Add CIS related kola tests - acl.security.cis.modprobe acl.security.cis.logperms acl.security.cis.sshd

[mayankfz]

Summary

Add CIS related kola tests - acl.security.cis.modprobe acl.security.cis.logperms acl.security.cis.sshd

Change Log

• Add CIS related kola tests - acl.security.cis.modprobe acl.security.cis.logperms acl.security.cis.sshd

Type of Change

• New kola test
• Kola test fix/update
• Platform integration change (Azure, QEMU, etc.)
• CLI/command change
• CI/automation change
• Bug fix
• Documentation update

Associated Issues

https://dev.azure.com/mariner-org/ACL/_workitems/edit/19664

Test Methodology

• Test details: https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1197933&view=results

Merge Checklist

All applicable boxes should be checked before merging

• go build ./... passes (basic validation)
• docker build -t mantle . succeeds (full multi-arch build; required for build-affecting changes)
• go test ./... passes
• go vet ./... reports no issues
• Relevant kola tests pass against a test image
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

Pull request overview

Adds new Azure Container Linux (ACL) CIS-focused kola tests under kola/tests/misc to validate CIS hardening settings on supported platforms (qemu/qemu-unpriv/azure).

Changes:

• Register three new ACL-only kola tests: acl.security.cis.sshd, acl.security.cis.modprobe, acl.security.cis.logperms.
• Implement SSHD hardening validation via sshd -T and permissions checks on SSH config/drop-in files.
• Implement checks for CIS modprobe blacklist entries and Azure log/waagent-related permission settings.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

kola/tests/misc/cis.go:92

• modprobe is invoked without sudo. On most distros modprobe lives in an sbin directory and/or requires elevated privileges; this can cause the test to fail with command not found or permission errors even when the CIS config is correct. Run it via sudo (or use an absolute path) to make the check platform/PATH-independent.

	// sctp should be a silent no-op (exit 0), not a hard error
	c.MustSSH(m, "modprobe -n sctp")

[Copilot]

🟡 Changes recommended

The new CISLogPerms test uses stat without sudo on paths expected to be 0750, which can cause permission-denied failures and make the test incorrect/flaky.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

kola/tests/misc/cis.go:129

• The per-file permission checks under /var/log/azure use stat without sudo. Since the parent dir is expected to be 0750, these stat calls can fail due to lack of traverse permission, making the test flaky/incorrect.

		mode := strings.TrimSpace(string(c.MustSSH(m, fmt.Sprintf("stat -c '%%a' %s", path))))

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

One of the new tests runs modprobe without sudo, which can fail under the default unprivileged SSH user and make the test flaky or incorrect.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

kola/tests/misc/cis.go:97

• modprobe typically requires root privileges even in dry-run mode on some distros; running it without sudo can cause the test to fail with EPERM and never validate the CIS install sctp /bin/true behavior. Since this test suite already assumes passwordless sudo on ACL, run the dry-run via sudo to make the assertion platform/user-independent.

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Lite