Add missing OCIL to three PCI-DSS RHEL8 rules (#4913) - #15033
Conversation
Issue ComplianceAsCode#4913 lists five rules in the PCI-DSS RHEL8 profile as missing OCIL. Two of them already have it on current master and are left untouched: audit_rules_immutable - has ocil_clause + ocil security_patches_up_to_date - has ocil_clause + ocil The remaining three are addressed here: audit_rules_session_events uses the existing ocil_audit_rules_watch() macro for /var/run/utmp, /var/log/btmp and /var/log/wtmp with the "session" key, matching how audit_rules_sysadmin_actions renders its watches. chronyd_or_ntpd_specify_multiple_servers checks for two or more "server" lines for whichever NTP daemon is in use. Uses the chrony_conf_path product variable rather than a hardcoded path, since it differs on Debian-family products. disable_prelink follows the OVAL, which is an OR of "prelink package not installed" and "PRELINKING=no in /etc/sysconfig/prelink", so the OCIL checks the package first and the setting second. Each ocil_clause is phrased so it reads as the failure condition, matching the surrounding rules.
|
Hi @raviaxo. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| {{{ ocil_audit_rules_watch("/var/run/utmp", "session") }}} | ||
| {{{ ocil_audit_rules_watch("/var/log/btmp", "session") }}} | ||
| {{{ ocil_audit_rules_watch("/var/log/wtmp", "session") }}} |
There was a problem hiding this comment.
The output that these macros create is really weird because it contains the instructions three times. It isn't really reader friendly. Instead, I'd prefer having here a custom text that contains just a single grep command that will find all 3 audit rules.
2 participants
Addresses #4913, which lists five rules in the PCI-DSS RHEL8 profile as missing OCIL.
Two of the five already have OCIL on current master and are left untouched:
audit_rules_immutablesecurity_patches_up_to_dateThe remaining three are addressed here. In each case I followed the rule's existing check rather than writing fresh prose, so the manual check and the automated one describe the same thing:
audit_rules_session_events— uses the existingocil_audit_rules_watch()macro for/var/run/utmp,/var/log/btmpand/var/log/wtmpwith thesessionkey, the same wayaudit_rules_sysadmin_actionsrenders its watches.chronyd_or_ntpd_specify_multiple_servers— checks for two or moreserverlines for whichever NTP daemon is in use, matching the OVAL, which requires{2,}matches. Uses thechrony_conf_pathproduct variable rather than a hardcoded path, since it differs on Debian-family products.disable_prelink— follows the OVAL, which is an OR of prelink package not installed andPRELINKING=noin/etc/sysconfig/prelink, so the OCIL checks the package first and the setting second.Each
ocil_clauseis phrased as the failure condition, matching the surrounding rules.Not built locally, and I would rather say so than imply otherwise. The machine I wrote this on has neither
yamlnorjinja2available to the system Python, so I verified structurally rather than by building: theocil_audit_rules_watchmacro exists with that signature and is used identically elsewhere,chrony_conf_pathis a defined product variable, the jinja braces balance, and both keys are present on each rule. I am relying on CI for the actual build. Two things I caught this way and fixed before pushing: an earlier draft referencedprelink_conf_path, which does not exist anywhere in the project, and hardcoded/etc/chrony.d/*.conf, which is wrong on Debian-family products.Happy to adjust wording or split this if you would rather have one rule per PR.