From 8cfa115c7272967f92bc152ae2901f516afe107f Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Thu, 16 Jul 2026 16:33:41 +0000 Subject: [PATCH 1/5] security: Update on CIS benchmarks Signed-off-by: Mayank Singh --- build_library/rpm/build_image_util.sh | 52 ++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 8 deletions(-) diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index 1b370f79279..e3106284d5d 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -414,7 +414,7 @@ TMPFILES_SSHD # Support both traditional authorized_keys and Ignition's authorized_keys.d/ignition AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/ignition SSHD_CONF - sudo chmod 644 "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" + sudo chmod 600 "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" # Phase 1 hardening: disable SSH password authentication at build time. # Closes the window between boot and WALinuxAgent provisioning where @@ -428,7 +428,28 @@ PasswordAuthentication no KbdInteractiveAuthentication no ChallengeResponseAuthentication no SSHD_NOPASSWD - sudo chmod 644 "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" + sudo chmod 600 "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" + + # CIS 5.2.7: Ensure SSH access is limited + # Deny root SSH access (matches AgentBaker's DenyUsers pattern). + # CIS requires at least one of AllowUsers/AllowGroups/DenyUsers/DenyGroups. + # CIS 5.2.10: Disable SSH forwarding (agent/TCP/X11/tunnel) + info "RPM mode: Adding CIS SSH access and forwarding restrictions" + sudo tee "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" > /dev/null <<'SSHD_CIS' +# CIS 5.2.7 - Ensure SSH access is limited +# The assessor requires all four directives to be present in sshd -T output. +# AllowUsers/AllowGroups * are effectively no-ops (permit everyone) but satisfy +# the check. DenyUsers/DenyGroups root block root SSH login. +AllowUsers * +AllowGroups * +DenyUsers root +DenyGroups root +# CIS 5.2.10 - Ensure SSH disableforwarding is enabled +DisableForwarding yes +# CIS 5.2.16 - Ensure sshd MaxAuthTries is configured (<=4) +MaxAuthTries 4 +SSHD_CIS + sudo chmod 600 "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" # Ensure sshd_config includes the .d directory local sshd_config="${ssh_config_dir}/sshd_config" @@ -1125,11 +1146,15 @@ _configure_cis_hardening_rpm() { info "RPM mode: Applying CIS Level 1 hardening" # 1.1.1.1: Blacklist cramfs kernel module + # 3.1.4: Blacklist sctp kernel module (matches AgentBaker modprobe-CIS.conf) sudo install -d -m 0755 "${root_fs_dir}/usr/lib/modprobe.d" sudo tee "${root_fs_dir}/usr/lib/modprobe.d/cis-blacklist.conf" > /dev/null <<'MODPROBE_CIS' # CIS 1.1.1.1 - Ensure cramfs kernel module is not available install cramfs /bin/false blacklist cramfs +# CIS 3.1.4 - Ensure sctp kernel module is not available +install sctp /bin/false +blacklist sctp MODPROBE_CIS sudo chmod 0644 "${root_fs_dir}/usr/lib/modprobe.d/cis-blacklist.conf" @@ -1146,12 +1171,6 @@ MODPROBE_CIS # 5.1.1 (cron daemon enabled): # ACL does not ship cronie. No cron daemon exists to enable. Should be # excluded from the ACL CIS benchmark. - # - # 5.5.2 (system accounts secured): - # Requires SCE script execution which the assessor does not support yet. - # - # 6.1.3.1 (access to all logfiles configured): - # Requires SCE script execution which the assessor does not support yet. # 1.4.x / 3.2.x: Sysctl hardening (network + ASLR) # Includes both IPv4 and IPv6 settings as required by the CIS benchmark. @@ -1371,6 +1390,23 @@ Compress=yes JOURNALD_CIS sudo chmod 0644 "${root_fs_dir}/etc/systemd/journald.conf.d/cis.conf" + # 6.1.3.1: waagent creates logs with 644 (umask 022). Set UMask=0137 so + # waagent.log and extension logs (e.g. CommandExecution.log) get 640. + info "RPM mode: Adding waagent.service UMask drop-in (CIS 6.1.3.1)" + sudo mkdir -p "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d" + sudo tee "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" > /dev/null <<'WAAGENT_UMASK' +[Service] +UMask=0137 +WAAGENT_UMASK + sudo chmod 0644 "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" + + # tmpfiles.d fallback: fix /var/log/azure perms at boot for pre-existing logs + sudo tee "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" > /dev/null <<'TMPFILES_LOG' +z /var/log/azure - root root 0750 - +Z /var/log/azure - root root 0640 - +TMPFILES_LOG + sudo chmod 0644 "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" + # 7.2.8: Home directory permissions sudo chmod 0700 "${root_fs_dir}/root" if [[ -d "${root_fs_dir}/home" ]]; then From a70cbada5e9938a27f475c822c4ec22a1a0322b8 Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Tue, 21 Jul 2026 06:53:40 +0000 Subject: [PATCH 2/5] incorporate review comments Signed-off-by: Mayank Singh --- build_library/rpm/build_image_util.sh | 33 +++++++++---------- .../oem-azure/files/manglefs_rpm.sh | 9 +++++ 2 files changed, 24 insertions(+), 18 deletions(-) diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index e3106284d5d..a23ef2fcdc8 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -437,9 +437,12 @@ SSHD_NOPASSWD info "RPM mode: Adding CIS SSH access and forwarding restrictions" sudo tee "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" > /dev/null <<'SSHD_CIS' # CIS 5.2.7 - Ensure SSH access is limited -# The assessor requires all four directives to be present in sshd -T output. -# AllowUsers/AllowGroups * are effectively no-ops (permit everyone) but satisfy -# the check. DenyUsers/DenyGroups root block root SSH login. +# The assessor requires 'allowusers' present in sshd -T (regex .+$), without it +# the rule fails with "Option 'allowusers' not found". A static allow-list is not +# possible because WALinuxAgent provisions the admin user in a dynamic group. +# NOTE: AllowUsers/AllowGroups are additive in OpenSSH, a wildcard means +# downstream consumers must replace this file to narrow access (adding another +# AllowUsers in a drop-in unions with '*', i.e. still everyone). AllowUsers * AllowGroups * DenyUsers root @@ -447,6 +450,8 @@ DenyGroups root # CIS 5.2.10 - Ensure SSH disableforwarding is enabled DisableForwarding yes # CIS 5.2.16 - Ensure sshd MaxAuthTries is configured (<=4) +# Note: counts keys offered, not accepted. Clients with >=4 loaded keys +# should use IdentitiesOnly=yes to avoid "Too many authentication failures". MaxAuthTries 4 SSHD_CIS sudo chmod 600 "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" @@ -460,13 +465,14 @@ SSHD_CIS # Include drop-in configurations Include /etc/ssh/sshd_config.d/*.conf SSHD_CONFIG_EOF - sudo chmod 644 "${sshd_config}" elif ! sudo grep -q "^Include.*/etc/ssh/sshd_config.d" "${sshd_config}"; then info "RPM mode: Adding Include directive to existing sshd_config" sudo sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' "${sshd_config}" else info "RPM mode: sshd_config already has Include directive" fi + # CIS 5.2.1: sshd_config must be 600 root:root regardless of how it was created + sudo chmod 600 "${sshd_config}" # Switch sshd to socket activation (matching Flatcar behavior) # The Azure Linux openssh RPM only ships sshd.service (traditional daemon). @@ -1153,7 +1159,8 @@ _configure_cis_hardening_rpm() { install cramfs /bin/false blacklist cramfs # CIS 3.1.4 - Ensure sctp kernel module is not available -install sctp /bin/false +# /bin/true so modprobe callers get exit 0 (not a hard error from /bin/false) +install sctp /bin/true blacklist sctp MODPROBE_CIS sudo chmod 0644 "${root_fs_dir}/usr/lib/modprobe.d/cis-blacklist.conf" @@ -1390,20 +1397,10 @@ Compress=yes JOURNALD_CIS sudo chmod 0644 "${root_fs_dir}/etc/systemd/journald.conf.d/cis.conf" - # 6.1.3.1: waagent creates logs with 644 (umask 022). Set UMask=0137 so - # waagent.log and extension logs (e.g. CommandExecution.log) get 640. - info "RPM mode: Adding waagent.service UMask drop-in (CIS 6.1.3.1)" - sudo mkdir -p "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d" - sudo tee "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" > /dev/null <<'WAAGENT_UMASK' -[Service] -UMask=0137 -WAAGENT_UMASK - sudo chmod 0644 "${root_fs_dir}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" - - # tmpfiles.d fallback: fix /var/log/azure perms at boot for pre-existing logs + # tmpfiles.d: create /var/log/azure with 0750 at boot (CIS 6.1.3.1). + # 'd' creates the dir if missing, UMask=0027 handles file perms at runtime. sudo tee "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" > /dev/null <<'TMPFILES_LOG' -z /var/log/azure - root root 0750 - -Z /var/log/azure - root root 0640 - +d /var/log/azure 0750 root root - - TMPFILES_LOG sudo chmod 0644 "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh index c8c243fa20e..3b7b78aa352 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh @@ -15,6 +15,15 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then "${rootfs}/usr/lib/systemd/system/waagent.service" fi +# CIS 6.1.3.1: waagent creates logs with 644 (umask 022). Set UMask=0027 so +# waagent.log and extension logs get 640 while directories stay traversable (0750). +mkdir -p "${rootfs}/usr/lib/systemd/system/waagent.service.d" +cat > "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" <<'EOF' +[Service] +UMask=0027 +EOF +chmod 0644 "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" + # Patch waagent service file to create symlink back to /etc/waagent.conf at ExecStartPre if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then # Insert ExecStartPre lines after the [Service] header From 7ed9b6702bfb9f58aa4bce92ce988f697e92b8ed Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Tue, 4 Aug 2026 07:58:19 +0000 Subject: [PATCH 3/5] add CIS related kola tests - acl.security.cis.modprobe acl.security.cis.logperms acl.security.cis.sshd Signed-off-by: Mayank Singh --- acl/tests/kola_enforcing.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/acl/tests/kola_enforcing.yaml b/acl/tests/kola_enforcing.yaml index d4216c4ea7a..0561202ab58 100644 --- a/acl/tests/kola_enforcing.yaml +++ b/acl/tests/kola_enforcing.yaml @@ -112,6 +112,22 @@ tests: # TEMPORARY (AB#23640): Enable acl.packages.package-manifest in kola_enforcing.yaml once the mantle LKG carries it # - name: acl.packages.package-manifest + - name: acl.security.cis.logperms + exceptions: + - platforms: [qemu] + architectures: [aarch64] + reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration. + - name: acl.security.cis.modprobe + exceptions: + - platforms: [qemu] + architectures: [aarch64] + reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration. + - name: acl.security.cis.sshd + exceptions: + - platforms: [qemu] + architectures: [aarch64] + reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration. + - name: bpf.execsnoop exceptions: - imageVariants: [acl-t] From 3e7fb8d91c4be2122f78141572f8bf3ee5c533b4 Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Mon, 7 Sep 2026 06:48:15 +0000 Subject: [PATCH 4/5] incorporate review comments Signed-off-by: Mayank Singh --- build_library/rpm/build_image_util.sh | 30 +++++++++++++------ .../oem-azure/files/manglefs_rpm.sh | 13 ++++---- 2 files changed, 29 insertions(+), 14 deletions(-) diff --git a/build_library/rpm/build_image_util.sh b/build_library/rpm/build_image_util.sh index a23ef2fcdc8..a748948b915 100644 --- a/build_library/rpm/build_image_util.sh +++ b/build_library/rpm/build_image_util.sh @@ -437,18 +437,21 @@ SSHD_NOPASSWD info "RPM mode: Adding CIS SSH access and forwarding restrictions" sudo tee "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" > /dev/null <<'SSHD_CIS' # CIS 5.2.7 - Ensure SSH access is limited -# The assessor requires 'allowusers' present in sshd -T (regex .+$), without it -# the rule fails with "Option 'allowusers' not found". A static allow-list is not -# possible because WALinuxAgent provisions the admin user in a dynamic group. -# NOTE: AllowUsers/AllowGroups are additive in OpenSSH, a wildcard means -# downstream consumers must replace this file to narrow access (adding another -# AllowUsers in a drop-in unions with '*', i.e. still everyone). +# Azure Policy requires AllowUsers, but Azure admin names are dynamic. +# Replace this file to narrow access, AllowUsers entries are additive. AllowUsers * -AllowGroups * DenyUsers root DenyGroups root # CIS 5.2.10 - Ensure SSH disableforwarding is enabled +# OpenSSH keeps the first value, so a later drop-in cannot override this. DisableForwarding yes +# CIS 5.2.23 - Ensure sshd granular forwarding is disabled +# Keep the effective values explicit for CIS assessment. +AllowTcpForwarding no +AllowAgentForwarding no +AllowStreamLocalForwarding no +X11Forwarding no +PermitTunnel no # CIS 5.2.16 - Ensure sshd MaxAuthTries is configured (<=4) # Note: counts keys offered, not accepted. Clients with >=4 loaded keys # should use IdentitiesOnly=yes to avoid "Too many authentication failures". @@ -471,8 +474,17 @@ SSHD_CONFIG_EOF else info "RPM mode: sshd_config already has Include directive" fi - # CIS 5.2.1: sshd_config must be 600 root:root regardless of how it was created - sudo chmod 600 "${sshd_config}" + # CIS 5.2.1: Restrict SSH configuration to root. + sudo chown root:root \ + "${sshd_config}" \ + "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" \ + "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" \ + "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" + sudo chmod 600 \ + "${sshd_config}" \ + "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" \ + "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" \ + "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" # Switch sshd to socket activation (matching Flatcar behavior) # The Azure Linux openssh RPM only ships sshd.service (traditional daemon). diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh index 3b7b78aa352..b7db384d226 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh @@ -15,14 +15,17 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then "${rootfs}/usr/lib/systemd/system/waagent.service" fi -# CIS 6.1.3.1: waagent creates logs with 644 (umask 022). Set UMask=0027 so -# waagent.log and extension logs get 640 while directories stay traversable (0750). -mkdir -p "${rootfs}/usr/lib/systemd/system/waagent.service.d" -cat > "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" <<'EOF' +# CIS 6.1.3.1: Restrict existing logs and new files created by waagent. +if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then + mkdir -p "${rootfs}/usr/lib/systemd/system/waagent.service.d" + cat > "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" <<'EOF' [Service] UMask=0027 +# Ignore missing paths and leave directory modes unchanged. +ExecStartPre=-/usr/bin/find /var/log/waagent.log /var/log/azure -xdev -type f -exec /usr/bin/chmod g-wx,o-rwx {} + EOF -chmod 0644 "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" + chmod 0644 "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" +fi # Patch waagent service file to create symlink back to /etc/waagent.conf at ExecStartPre if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then From fcebb7ee9e5bf778aee9a043f2583b9c816aec6f Mon Sep 17 00:00:00 2001 From: Mayank Singh Date: Mon, 7 Sep 2026 07:16:06 +0000 Subject: [PATCH 5/5] avoid missing log path warnings Signed-off-by: Mayank Singh --- .../coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh index b7db384d226..4762ba42942 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh @@ -22,7 +22,7 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then [Service] UMask=0027 # Ignore missing paths and leave directory modes unchanged. -ExecStartPre=-/usr/bin/find /var/log/waagent.log /var/log/azure -xdev -type f -exec /usr/bin/chmod g-wx,o-rwx {} + +ExecStartPre=-/bin/sh -c 'for path in /var/log/waagent.log /var/log/azure; do [ -e "$$path" ] || continue; /usr/bin/find "$$path" -xdev -type f -exec /usr/bin/chmod g-wx,o-rwx {} +; done' EOF chmod 0644 "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" fi