RHCOS4 STIG: Cover controls that correspond to NIST AC #10727

jhrozek · 2023-06-16T11:17:36Z

Description:

OCP4 STIG: SRG-APP-000343-CTR-000780 and SRG-APP-000381-CTR-000905 are covered by audit_rules_suid_privilege_function - this one is quite easy
SRG-APP-000029-CTR-000085: Audit execution of all setuid and setgid binaries on RHCOS4 - this one is more tricky. First, there's quite a few new rules that were added because I didn't find rules equivalent to the check and fix in the STIG draft. Second, I'm not sure if this SRG is the right one to be covered by the rules - the rules are valid and should be included in the STIG, but I think that SRG-APP-000381-CTR-000905 would be better suited for these checks. But at this point I'm unsure what to do and I think we should start an epic with stories that tracks the next STIG update to shuffle things around. Finally, I think some of the rules are following the letter of "let's audit all SUID binaries", but are not really needed, e.g. the SSSD binaries are really just helpers that can't be executed by a user and the grub2 binary probably shouldn't be on RHCOS in the first place (there's no GRUB on RHCOS...)

Rationale:

RHCOS4 STIG

Review Hints:

Make sure that the e2e tests pass
Make sure that the checks and remediations are in line with the AC controls in the STIG draft. I recommend making a copy of the document, then filtering column A with any controls that start with AC and looking for MachineConfig in column I (Fix).

github-actions · 2023-06-16T11:19:25Z

Start a new ephemeral environment with changes proposed in this pull request:

rhcos4 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-06-16T11:21:06Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -286,6 +286,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -286,6 +286,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 CCI-000130
@@ -62,6 +62,9 @@
 [reference]:
 SRG-OS-000471-GPOS-00215
 
+[reference]:
+SRG-APP-000029-CTR-000085
+
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by
 authorized users, or by unauthorized external entities that have compromised system accounts,

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -286,6 +286,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check
@@ -9,12 +9,12 @@
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
 -a always,exit -F path=/usr/sbin/pam_timestamp_check
--F auid>=1000 -F auid!=unset -F key=privileged
+-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
 -a always,exit -F path=/usr/sbin/pam_timestamp_check
--F auid>=1000 -F auid!=unset -F key=privileged
+-F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -258,6 +258,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -286,6 +286,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign
@@ -260,6 +260,9 @@
 [reference]:
 SRG-OS-000471-GPOS-00215
 
+[reference]:
+SRG-APP-000029-CTR-000085
+
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by
 authorized users, or by unauthorized external entities that have compromised system accounts,

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -265,6 +265,9 @@
 
 [reference]:
 SRG-OS-000466-GPOS-00210
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 BP28(R19)
@@ -265,6 +265,9 @@
 
 [reference]:
 SRG-OS-000466-GPOS-00210
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -256,6 +256,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd'.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd
@@ -8,11 +8,11 @@
 configured to use the augenrules program to read audit rules during
 daemon startup (the default), add a line of the following form to a file with
 suffix .rules in the directory /etc/audit/rules.d:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add a line of the following
 form to /etc/audit/audit.rules:
--a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=unset -F key=privileged
+-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
 
 [reference]:
 1
@@ -307,6 +307,9 @@
 
 [reference]:
 SRG-OS-000471-GPOS-00215
+
+[reference]:
+SRG-APP-000029-CTR-000085
 
 [rationale]:
 Misuse of privileged functions, either intentionally or unintentionally by

jhrozek · 2023-06-16T13:23:41Z

@ggbecker @yuumasato I'm at loss to debug the CI issues:

ValueError: The rule 'audit_rules_privileged_commands_dbus_daemon_launch_helper' isn't mapped to any component! Insert the rule ID at least once to the rule-component mapping.

what is a rule-component mapping?

and then this test fails:

./shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_auid.fail.sh

why does it fail? What does the test do?

yuumasato · 2023-06-16T14:21:06Z

@jhrozek I'm not sure, but I think you need to add the new rules into any file in components/.
components/audit.yml seems to be the most fit.

CC @matejak and @jan-cerny

jhrozek · 2023-06-19T08:30:56Z

@jhrozek I'm not sure, but I think you need to add the new rules into any file in components/. components/audit.yml seems to be the most fit.

CC @matejak and @jan-cerny

thanks, let's see how the new CI run goes

jan-cerny · 2023-06-19T09:59:52Z

@jhrozek Yes, @yuumasato is correct, from now on the components are mandatory, that means you need to add a rule ID to a component file if you add a new rule to RHEL7, RHEL8, RHEL9 or Fedora products.

jhrozek · 2023-06-19T11:15:31Z

/test help

openshift-ci · 2023-06-19T11:15:34Z

@jhrozek: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jhrozek · 2023-06-19T11:49:17Z

/test e2e-aws-rhcos4-stig

jhrozek · 2023-06-19T13:16:03Z

RHCOS STIG CI succeeded.
@Vincent056 @rhmdnd PTAL

jhrozek · 2023-06-20T09:43:48Z

/test e2e-aws-rhcos4-stig

jhrozek · 2023-06-20T09:43:54Z

/test e2e-aws-ocp4-stig

jhrozek · 2023-06-20T09:44:08Z

/test e2e-aws-ocp4-stig-node

jhrozek · 2023-06-20T11:51:10Z

direct link to e2e test log: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/ComplianceAsCode_content/10727/pull-ci-ComplianceAsCode-content-master-e2e-aws-ocp4-stig/1671091507496488960/artifacts/e2e-aws-ocp4-stig/test/build-log.txt

jhrozek · 2023-07-04T11:53:17Z

Correct test log: https://gcsweb-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/origin-ci-test/pr-logs/pull/ComplianceAsCode_content/10727/pull-ci-ComplianceAsCode-content-master-e2e-aws-rhcos4-stig/1671091479709224960/artifacts/e2e-aws-rhcos4-stig/test/build-log.txt

controls/srg_ctr/SRG-APP-000029-CTR-000085.yml

yuumasato · 2023-07-10T09:19:33Z

/test e2e-aws-ocp4-stig

yuumasato · 2023-07-10T09:19:41Z

/test e2e-aws-ocp4-stig-node

yuumasato · 2023-07-10T09:19:52Z

/test e2e-aws-rhcos4-stig

jhrozek · 2023-07-10T14:31:44Z

/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-stig

jhrozek · 2023-07-10T14:32:02Z

/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-stig

jhrozek · 2023-07-11T07:33:15Z

lol oops I really should get into the habit of running some local checks :-)

jhrozek · 2023-07-11T08:27:47Z

/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-stig

jhrozek · 2023-07-11T10:02:55Z

Some CCEs were not unique, hopefully now all CI runs will be green

jhrozek · 2023-07-11T13:02:10Z

/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-stig

yuumasato · 2023-07-11T15:13:23Z

@jhrozek e2e passed.
Can you just add srg to audit_rules_privileged_commands_ssh_keysign, then I think we can merge.

…e covered by audit_rules_suid_privilege_function

…inaries on RHCOS4

jhrozek · 2023-07-11T19:58:20Z

@jhrozek e2e passed. Can you just add srg to audit_rules_privileged_commands_ssh_keysign, then I think we can merge.

nice catch, done

codeclimate · 2023-07-11T20:49:11Z

Code Climate has analyzed commit f5b3474 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.5% (0.0% change).

View more on Code Climate.

yuumasato · 2023-07-12T07:52:54Z

The Automatus CS8 and CS9 tests fail because some rules are only available for rhcos. Automatus Fedora is failing to prepare environment for tests, for some reason.
The rpm-build on Fedora is failing due to import imp.

jhrozek added OpenShift OpenShift product related. New Rule Issues or pull requests related to new Rules. labels Jun 16, 2023

jhrozek force-pushed the rhcos_stig_ac branch from cae7d10 to cf0ca68 Compare June 19, 2023 08:30

jhrozek force-pushed the rhcos_stig_ac branch from cf0ca68 to d2c67e3 Compare June 19, 2023 09:59

jhrozek force-pushed the rhcos_stig_ac branch from d2c67e3 to 4dc473f Compare June 19, 2023 10:30

jhrozek force-pushed the rhcos_stig_ac branch from 4dc473f to dcbf825 Compare June 20, 2023 09:00

marcusburghardt requested review from Vincent056 and rhmdnd June 22, 2023 05:19

jhrozek force-pushed the rhcos_stig_ac branch from dcbf825 to 2c548e5 Compare July 6, 2023 12:15

yuumasato self-assigned this Jul 10, 2023

yuumasato reviewed Jul 10, 2023

View reviewed changes

controls/srg_ctr/SRG-APP-000029-CTR-000085.yml Show resolved Hide resolved

jhrozek force-pushed the rhcos_stig_ac branch from 2c548e5 to 214cb03 Compare July 10, 2023 14:31

jhrozek force-pushed the rhcos_stig_ac branch from 214cb03 to e02b81d Compare July 11, 2023 08:07

jhrozek force-pushed the rhcos_stig_ac branch from e02b81d to cf18c40 Compare July 11, 2023 10:02

yuumasato added this to the 0.1.69 milestone Jul 11, 2023

jhrozek added 2 commits July 11, 2023 21:56

OCP4 STIG: SRG-APP-000343-CTR-000780 and SRG-APP-000381-CTR-000905 ar…

c66d9e5

…e covered by audit_rules_suid_privilege_function

SRG-APP-000029-CTR-000085: Audit execution of all setuid and setgid b…

f5b3474

…inaries on RHCOS4

jhrozek force-pushed the rhcos_stig_ac branch from cf18c40 to f5b3474 Compare July 11, 2023 19:58

yuumasato approved these changes Jul 12, 2023

View reviewed changes

yuumasato merged commit 52bf2bb into ComplianceAsCode:master Jul 12, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RHCOS4 STIG: Cover controls that correspond to NIST AC #10727

RHCOS4 STIG: Cover controls that correspond to NIST AC #10727

jhrozek commented Jun 16, 2023

github-actions bot commented Jun 16, 2023

github-actions bot commented Jun 16, 2023 •

edited

Loading

jhrozek commented Jun 16, 2023

yuumasato commented Jun 16, 2023 •

edited

Loading

jhrozek commented Jun 19, 2023

jan-cerny commented Jun 19, 2023

jhrozek commented Jun 19, 2023

openshift-ci bot commented Jun 19, 2023

jhrozek commented Jun 19, 2023

jhrozek commented Jun 19, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jul 4, 2023

yuumasato commented Jul 10, 2023

yuumasato commented Jul 10, 2023

yuumasato commented Jul 10, 2023

jhrozek commented Jul 10, 2023

jhrozek commented Jul 10, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

yuumasato commented Jul 11, 2023 •

edited

Loading

jhrozek commented Jul 11, 2023

codeclimate bot commented Jul 11, 2023

yuumasato commented Jul 12, 2023

RHCOS4 STIG: Cover controls that correspond to NIST AC #10727

RHCOS4 STIG: Cover controls that correspond to NIST AC #10727

Conversation

jhrozek commented Jun 16, 2023

Description:

Rationale:

Review Hints:

github-actions bot commented Jun 16, 2023

github-actions bot commented Jun 16, 2023 • edited Loading

jhrozek commented Jun 16, 2023

yuumasato commented Jun 16, 2023 • edited Loading

jhrozek commented Jun 19, 2023

jan-cerny commented Jun 19, 2023

jhrozek commented Jun 19, 2023

openshift-ci bot commented Jun 19, 2023

jhrozek commented Jun 19, 2023

jhrozek commented Jun 19, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jun 20, 2023

jhrozek commented Jul 4, 2023

yuumasato commented Jul 10, 2023

yuumasato commented Jul 10, 2023

yuumasato commented Jul 10, 2023

jhrozek commented Jul 10, 2023

jhrozek commented Jul 10, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

jhrozek commented Jul 11, 2023

yuumasato commented Jul 11, 2023 • edited Loading

jhrozek commented Jul 11, 2023

codeclimate bot commented Jul 11, 2023

yuumasato commented Jul 12, 2023

github-actions bot commented Jun 16, 2023 •

edited

Loading

yuumasato commented Jun 16, 2023 •

edited

Loading

yuumasato commented Jul 11, 2023 •

edited

Loading