Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce CIS RHEL9 profiles #10091

Merged
merged 24 commits into from
Jan 20, 2023
Merged

Introduce CIS RHEL9 profiles #10091

merged 24 commits into from
Jan 20, 2023

Conversation

marcusburghardt
Copy link
Member

Description:

CIS released the CIS Red Hat Enterprise Linux 9 Benchmark v1.0.0 in 2022-11-28.
As outcome of the Benchmark review, the CIS RHEL9 controlfile was created, the proper CIS reference was included in all relevant rules and the final CIS RHEL9 profiles were updated from Draft to the final version.

Some rules, besides the CIS RHEL9 reference, might have RHEL CCEs included and the prodtype incremented.

Rationale:

Final version of CIS RHEL9 profiles.

Review Hints:

The PR is mostly about references inclusions. However, it was split in some commits aligned to the CIS Benchmark sections.

@marcusburghardt
New CIS RHEL9 control file
2b031d2 
This controlfile was based on cis_rhel8 to optimize efforts and then
reviewed to reflect the v1.0.0 version of CIS for RHEL9.
@marcusburghardt
Include CIS RHEL9 reference in partition related rules
97fc709
@marcusburghardt
Include CIS RHEL9 reference in bootloader related rules
ee7846e
@marcusburghardt
Include CIS RHEL9 reference in software updates related rules
ff0fac1
@marcusburghardt
Include CIS RHEL9 reference in fs integrity related rules
50acd0e
@marcusburghardt
Include CIS RHEL9 reference in process hardening related rules
d021c7b
@marcusburghardt
Include CIS RHEL9 reference in SELinux related rules
2bf0c81
@marcusburghardt
Include CIS RHEL9 reference in banners related rules
4b181a9
@marcusburghardt
Include CIS RHEL9 reference in GDM related rules
d0c03a8
@marcusburghardt
Include CIS RHEL9 reference in NTP related rules
01a1e8b
@marcusburghardt
Include CIS RHEL9 reference in Special Services related rules
8fdf3a3
@marcusburghardt
Include CIS RHEL9 reference in client services related rules
e3e43ad
@marcusburghardt
Include CIS RHEL9 reference in Network Config related rules
513c075
@marcusburghardt
Include CIS RHEL9 reference in Logging related rules
e3886d4
@marcusburghardt
Include CIS RHEL9 reference in AAA related rules
5545d18
@marcusburghardt
Include CIS RHEL9 reference in System Maintainance related rules
226f7a4
@marcusburghardt
Reviewed all pending requirements
bfd758d 
Many pending requriements could be satisfied by existing rules.
Some rules are relatively new but there was also cases of new
CIS RHEL9 requirements which were already included in other benchmarks
and consequently have a rule in the project.
@marcusburghardt
Update RHEL9 CIS profiles
2fd53c4 
The profiles are no longer Drafts.
@marcusburghardt marcusburghardt added RHEL9 Red Hat Enterprise Linux 9 product related. CIS CIS Benchmark related. labels Jan 19, 2023
@marcusburghardt marcusburghardt added this to the 0.1.66 milestone Jan 19, 2023
@marcusburghardt marcusburghardt requested a review from a team as a code owner January 19, 2023 13:14
@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@Mab879 Mab879 self-assigned this Jan 19, 2023
@Mab879
Copy link
Member

Mab879 commented Jan 19, 2023

I have not finished my review, but can you please add a CODEOWNERS entry for this new control file?

@marcusburghardt
Copy link
Member Author

I have not finished my review, but can you please add a CODEOWNERS entry for this new control file?

Sure. Done in the last commit.

@Mab879
Copy link
Member

Mab879 commented Jan 19, 2023

Please take a look at the output from utils/refchecker.py

$ ./utils/refchecker.py rhel9 cis_workstation_l2 cis 
Rule accounts_maximum_age_login_defs lacks required reference cis or cis@rhel9
Rule accounts_password_pam_retry lacks required reference cis or cis@rhel9
Rule accounts_passwords_pam_faillock_unlock_time lacks required reference cis or cis@rhel9
Rule configure_crypto_policy lacks required reference cis or cis@rhel9
Rule dconf_db_up_to_date lacks required reference cis or cis@rhel9
Rule enable_authselect lacks required reference cis or cis@rhel9
Rule set_password_hashing_algorithm_systemauth lacks required reference cis or cis@rhel9

@marcusburghardt
Included missing references
921197f 
Some special rules were not included in previous commits.
Also, some missing references were identified by utils/refchecker.py
script
@marcusburghardt
Remove aide_use_fips_hashes from controlfile
9fa7119 
This rule should satisfy the requirement. However, it is reporting an
error during the tests and will be included later to keep the profile
as stable as possible.
@marcusburghardt
Remove rules related to UEFI path
d09a586 
In RHEL9, the path for grub2 files were unified. Now everthying is in
/boot/grub2. The rules specific for UEFI were moved to related_rules
just for reference.
Mab879
Mab879 approved these changes Jan 19, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR! This going to great addition to the project.

@Mab879 Mab879 added Highlight This PR/Issue should make it to the featured changelog. New Profile Issues or pull requests related to new Profiles. labels Jan 19, 2023
Mab879
Mab879 requested changes Jan 20, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am working on getting PR out for a script that checks for control id vs. rule reference discrepancies. But for the time being, I will place the output of it here:

sudo_require_reauthentication cis@rhel9 5.3.6 does not match the control id 5.3.5
set_password_hashing_algorithm_systemauth cis@rhel9 5.4.4 does not match the control id 5.5.4

marcusburghardt and others added 2 commits January 20, 2023 09:03
@marcusburghardt @Mab879
Update linux_os/guide/system/software/sudo/sudo_require_reauthenticat…
3a479e1 
…ion/rule.yml

Co-authored-by: Matthew Burket <m@tthewburket.com>
@marcusburghardt @Mab879
Update linux_os/guide/system/accounts/accounts-pam/set_password_hashi…
fa29174 
…ng_algorithm/set_password_hashing_algorithm_systemauth/rule.yml

Co-authored-by: Matthew Burket <m@tthewburket.com>
@marcusburghardt
Copy link
Member Author

Thanks for the detailed review @Mab879 . I believe is everything adjusted now.

@codeclimate
Copy link

codeclimate bot commented Jan 20, 2023

Code Climate has analyzed commit fa29174 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.7% (0.0% change).

View more on Code Climate.

Mab879
Mab879 approved these changes Jan 20, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing those last issues. LGTM.

@Mab879 Mab879 merged commit f7e2b7e into ComplianceAsCode:master Jan 20, 2023
@marcusburghardt marcusburghardt deleted the cis_rhel9 branch January 20, 2023 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mab879 Mab879 Mab879 approved these changes

Assignees

@Mab879 Mab879

Labels
CIS CIS Benchmark related. Highlight This PR/Issue should make it to the featured changelog. New Profile Issues or pull requests related to new Profiles. RHEL9 Red Hat Enterprise Linux 9 product related.
Projects
None yet
Milestone
0.1.66
Development

Successfully merging this pull request may close these issues.
2 participants
@marcusburghardt @Mab879