Adapt audit_rules_suid_privilege_function for Ubuntu 24.04 CIS #12974
Conversation
|
Hi @mpurg. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
+++ xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
@@ -8,7 +8,7 @@
for ARCH in "${RULE_ARCHS[@]}"
do
ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
-
+
OTHER_FILTERS="-C uid!=euid -F euid=0"
AUID_FILTERS=""
@@ -326,7 +326,7 @@
for ARCH in "${RULE_ARCHS[@]}"
do
ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
-
+
OTHER_FILTERS="-C gid!=egid -F egid=0"
AUID_FILTERS="" |
|
/packit build |
1 similar comment
|
/packit build |
Ubuntu 24.04 CIS control 6.2.3.2 recommends that all actions as another user are logged and not only when euid=0.
3cea943 to
93dbe3b
Compare
966c6ed
into
ComplianceAsCode:stabilization-v0.1.76
Description:
Rationale:
Tests:
Ubuntu 24.04 in KVM:
WARNING - Script wrong_f_egid.fail.sh is not applicable on given platform
WARNING - Script wrong_f_euid.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
INFO - Script wrong_c_euid.fail.sh using profile (all) OK
INFO - Script wrong_c_egid.fail.sh using profile (all) OK
INFO - Script other_key.pass.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_a.fail.sh using profile (all) OK
INFO - Script use_f_key.pass.sh using profile (all) OK
INFO - Script no_rules.fail.sh using profile (all) OK
INFO - Script miss_arch.fail.sh using profile (all) OK
INFO - Script miss_c.fail.sh using profile (all) OK