Conversation
Issue ComplianceAsCode#4913 lists five rules in the PCI-DSS RHEL8 profile as missing OCIL. Two of them already have it on current master and are left untouched: audit_rules_immutable - has ocil_clause + ocil security_patches_up_to_date - has ocil_clause + ocil The remaining three are addressed here: audit_rules_session_events uses a single "auditctl -l | grep -E" command matching /var/run/utmp, /var/log/btmp and /var/log/wtmp at once, following the pattern already used by audit_rules_usergroup_modification. The path alternation works under both watch styles, since each path appears in the auditctl output whether the rule renders as "-w <path>" or as "-a always,exit -F path=<path>". chronyd_or_ntpd_specify_multiple_servers checks for two or more "server" lines for whichever NTP daemon is in use. Uses the chrony_conf_path product variable rather than a hardcoded path, since it differs on Debian-family products. disable_prelink follows the OVAL, which is an OR of "prelink package not installed" and "PRELINKING=no in /etc/sysconfig/prelink", so the OCIL checks the package first and the setting second. Each ocil_clause is phrased so it reads as the failure condition, matching the surrounding rules.
|
Hi @raviaxo. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@jan-cerny PTAL, seems this is a conclusion of your review in #15033 Thanks 🙏 |
3 participants
Description:
Adds the missing
ocilandocil_clauseto three rules in the PCI-DSS RHEL8 profile:auditctl -l | grep -Ecommand matching/var/run/utmp,/var/log/btmpand/var/log/wtmpat once, following the pattern already used byaudit_rules_usergroup_modification.serverlines for whichever NTP daemon is in use, using thechrony_conf_pathproduct variable rather than a hardcoded path, since it differs on Debian-family products.PRELINKING=noin/etc/sysconfig/prelink, so the OCIL checks the package first and the setting second.Two of the five rules named in the issue already have OCIL on current master and are left untouched:
audit_rules_immutableandsecurity_patches_up_to_date.Rationale:
Rules in the PCI-DSS RHEL8 profile without OCIL give the assessor no manual verification text in the generated guide.
Supersedes Add missing OCIL to three PCI-DSS RHEL8 rules (#4913) #15033, which I closed by accident with a bad force-push to the head branch; GitHub will not reopen it. Same branch, same change, with @jan-cerny's review feedback applied.
Fixes Some rules in PCI-DSS profile are missing OCIL (RHEL8) #4913
Review Hints:
The only difference from Add missing OCIL to three PCI-DSS RHEL8 rules (#4913) #15033 is
audit_rules_session_events. That rule previously calledocil_audit_rules_watch()once per watched file, which repeated the same "Verify ... with the following command" instruction three times. It is now custom text with one grep, as requested in review.The path alternation is deliberately style-agnostic: each path appears in the
auditctl -loutput whether the rule renders as-w <path> -p wa -k sessionor as-a always,exit -F path=<path> -F perm=wa -F key=session, so the text does not need to branch onaudit_watches_style. The wording says "lines" rather than "a line" because the modern style emits a b32 and a b64 line per file.ocil_clauseon that rule is left asthere is not output, unchanged from master.