implement section 5 rules of CIS Benchmark for OpenShift with "count" function #6529
Comments
|
I think count function of OVAL dictionary can be used, but current yamlfile content test does not support including additional elements like count. @evgenyz Could you help us embed |
|
Okay, so you want to count how many elements of the array were returned in the object Here is the test (variable test I know that OVAL can be brain-damaging, don't hesitate to ask for explanation. Also, are you sure that it is a good idea to count array elements? <ind-def:variable_test version="1" id="oval:0:tst:6" check="all">
<ind-def:object object_ref="oval:0:obj:7"/>
<ind-def:state state_ref="oval:0:ste:7"/>
</ind-def:variable_test>
<ind-def:variable_object version="1" id="oval:0:obj:7">
<ind-def:var_ref>oval:0:var:4</ind-def:var_ref>
</ind-def:variable_object>
<ind-def:variable_state version="1" id="oval:0:ste:7">
<ind-def:var_ref>oval:0:var:4</ind-def:var_ref>
<ind-def:value>4</ind-def:value>
</ind-def:variable_state>
<local_variable comment="var" datatype="int" version="1" id="oval:0:var:4">
<count>
<object_component object_ref="oval:ssg-object_kubelet_configure_tls_cipher_suites_ingresscontroller:obj:1" item_field="value" record_field="#"/>
</count>
</local_variable> |
|
@evgenyz Thank you, I'm now clearer about how I can use the count function. items:
- apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: admin
rules:
- apiGroups:
- packages.operators.coreos.com
resources:
- packagemanifests
verbs:
- '*'
- apiGroups:
- admissionregistration.k8s.io
resources:
- mutatingwebhookconfigurations
verbs:
- '*'
...I think the rule should count the number of wildcard rules and warn user if the number excesses some threshold. $ curl -H "Authorization: Bearer $(oc whoami -t)" "https://$(KUBE_API_SERVER)/apis/rbac.authorization.k8s.io/v1/clusterroles" | jq .items[].rules[].verbs[] | sort | uniq -c
28 "*"
...My strategy was:
To get wildcard roles using template:
name: yamlfile_value
vars:
ocp_data: "true"
filepath: 'apis/rbac.authorization.k8s.io/v1/clusterroles'
yamlpath: ".items[:].rules[:].verbs[:]"
values:
- value: '\*'
operation: 'pattern match'Before adding counting function, I tried to run this check. Result is: the API resource collector fails to save multiple template:
name: yamlfile_value
vars:
ocp_data: "true"
filepath: '/apis/rbac.authorization.k8s.io/v1/clusterroles/admin'
yamlpath: ".rules[61].verbs[0]"
values:
- value: '\*'
operation: 'pattern match'Do you or your colleagues know how to solve this multiple-resource collection issue? |
|
There are two issues on Compliance Operator to implement section 5.x rules. 1. Error when multiple rules attempt to collect all resources of a typeAssume that there are two rules and they attempt to collect following resources.
When rule 1 is performed, the resource is stored in 2. Error when null entry exists in map/list retrievalWith {
"items": [
{
"rules": [
{
"verbs": [
"read"
]
}
]
},
{
"rules": null
}
]
}In my understanding, we need to update Compliance Operator. Does anyone know the way to avoid these errors? or do I need to propose enhancements to Compliance Operator? |
|
In theory yaml probe could be adjusted to treat What are the results for |
|
It may be an empty array (map) for |
marcusburghardt
added
OpenShift
|
@yuumasato is this still valid |
|
Not sure if this exact issue is valid, but it is still relevant. |
Which products and profiles does the rule apply to?
Describe the configuration setting enforced by this rule.
Rules in section 5 of CIS Benchmark for Kubernetes (OpenShift) (Control 5.1.2-5.1.4, 5.2.1-5.2.9) which require counting the number of elements in YAML files. Count the number of elements, and compare them with predefined constants.
Why is the configuration security relevant?
The numbers of the configurations should be minimized to reduce security risks; for example, the grater number of wildcard role (section 5.1.3) indicates higher security risk.
How to check the configuration?
Get resources of kubernetes, count the number of specific elements in the resources and check whether the number is grater than a predefined constant value.
Is it order dependent? (does it need to be at certain place in the file?)
No.
What is correct and incorrect syntax?
(N/A)
How to remediate
(TBD; Automated remediation is difficult)
Does any command need to be run?
api-resource-collectorof Compliance Operator will be used to fetch kubernetes resources.Are there going to be other rules like this one in the future? Is it worth creating template? (similar configuration format, similar remediation process...)
Yes; a number of rules may use this type of rule.
Are there any caveats to be considered when testing?
(TBD)
Is the configuration loaded directly by the or is it stored in some intermediate database (similar to dconf)?
api-resource-collectorof Compliance Operator can load the configurations.Is it possible to check / remediate this configuration in offline mode? (scanning containers or offline systems)
No
Please provide security policy references if possible e.g. STIG
CIS Benchmark for Kubernetes (OpenShift)
The text was updated successfully, but these errors were encountered: