Update PCI-DSS profile for RHEL #11267
Conversation
The profile is now consuming the pcidss_4 control file. Previous pcidss profile for RHEL 9 was based on PCI-DSSv3.2.1.
The profile is now consuming pcidss_4 control file. Previous pcidss profile for RHEL 8 was based on PCI-DSSv3.2.1.
The profile is now consuming pcidss_4 control file. Previous pcidss profile for RHEL 7 was based on PCI-DSSv3.2.1.
marcusburghardt
added
RHEL
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
There are already some few issues caught by CI tests. I will fix them before moving this PR from Draft to Ready. |
Deinition based on current presence of the rule in existing profiles and control files.
Deinition based on current presence of the rule in existing profiles and control files.
Deinition based on current presence of the rule in existing profiles and control files.
These two rules are very similar but use a different name for the service. It would be possible to unify these templated rules in the future and deprecate one of them. For now, it is only included the prodtype in both rules based on the current presence of the rule in existing profiles and control files.
Deinition based on current presence of the rule in existing profiles and control files.
Deinition based on current presence of the rule in existing profiles and control files.
This rule is used by extention in chronyd_or_ntpd_specify_multiple_servers.
Also included rhel8 cce. This rule is used by extention in chronyd_or_ntpd_specify_remote_server, chronyd_or_ntpd_specify_multiple_servers, and service_chronyd_or_ntpd_enabled, all used in rhel8.
Also included rhel8 cce. This rule is used by extention in chronyd_or_ntpd_specify_remote_server.
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@teacup-on-rockingchair and @dodys , after the third commit in this PR I included "prodtype" in some rules used by SUSE and Ubuntu. Could you take a look if you are fine with these prodtype changes, please? |
| @@ -1,5 +1,7 @@ | |||
| documentation_complete: true | |||
|
|
|||
| prodtype: fedora,ol9,rhel9,sle12,sle15,ubuntu1604,ubuntu1804,ubuntu2004 | |||
There was a problem hiding this comment.
we currently have this rule only in ubuntu2004
There was a problem hiding this comment.
Thanks. Removing these products from the product type raises some concerns:
https://complianceascode.readthedocs.io/en/latest/manual/developer/06_contributing_with_content.html#agreements
It would remove them from data streams. Is that ok for you? Otherwise we can keep them there.
There was a problem hiding this comment.
We will need to figure out something for RHEL 9 as the package doesn't exist there.
There was a problem hiding this comment.
Indeed, the package doesn't exist there. But the rule was already already in the data stream by the absence of prodtype.
There was a problem hiding this comment.
It is worth noting that the rule is not selected in any of our shipped RHEL 9 profiles as of b461247 . How about putting a comment to the rule.yaml file explaining why the rhel9 profile got there?
Error was reported by CI tests.
Reported by CI tests.
Reported by CI tests.
Include the package_audispd-plugins_installed rule used for RHEL.
Excluded the rule package_audit-audispd-plugins_installed in favor of package_audispd-plugins_installed.
The rule is only used by ubuntu2004 so the ubuntu1604 and ubuntu1804 introcuded by a previous commit were removed now.
CI tests detected the rpm_verify_permissions rule is failing after pci-dss remediation. More investigation is needed before enabling this rule. Issue ComplianceAsCode#11285
marcusburghardt
force-pushed
the
pci_dss_rhel
branch
from
5f05ba7 to
962956c
Compare
|
Code Climate has analyzed commit 962956c and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.8%. View more on Code Climate. |
|
I believe we are good now. There is one issue that can be investigated in a separate PR: #11285 |
Description:
PCI-DSS profiles for RHEL products were based on PCI-DSSv3.2.1, which will be retired in March 2024.
There was already a control file for PCI-DSSv4, which was largely reviewed and updated by #11214
In this meantime it was also enabled CI tests for PCI-DSS profile by #11257
This PR is finally updating the RHEL profiles to consume the PCI-DSSv4 control file.
Rationale:
Review Hints:
Specially the test-farm tests should be very important to detect issues
Additional tests can be executed locally with automatus.