ANSSI BP 028 profile for debian12 #11368

a-skr · 2023-12-10T15:01:28Z

Description:

Add ANSSI-BP-028 profile for Debian 12 (including remediation).

openshift-ci · 2023-12-10T15:01:39Z

Hi @a-skr. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2023-12-10T15:02:53Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

jan-cerny · 2023-12-11T10:45:45Z

linux_os/guide/system/apparmor/grub2_enable_apparmor/rule.yml

@@ -1,6 +1,6 @@
 documentation_complete: true

-prodtype: ubuntu2004,ubuntu2204
+prodtype: ubuntu2004,ubuntu2204,debian12


The prodtypes need to be alphabetically sorted. You have multiple occurrences of unsorting the prodtype key in this PR.

I didn't know that. I will fix them.

jan-cerny · 2023-12-11T11:00:29Z

...s/guide/system/software/integrity/software-integrity/aide/aide_build_database/bash/debian.sh

@@ -0,0 +1,20 @@
+# platform = multi_platform_debian
+


The OVAL checks and Ansible and Bash remediations for Debian 12 that you introduce are quite different from the existing ones that are there for other products. Consequently, the description and other texts in the rule.yml file of this rule aren't properly aligned with the actual check and remediation. Please update the linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml in a way so that it better describes the actual situation on Debian 12.

The debian description explains an interactive aide database update (through the aideinit wrapper) which, I think, is fitting.

The remedation (non interactive) uses options -y -f to automatically create then deploy the new database.

As per aideinit manpage, the user should ideally check the database content before deploying it, so I prefer a description that doesn't automatically force the deployment of the new DB.

jan-cerny · 2023-12-11T11:04:53Z

shared/templates/rsyslog_logfiles_attributes_modify/ansible.template

@@ -51,7 +51,7 @@

 - name: '{{{ rule_title }}} - Extract log files new format'
  ansible.builtin.shell: |
-    set -o pipefail
+    {{% if not 'debian' in product %}}set -o pipefail{{% endif -%}}


What is the reason for this change? I think that Ansible lint will require having the pipefail here.

The default shell in Debian for scripts is dash. dash doesn't have the pipefail option. Some operating systems (such as those based on open-embedded) may not have bash compiled in (they usually use busybox).

Alternatively, I can force bash usage in the playbook fragment.

What do you prefer?

Thanks for a great explanation.

I have found that at this moment we have in our CI relaxed this Ansible lint check to a warning, due to some other existing ules that don't have the pipefail set in their Ansible code.

content/.config/ansible-lint.yml

Lines 15 to 22 in ae3019d

warn_list:

- name[missing] # Rule for checking task and play names.

- template-instead-of-copy # Templated files should use template instead of copy

- yaml[empty-lines] # Violations reported by yamllint.

- yaml[line-length] # Violations reported by yamllint.

- name[casing] # Rule for checking task and play names.

- no-handler # Style choice, skipping for now

- risky-shell-pipe # Skipping for now due to authselect rules

Also, there is a complex discussion about it on the Ansible lint GitHub ansible/ansible-lint#497 and there is no specific outcome.

So after finding these information I would prefer to keep this if condition here as you proposed. It would be nice to add an explanatory comment to the code there.

I will add an explanation ASAP.

Change default value from system.administrator@mail.mil to change_me@localhost in case mail.mil suddenly becomes valid.

- enable remediation - fix description - add OVAL test

related macros shared/macros/10-ansible.jinja fixes: - fix name of task adding grub2 arguments - fix kernel arguments matching regexp: kernel command line arguments may be words separated by commas. The \w metacharacter doesn't match the comma, so rules like grub2_l1tf_argument fail if the ansible remediation playbook is executed a second time.

…efs rule

…heck

jan-cerny · 2023-12-12T09:38:40Z

/packit retest-failed

jan-cerny · 2023-12-13T12:27:09Z

shared/templates/rsyslog_logfiles_attributes_modify/ansible.template

 - name: '{{{ rule_title }}} - Get include files directives'
  ansible.builtin.shell: |
-    set -o pipefail
+    {{% if not 'debian' in product %}}set -o pipefail{{% endif -%}}


There is one more problem, and that is a serious one and it causes the fail of the testing farm CI jobs. On other products, this reduces the whitespace and accidentally removes the newline. For example, when you build rhel9, you will see this in the built cotnent:

set -o pipefailgrep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true

Please make sure this won't happen. Dtto for other occurrences.

It should be fixed by now.
Thank you for your patience.

The ansible remediation fragment assumes /bin/sh points to bash, which may not be the case depending on linux distribution.

…g_delete

…g_finit

…g_init

codeclimate · 2023-12-13T15:17:08Z

Code Climate has analyzed commit 2d92005 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5% (0.0% change).

View more on Code Climate.

jan-cerny

I have checked the built debian12 content and I have seen that the ANSSI BP28 profiles are present there.

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Dec 10, 2023

marcusburghardt added Debian Debian product related. ANSSI ANSSI Benchmark related. labels Dec 11, 2023

jan-cerny requested changes Dec 11, 2023

View reviewed changes

jan-cerny self-assigned this Dec 11, 2023

jan-cerny added this to the 0.1.72 milestone Dec 11, 2023

a-skr added 22 commits December 12, 2023 07:18

Add ANSSI-BP-028 minimal profile for Debian 12

43043cb

change defaut root mail alias in postfix client rule

bb329dc

Change default value from system.administrator@mail.mil to change_me@localhost in case mail.mil suddenly becomes valid.

enable remediation for Debian in postfix client rule

49254b7

enable bash remediation for Debian in package_installed template

ed0ab89

enable debian 12 in aide_build_database rule

e7b2582

- enable remediation - fix description - add OVAL test

fix package name for debian 12 in service_auditd_enabled rule

2c2a906

enable Debian bash remediation for sysctl template

c5ad145

enable Debian remediation for sshd_set_keepalive rule

5b936c2

enable debian 12 ansible remediation for accounts_maximum_age_login_d…

3284660

…efs rule

Add ANSSI-BP-028 intermediary profile for Debian 12

803982a

enable osrelease strings ending with -amd64 to pass prefer_64bit_os c…

0aec8ca

…heck

enable debian remediation in audit_rules_dac_modification template

d270703

enable debian remediation in audit_rules_file_deletion_events template

c2c9eab

enable debian remediation in audit_rules_uncuccessful_file_modification

c762b19

enable debian remediation in audit_rules_login_events

74c08bd

enable debian remediation in audit_rules_time_adjtimex

be6d8c8

enable debian remediation in audit_rules_time_clock_settime

f19e686

enable debian remediation in audit_rules_sysadmin_actions

587d724

enable debian remediation in audit_rules_immutable

afbef02

enable debian remediation in audit_rules_networkconfig_modification

130fc3b

enable debian remediation in audit_rules_session_events

675c656

enable debian remediation in audit_time_rules

09b5464

a-skr force-pushed the feature-debian12 branch from 6f1d72c to 0adab98 Compare December 12, 2023 07:29

a-skr force-pushed the feature-debian12 branch from 0adab98 to 92cc544 Compare December 12, 2023 12:14

jan-cerny requested changes Dec 13, 2023

View reviewed changes

a-skr added 13 commits December 13, 2023 15:55

escape pipefail for debian in rsyslog_logfiles_attributes_modify

e64a47e

The ansible remediation fragment assumes /bin/sh points to bash, which may not be the case depending on linux distribution.

enable debian ansible remediation in audit_rules_kernel_module_loadin…

e3aba7c

…g_delete

enable debian ansible remediation in audit_rules_kernel_module_loadin…

6dd8c65

…g_finit

enable debian ansible remediation in audit_rules_kernel_module_loadin…

1c98ac1

…g_init

enable debian ansible remediation audit_rules_privileged_commands

afbbc62

enable debian ansible remediation in audit_rules_session_events

e488314

enable all_apparmor_profiles_enforced for Debian12

a0e7cb2

enable apparmor_configured for Debian

d0702fc

enable package_apparmor_installed for Debian

8f596f9

enable grub2_enable_apparmor for Debian

3806bd4

enable package_pam_apparmor_installed for Debian

551d518

add enhanced ANSSI-BP-028 profile for Debian

056beeb

add high ANSSI-BP-028 profile for Debian

2d92005

a-skr force-pushed the feature-debian12 branch from 92cc544 to 2d92005 Compare December 13, 2023 15:01

jan-cerny approved these changes Dec 13, 2023

View reviewed changes

jan-cerny merged commit 0ed28da into ComplianceAsCode:master Dec 13, 2023
32 of 33 checks passed

vojtapolasek added Highlight This PR/Issue should make it to the featured changelog. New Profile Issues or pull requests related to new Profiles. labels Feb 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ANSSI BP 028 profile for debian12 #11368

ANSSI BP 028 profile for debian12 #11368

a-skr commented Dec 10, 2023

openshift-ci bot commented Dec 10, 2023

github-actions bot commented Dec 10, 2023

jan-cerny Dec 11, 2023

a-skr Dec 11, 2023

jan-cerny Dec 11, 2023

a-skr Dec 12, 2023

jan-cerny Dec 11, 2023

a-skr Dec 11, 2023 •

edited

Loading

jan-cerny Dec 12, 2023

a-skr Dec 12, 2023

jan-cerny commented Dec 12, 2023

jan-cerny Dec 13, 2023

a-skr Dec 13, 2023

codeclimate bot commented Dec 13, 2023

jan-cerny left a comment

	warn_list:
	- name[missing] # Rule for checking task and play names.
	- template-instead-of-copy # Templated files should use template instead of copy
	- yaml[empty-lines] # Violations reported by yamllint.
	- yaml[line-length] # Violations reported by yamllint.
	- name[casing] # Rule for checking task and play names.
	- no-handler # Style choice, skipping for now
	- risky-shell-pipe # Skipping for now due to authselect rules

ANSSI BP 028 profile for debian12 #11368

ANSSI BP 028 profile for debian12 #11368

Conversation

a-skr commented Dec 10, 2023

Description:

openshift-ci bot commented Dec 10, 2023

github-actions bot commented Dec 10, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

a-skr Dec 11, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jan-cerny commented Dec 12, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codeclimate bot commented Dec 13, 2023

jan-cerny left a comment

Choose a reason for hiding this comment

a-skr Dec 11, 2023 •

edited

Loading