You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all
The OVAL state has the same product == sle16 limitation as the remediation macro. For openSUSE 16 the checker will continue requiring xattrs, so an xattrs-free configuration would be reported noncompliant even after the generated configuration is corrected. Keep this applicability condition synchronized with the openSUSE 16 handling.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
{{% else %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
{{% endif %}}
The SLE16 OVAL state requires p+i+n+u+g+s+b+acl+selinux+sha512, but the new SLE16 pass scenarios write p+i+n+u+g+s+b+acl+sha512 without selinux (and the expect_sbin_path scenario does the same). Those scenarios will therefore fail evaluation despite being marked pass. Please align the SLE16 test data, aide_string(), and this OVAL state on whether selinux is required.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
Adding multi_platform_sle makes both branches run against SUSE products, but the updated OVAL requires selinux for all SUSE states: sle16 expects ...+acl+selinux+sha512, while older SUSE expects ...+acl+selinux+xattrs+sha512. The pass scenario omits selinux in both branches, so it will fail on every SUSE product; include it in each expected string.
The quotes are part of the block scalar and will be written literally to /etc/aide_service.conf. Unlike the Bash remediation, this does not produce the AIDE @@include /etc/aide.conf directive, so the SLE16 service may not parse or use the intended configuration.
This test scenario is declared for RHEL, OL, SLE, SLMicro, Ubuntu, and other platforms, but the new variables unconditionally select aide.service and aide.timer. Once the shared remediation/checker preserves the existing aidecheck.* units for non-SUSE products, this setup will no longer establish the expected state on those platforms; make the test unit names use the same SUSE-family conditional.
{{% set aide_service = 'aide.service' %}}
{{% set aide_timer = 'aide.timer' %}}
lineinfile_present only appends the supplied line; its normal caller first removes existing matches (see shared/macros/10-bash.jinja:1334-1344). Calling it directly here makes repeated Bash remediation runs append duplicate report_url entries instead of being idempotent. Use an idempotent line-update path or remove the existing setting before appending.
The remediation enters the SUSE systemd branch for the opensuse product, but this OVAL criteria is gated only for sle15, sle16, and the SLMicro products. As a result, openSUSE 16 receives the new aide.service/notification setup while the check ignores those units and only evaluates the cron alternatives. Include openSUSE through the same version/applicability mechanism or keep its remediation on the cron path.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
This newly added sle16 branch still tells administrators to look for aidecheck.service in the dependency tree, but the implementation now wires aide.service to aidecheck-notify.service. The verification instructions are therefore wrong for sle16; refer to aide.service here.
<pre>$ sudo systemctl status aidecheck-notify|grep loaded</pre>
The output should return that the service is loaded.
Also we should make sure that notification service is started by the check:
<pre>$ sudo systemctl list-dependencies --reverse aidecheck-notify</pre>,
which should display the aidecheck.service in the dependency tree
The new systemd applicability branch only recognizes sle15, sle16, and the SLMicro products. Since openSUSE Leap 16 is represented by product: opensuse, it will take the package[aide] branch and the remediation will remain on the cron path instead of configuring aide.service/aidecheck-notify.service, despite the PR description including openSUSE16.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
platform: package[aide] and package[systemd]
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
This SUSE-specific template now checks audit_binaries, but the SLE16 property list includes /sbin/audisp-syslog and does not include /sbin/rsyslogd (product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspect rsyslogd and omits audisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
…t review
- added check for setting report_url=file:/var/log/aide-report.log in /etc/aide.conf
- make sure we do not end up with duplicating report_url=file:/var/log/aide-report.log entries
- in the oval for sle15 use previous file regex
The OVAL state still requires xattrs for product == 'opensuse' because it falls into this else branch. As a result, an openSUSE 16 configuration using the new no-xattrs AIDE string will be reported noncompliant even if the generated configuration is correct.
The SLE16 test branch omits selinux, but the SLE16 OVAL state and aide_string() both require p+i+n+u+g+s+b+acl+selinux+sha512. Consequently, this expect_sbin_path.pass.sh scenario will be evaluated as non-compliant on SLE16; include +selinux in the generated value.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.
The reason will be displayed to describe this comment to others. Learn more.
@teacup-on-rockingchair pls take a look at the failing CI and provide testing scenarios and verbose docs for the changes.
Thanks a lot 👍
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AnsibleAnsible remediation update.BashBash remediation update.SLESSUSE Linux Enterprise Server product related.Update RuleIssues or pull requests related to Rules updates.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
teacup-on-rockingchair
added
Ansible
Description:
Rationale:
all SUSE platforms use:
xattrs is removed for sle16/opensuse16 since AIDE does not support it, aide_verify_ext_attributes rule is disabled also