Add Tripwire integrity rules - #15127
israel-villar wants to merge 7 commits into
Conversation
Tripwire is a common alternative to AIDE for file and directory integrity checking, but the guide only covers AIDE. Adds a tripwire group mirroring the existing aide group: - package_tripwire_installed (from template). - tripwire_build_database: check-only, verifies /var/lib/tripwire/*.twd exists; no remediation because tripwire --init requires the site and local passphrases to be entered interactively. - tripwire_periodic_cron_checking: check-only, verifies a "tripwire --check" cron entry exists (the Debian package ships /etc/cron.daily/tripwire by default). Adds the tripwire component. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…_periodic_cron_checking Both rules have custom OVAL (not template-based), so they aren't covered by any template's built-in test suite. - tripwire_build_database: pass when a *.twd file exists under /var/lib/tripwire, fail when none does. - tripwire_periodic_cron_checking: pass both via the Debian package's own /etc/cron.daily/tripwire (verified against the real packaged file content, no admin action needed) and via an explicit /etc/cron.d entry (covers the OVAL's other OR branch); fail when no schedule exists at all. All scenarios add linux-base to the packages list so the system_with_kernel platform gate (inherited from the tripwire group, mirroring aide's) evaluates true in the Docker test container, which otherwise has no kernel package and would report every scenario as not applicable. Verified with Automatus against the debian13 test container: all 5 scenarios evaluate as expected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
packaged_default.pass.sh relied silently on the tripwire package's post-install state instead of asserting it, which is fragile across package versions (aide_periodic_cron_checking's own test suite never relies on implicit package defaults, always writing the expected content explicitly, even though the AIDE package also installs a default cron.daily script). Writes the real /etc/cron.daily/tripwire content directly instead. Also adds crontab_entry.pass.sh, covering the /etc/crontab method the rule's own description documents as the explicit alternative to the packaged default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The /etc/cron.d and /etc/crontab OVAL branches (and their tests) were
speculative flexibility carried over from aide_periodic_cron_checking,
not grounded in how Tripwire is actually scheduled on Debian. A real
Debian 13 host running tripwire confirms the package relies solely on
/etc/cron.daily/tripwire; there is no crontab line or cron.d file for
it.
Drops both branches from the OVAL and the corresponding description/
ocil text, keeping only the /etc/cron.{daily,weekly,hourly} check
(generalized beyond "daily" so an administrator can relocate the
script to a less frequent cron directory). Replaces
cron_d_entry.pass.sh/crontab_entry.pass.sh with cron_weekly.pass.sh,
which exercises that relocation instead of a scenario with no
real-world basis.
Verified with Automatus against the debian13 test container: all 3
remaining scenarios evaluate as expected, and a full
--datastream-only build stays clean.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Hourly was another untested, speculative option (Tripwire integrity checks are too heavy for hourly runs, and it isn't part of the rule's own "at least weekly" rationale). Narrows the OVAL path pattern and description/ocil text to just /etc/cron.daily (the packaged default) and /etc/cron.weekly, matching aide_periodic_cron_checking's own cron.(daily|weekly) pattern. Verified with Automatus against the debian13 test container: all 3 scenarios evaluate as expected, and a full --datastream-only build stays clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Leftover from before hourly was dropped from the rule; harmless (rm -f on a nonexistent path is a no-op) but inconsistent with the rule's current scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Hi @israel-villar. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Hello @israel-villar, thanks for the submission. In order to consider this for a review, and to review this properly, please provide exact official Tripwire documentation sources for the decisions you made when creating these rules. Also please provide full documentation (comments) into the test benches you provided (expected results) Thanks. |
| @@ -0,0 +1,9 @@ | |||
| name: tripwire | |||
There was a problem hiding this comment.
Thanks for the review, @macko1. Here are the exact official Tripwire sources for the decisions in this PR:
-
tripwire --init / tripwire --check and the --quiet/--email-report flags — official tripwire(8) man page from the upstream Open Source Tripwire project: https://github.com/Tripwire/tripwire-open-source/blob/master/man/man8/tripwire.8 (see the mode selectors -m i/--init, -m c/--check, and the option table listing -s/--quiet and -M/--email-report.)
-
The DBFILE default of /var/lib/tripwire/$(HOSTNAME).twd — official twconfig(4) man page, same upstream project: https://github.com/Tripwire/tripwire-open-source/blob/master/man/man4/twconfig.4 ("Required Variables" section: DBFILE Default = /var/lib/tripwire/$(HOSTNAME).twd).
-
The /etc/cron.daily/tripwire script and its exact contents shipped by the Debian tripwire package (source of the tripwire_periodic_cron_checking check and test scenarios): https://sources.debian.org/src/tripwire/2.4.3.7-6/debian/cron.daily/ and the packaged twcfg.txt confirming Debian keeps the upstream DBFILE default: https://sources.debian.org/src/tripwire/2.4.3.7-6/debian/twcfg.txt/
I've also pushed a commit adding/extending expected-result comments on each test scenario per your second request
Add or extend a comment on each Automatus test scenario explaining what it exercises and the expected pass/fail outcome, as requested in review. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 participants
Description:
tripwirerule group underlinux_os/guide/system/software/integrity/software-integrity/tripwire/, mirroring the existingaidegroup, with three rules:package_tripwire_installed(template),tripwire_build_database(check-only, verifies/var/lib/tripwire/*.twdexists), andtripwire_periodic_cron_checking(check-only, verifies atripwire --checkcron entry exists). Adds thetripwirecomponent.Rationale:
tripwire_build_databaseships without remediation becausetripwire --initrequires the site and local passphrases to be entered interactively.Review Hints:
./build_product --datastream-only debian13.linux_os/guide/system/software/integrity/software-integrity/tripwire/*/rule.yml, the twooval/shared.xmlfiles,components/tripwire.yml.