   - require_singleuser_auth
   - restrict_strategy
 
-- name: Require single user mode password
-  lineinfile:
-    create: true
-    dest: /usr/lib/systemd/system/rescue.service
-    regexp: ^#?ExecStart=
-    line: ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
+- name: Require Authentication for Single User Mode - Require emergency user mode
+    password
+  community.general.ini_file:
+    path: /etc/systemd/system/rescue.service.d/10-oscap.conf
+    section: Service
+    option: ExecStart
+    value: -/usr/lib/systemd/systemd-sulogin-shell rescue
   when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-80855-0

github-actions · 2024-10-10T21:55:00Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12486
This image was built from commit: b560bc1

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12486

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12486 make deploy-local

jan-cerny · 2024-10-14T13:34:03Z

linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/ansible/shared.yml

 - name: Require single user mode password
  lineinfile:
      create: yes
      dest: /usr/lib/systemd/system/rescue.service
      regexp: "^#?ExecStart="
-      {{% if product in ["fedora", "ol8", "ol9", "rhel8", "rhel9", "sle12", "sle15"] -%}}
+      {{% if product in ["fedora", "ol8", "ol9", "sle12", "sle15"] -%}}


Ocil and fixtext in the rule.yml should be updated the same way.

jan-cerny · 2024-10-14T13:39:56Z

..._os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml

@@ -4,7 +4,7 @@
 # complexity = low
 # disruption = low

-{{% if 'sle' in product %}}
+{{% if 'sle' in product or 'rhel' in product %}}


The condition on line 21 should be updated

jan-cerny · 2024-10-14T13:47:21Z

..._os/guide/system/accounts/accounts-physical/require_emergency_target_auth/ansible/shared.yml

@@ -4,7 +4,7 @@
 # complexity = low
 # disruption = low

-{{% if 'sle' in product %}}
+{{% if 'sle' in product or 'rhel' in product %}}


I think you should add a test scenario that covers the situation when the .d directory is used.

jan-cerny · 2024-10-14T13:53:00Z

linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml

      <criterion test_ref="test_require_rescue_service_runlevel1" />
      <criterion test_ref="test_no_custom_runlevel1_target" negate="true"/>
-      <criterion test_ref="test_no_custom_rescue_service" negate="true"/>
+            <criterion test_ref="test_no_custom_rescue_service" negate="true"/>


unwanted whitespace change

jan-cerny · 2024-10-14T13:54:45Z

linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml

@@ -5,16 +5,16 @@
    <criteria operator="AND">
      <criterion comment="Conditions are satisfied"
      test_ref="test_require_rescue_service" />
-      {{%- if product not in ["ol8", "rhel8"] -%}}
+      {{%- if product not in ["ol8"] and 'rhel' not in product  -%}}


I got errors from Automatus:

jcerny@fedora:~/work/git/scap-security-guide (pr/12486)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 require_singleuser_auth Setting console output to log level INFO INFO - The base image option has not been specified, choosing libvirt-based test environment. INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-14-1548/test_suite.log WARNING - Script rhel7_correct_value.pass.sh is not applicable on given platform INFO - xccdf_org.ssgproject.content_rule_require_singleuser_auth INFO - Script wrong_value.fail.sh using profile (all) OK ERROR - Rule evaluation resulted in error, instead of expected fixed during remediation stage ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth'. ERROR - Script correct_value.pass.sh using profile (all) found issue: ERROR - Rule evaluation resulted in fail, instead of expected pass during initial stage ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth'. jcerny@fedora:~/work/git/scap-security-guide (pr/12486)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible require_singleuser_auth Setting console output to log level INFO INFO - The base image option has not been specified, choosing libvirt-based test environment. INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-14-1550/test_suite.log WARNING - Script rhel7_correct_value.pass.sh is not applicable on given platform INFO - xccdf_org.ssgproject.content_rule_require_singleuser_auth INFO - Script wrong_value.fail.sh using profile (all) OK ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth'. ERROR - Script correct_value.pass.sh using profile (all) found issue: ERROR - Rule evaluation resulted in fail, instead of expected pass during initial stage ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth'.

Can you take a look?

Don't modify /usr files they are controled by the operating system.

…cy_target_auth

To better support drop in config files for RHEL and Fedora.

Allow spaces for ini file Fix for Fedora

codeclimate · 2024-10-23T22:09:28Z

Code Climate has analyzed commit 903b851 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

Mab879 · 2024-10-29T17:30:41Z

@mildas We can use the FQCN for community.general.ini_file?

mildas · 2024-10-31T09:20:04Z

@Mab879 Test doesn't accept community.general/ansible.posix modules FQCN. I have proposed a fix for the test and will re-run CI when it's merged.

jan-cerny · 2024-10-31T13:44:59Z

This looks fine now:

jcerny@fedora:~/work/git/scap-security-guide (pr/12486)$ python3 tests/automatus.py  rule --libvirt qemu:///system ssgts_rhel9 require_singleuser_auth
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-31-1442/test_suite.log
WARNING - Script rhel7_correct_value.pass.sh is not applicable on given platform
WARNING - Script correct_value.pass.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_require_singleuser_auth
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_dropin.pass.sh using profile (all) OK
INFO - Script wrong_dropin.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12486)$ python3 tests/automatus.py  rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible require_singleuser_auth
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-31-1443/test_suite.log
WARNING - Script rhel7_correct_value.pass.sh is not applicable on given platform
WARNING - Script correct_value.pass.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_require_singleuser_auth
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_dropin.pass.sh using profile (all) OK
INFO - Script wrong_dropin.fail.sh using profile (all) OK

Mab879 added Ansible Ansible remediation update. Bash Bash remediation update. labels Oct 10, 2024

Mab879 added this to the 0.1.75 milestone Oct 10, 2024

Mab879 force-pushed the systemd_unit_rule_updates branch from b560bc1 to 55277d3 Compare October 11, 2024 14:45

jan-cerny requested changes Oct 14, 2024

View reviewed changes

jan-cerny self-assigned this Oct 14, 2024

Mab879 marked this pull request as draft October 18, 2024 21:20

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 18, 2024

Mab879 added 3 commits October 22, 2024 10:41

Update require_emergency_target_auth for RHEL

ce6aad9

Don't modify /usr files they are controled by the operating system.

Update require_singleuser_auth for RHEL

024ea6f

Don't modify /usr files they are controled by the operating system.

Add tests for drop ins to require_singleuser_auth and require_emergen…

1b8df2c

…cy_target_auth

Mab879 force-pushed the systemd_unit_rule_updates branch from 94babc3 to 7da7181 Compare October 22, 2024 15:41

Update require_emergency_target_auth and require_singleuser_auth

269dfd8

To better support drop in config files for RHEL and Fedora.

Mab879 force-pushed the systemd_unit_rule_updates branch from 7da7181 to 269dfd8 Compare October 22, 2024 16:09

Mab879 marked this pull request as ready for review October 22, 2024 16:09

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 22, 2024

Mab879 marked this pull request as draft October 22, 2024 17:13

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 22, 2024

Update require_singleuser_auth OVAL checks

903b851

Allow spaces for ini file Fix for Fedora

Mab879 marked this pull request as ready for review October 29, 2024 17:30

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Oct 29, 2024

jan-cerny approved these changes Nov 1, 2024

View reviewed changes

jan-cerny merged commit 0dd0724 into ComplianceAsCode:master Nov 1, 2024
101 of 104 checks passed

Mab879 deleted the systemd_unit_rule_updates branch November 1, 2024 16:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update select rules for RHEL not to modify systemd units in /usr #12486

Update select rules for RHEL not to modify systemd units in /usr #12486

Mab879 commented Oct 10, 2024

github-actions bot commented Oct 10, 2024

github-actions bot commented Oct 10, 2024 •

edited

Loading

github-actions bot commented Oct 10, 2024

jan-cerny Oct 14, 2024

jan-cerny Oct 14, 2024

jan-cerny Oct 14, 2024

jan-cerny Oct 14, 2024

jan-cerny Oct 14, 2024

codeclimate bot commented Oct 23, 2024

Mab879 commented Oct 29, 2024

mildas commented Oct 31, 2024

jan-cerny commented Oct 31, 2024

Update select rules for RHEL not to modify systemd units in /usr #12486

Update select rules for RHEL not to modify systemd units in /usr #12486

Conversation

Mab879 commented Oct 10, 2024

Description:

Rationale:

github-actions bot commented Oct 10, 2024

github-actions bot commented Oct 10, 2024 • edited Loading

github-actions bot commented Oct 10, 2024

jan-cerny Oct 14, 2024

Choose a reason for hiding this comment

jan-cerny Oct 14, 2024

Choose a reason for hiding this comment

jan-cerny Oct 14, 2024

Choose a reason for hiding this comment

jan-cerny Oct 14, 2024

Choose a reason for hiding this comment

jan-cerny Oct 14, 2024

Choose a reason for hiding this comment

codeclimate bot commented Oct 23, 2024

Mab879 commented Oct 29, 2024

mildas commented Oct 31, 2024

jan-cerny commented Oct 31, 2024

github-actions bot commented Oct 10, 2024 •

edited

Loading