Update CIS profiles to use control files #10833

rhmdnd · 2023-07-12T20:06:20Z

Remove all the original rules and mappings we had for CIS version 1.1
and instead rely on the control files for CIS OpenShift 1.4.0 that we
recently implemented.

github-actions · 2023-07-12T21:14:23Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

rhmdnd · 2023-07-13T19:35:51Z

/test

openshift-ci · 2023-07-13T19:35:54Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-images

Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rhmdnd · 2023-07-13T19:36:04Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-13T20:02:03Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-13T20:03:51Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-13T21:23:24Z

The OpenShift tests should work a bit better once #10841 lands

rhmdnd · 2023-07-14T13:27:10Z

Rebased to pick up the YAML fix in section 5.

#10843

rhmdnd · 2023-07-14T13:27:37Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

jhrozek · 2023-07-17T07:24:56Z

@rhmdnd can you rebase?

rhmdnd · 2023-07-17T15:34:56Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-17T18:05:02Z

The CIS tests are failing because we don't have any filtering in place for the node versus platform rules. Working on that now.

rhmdnd · 2023-07-17T18:07:26Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-17T19:47:16Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-17T21:31:54Z

Filtering worked for the CIS profile. Adding in filtering for the node profile now.

rhmdnd · 2023-07-17T21:33:08Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd · 2023-07-17T21:35:21Z

cc: @xiaojiey for awareness that these changes are coming to the CIS profile for the next Compliance Operator release.

rhmdnd · 2023-07-17T23:29:49Z

OCP4 CIS testing passed. cc @jhrozek @Vincent056 @yuumasato

xiaojiey · 2023-07-18T02:40:53Z

cc: @xiaojiey for awareness that these changes are coming to the CIS profile for the next Compliance Operator release.

Got it. Thanks for the notification. Does it mean cis 1.4.0 is available?

openshift-ci · 2023-07-18T02:40:55Z

@xiaojiey: The label(s) `/label qe-

cannot be applied. These labels are supported:platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, downstream-change-needed, rebase/manual, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/valid-bug, staff-eng-approved. Is this label configured under labels -> additional_labelsorlabels -> restricted_labelsinplugin.yaml`?

Details

In response to this:

/label qe-

cc: @xiaojiey for awareness that these changes are coming to the CIS profile for the next Compliance Operator release.

Got it. Thanks for the notification. Does it mean cis 1.4.0 is available?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jhrozek · 2023-07-18T07:47:20Z

cc: @xiaojiey for awareness that these changes are coming to the CIS profile for the next Compliance Operator release.

Got it. Thanks for the notification. Does it mean cis 1.4.0 is available?

Mostly. We've ported the existing rules and did some changes, but not all. We need to make a second pass to sync the upstream benchmark that we worked on with CIS to the rules, but I don't think there will be many changes. Some parts of CIS are not implementable with CIS yet (some permission issues) outside 4.14+.

But for now this is mostly a different way of building the profile and the references should point to the right controls and sections in upstream CIS.

jhrozek · 2023-07-18T08:51:06Z

It appears that we have either missed some rules or maybe these rules were deprecated:

- file_permissions_kube_controller_manager (was in node, 1.1.3, now there is a typo that says file_permissions_kube_apiserver)
- file_owner_kubelet (was in node 4.1.6)
- file_permissions_scheduler (was in node 1.1.5)
- general_configure_imagepolicywebhook (was 5.5.1)
- kubelet_enable_protect_kernel_sysctl (was in node 4.2.6)
- kubelet_enable_protect_kernel_defaults (was in node 4.2.6)
- api_server_admission_control_plugin_securitycontextdeny (was 1.2.13)
- api_server_api_priority_flowschema_catch_all (was 1.2.10)
- api_server_auth_mode_node (was 1.2.8)
- api_server_no_adm_ctrl_plugins_disabled (was 1.2.14)
- controller_rotate_kubelet_server_certs (was 1.3.6)
- general_configure_imagepolicywebhook (was 5.5.1)
- kubelet_configure_tls_key (was 4.2.10)
- var_openshift_audit_profile = WriteRequestBodies (wtf diff, can't find it now)

I'll check them out and send PRs for the obvious cases. We can discuss the rest.

jhrozek · 2023-07-18T09:02:08Z

I think we can skip these rules:

- general_configure_imagepolicywebhook - I don't see this rule being used in CIS at all except a footnote in 5.5.1
- kubelet_enable_protect_kernel_sysctl (was in node 4.2.6) - unused, is the default in newer OCP versions anyway
- kubelet_enable_protect_kernel_defaults (was in node 4.2.6) - ditto
- api_server_admission_control_plugin_securitycontextdeny - explicitly removed in 1.4

jhrozek · 2023-07-18T09:10:35Z

These were also removed:

api_server_api_priority_flowschema_catch_all - can't find it in 1.4
api_server_auth_mode_node - CIS now only checks for the mode not being AlwaysAllow
api_server_no_adm_ctrl_plugins_disabled - deprecated in favor of api_server_admission_control_plugin_scc

jhrozek · 2023-07-18T09:11:25Z

In this patch, please explicitly set the audit policy to WriteRequestBodies like we do e.g. in the STIG profile: https://github.com/ComplianceAsCode/content/blob/master/products/ocp4/profiles/stig.profile#L28

jhrozek · 2023-07-18T09:11:40Z

I will send some minor patches in a separate PR.

jhrozek

The audit policy needs to be set.

rhmdnd · 2023-07-18T13:13:04Z

The audit policy needs to be set.

It was set in a previous patch, but it wasn't commented under Variable like we usually do, so I updated that to be more clear.

f7eeac7 (see line 34)

rhmdnd · 2023-07-18T13:24:41Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

Remove all the original rules and mappings we had for CIS version 1.1 and instead rely on the control files for CIS OpenShift 1.4.0 that we recently implemented.

rhmdnd · 2023-07-18T18:50:56Z

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

qlty-cloud-legacy · 2023-07-18T19:56:00Z

Code Climate has analyzed commit 632d332 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.2% (0.0% change).

View more on Code Climate.

jhrozek

/lgtm

rhmdnd requested review from Vincent056 and jhrozek July 12, 2023 20:06

marcusburghardt added the OpenShift OpenShift product related. label Jul 13, 2023

rhmdnd added the CIS CIS Benchmark related. label Jul 13, 2023

rhmdnd force-pushed the use_cis_ocp_1_4 branch from cff89e7 to c411437 Compare July 13, 2023 19:35

rhmdnd mentioned this pull request Jul 13, 2023

Implement rules for CIS OCP Section 3 #10778

Merged

rhmdnd force-pushed the use_cis_ocp_1_4 branch from c411437 to 9429f84 Compare July 13, 2023 20:03

rhmdnd force-pushed the use_cis_ocp_1_4 branch 2 times, most recently from 57e8108 to df639c0 Compare July 14, 2023 13:26

rhmdnd force-pushed the use_cis_ocp_1_4 branch from df639c0 to 8e8da49 Compare July 17, 2023 15:34

rhmdnd force-pushed the use_cis_ocp_1_4 branch from 8e8da49 to 3f8b67d Compare July 17, 2023 18:07

rhmdnd force-pushed the use_cis_ocp_1_4 branch from 3f8b67d to 4ca433c Compare July 17, 2023 19:46

rhmdnd force-pushed the use_cis_ocp_1_4 branch from 4ca433c to f7eeac7 Compare July 17, 2023 21:32

jhrozek suggested changes Jul 18, 2023

View reviewed changes

rhmdnd force-pushed the use_cis_ocp_1_4 branch 2 times, most recently from 7041bac to 57cb3e0 Compare July 18, 2023 13:11

Update CIS profiles to use control files

632d332

Remove all the original rules and mappings we had for CIS version 1.1 and instead rely on the control files for CIS OpenShift 1.4.0 that we recently implemented.

rhmdnd force-pushed the use_cis_ocp_1_4 branch from 57cb3e0 to 632d332 Compare July 18, 2023 18:50

jhrozek approved these changes Jul 19, 2023

View reviewed changes

jhrozek merged commit f91d7d1 into ComplianceAsCode:master Jul 19, 2023

yuumasato added this to the 0.1.70 milestone Jul 19, 2023

yuumasato assigned jhrozek Jul 19, 2023

Mab879 added the Update Profile Issues or pull requests related to Profiles updates. label Oct 12, 2023

Update CIS profiles to use control files #10833

Update CIS profiles to use control files #10833

Uh oh!

Conversation

rhmdnd commented Jul 12, 2023

Uh oh!

github-actions bot commented Jul 12, 2023

Uh oh!

rhmdnd commented Jul 13, 2023

Uh oh!

openshift-ci bot commented Jul 13, 2023

Uh oh!

rhmdnd commented Jul 13, 2023

Uh oh!

rhmdnd commented Jul 13, 2023

Uh oh!

rhmdnd commented Jul 13, 2023

Uh oh!

rhmdnd commented Jul 13, 2023

Uh oh!

rhmdnd commented Jul 14, 2023

Uh oh!

rhmdnd commented Jul 14, 2023

Uh oh!

jhrozek commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

rhmdnd commented Jul 17, 2023

Uh oh!

xiaojiey commented Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek commented Jul 18, 2023

Uh oh!

jhrozek left a comment

Choose a reason for hiding this comment

Uh oh!

rhmdnd commented Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhmdnd commented Jul 18, 2023

Uh oh!

rhmdnd commented Jul 18, 2023

Uh oh!

qlty-cloud-legacy bot commented Jul 18, 2023

Uh oh!

jhrozek left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

xiaojiey commented Jul 18, 2023 •

edited

Loading

rhmdnd commented Jul 18, 2023 •

edited

Loading