Introduce secure_boot & kernel_uek cpes and use them in sysctl_kernel_kexec_load_disabled

[Xeicker]

Description:

• Introduce secure_boot cpe
• Introduce kernel_uek cpe
• Add these cpes in platform of sysctl_kernel_kexec_load_disabled for OL8

Rationale:

• This is to comply with latest DISA STIG V1R7 applicability text in OL08-00-010372 requirement

Note: For OL 8 systems using the Oracle Unbreakable Enterprise Kernel (UEK) Release 6 or above and with secureboot enabled, this requirement is not applicable.

References

Since the secure_boot CPE could be polemical I share my reasoning to implement it in that way. The efivar is formed by attributes bytes + var value bytes [1] and the secure boot has to have a 1 in last byte for enabled and a 0 for disabled [2]. So the only byte expected to change is the value, this way the hash should be a good indicator of the system having the secureboot enabled

[1] - https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
[2] - https://docs.kernel.org/filesystems/efivarfs.html

[openshift-ci]

Hi @Xeicker. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit 9021f78 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.2% (0.0% change).

View more on Code Climate.

[mildas]

/packit retest-failed

[mildas]

/packit retest-failed

[jan-cerny]

I have tried to build the content and I have seen the resolved platform file and checked test_kernel_uek and secure_boot_enabled in the generated SCAP source data stream.

[jan-cerny]

The CI fail on Rawhide is caused by numpy and isn't related to the contents of this PR.