Add auid criteria to rules related to syscall audit rules

[Xeicker]

Description:

• Added the auid criteria: -F auid>=1000 -F auid!=unset. To the rules audit_rules_kernel_module_loading_init, audit_rules_kernel_module_loading_finit and audit_rules_kernel_module_loading_delete

Rationale:

• This is to make those rules compliant with DISA's STIG requirementes OL08-00-030360, OL08-00-030380 and OL08-00-030390 for ol8; and RHEL-08-030360 and RHEL-08-030390 for rhel8

[openshift-ci]

Hi @Xeicker. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete' differs:
--- old datastream
+++ new datastream
@@ -13,7 +13,9 @@
 do
 ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
 OTHER_FILTERS=""
- AUID_FILTERS=""
+ 
+ AUID_FILTERS="-F auid>=1000 -F auid!=unset"
+ 
 SYSCALL="delete_module"
 KEY="modules"
 SYSCALL_GROUPING="delete_module"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete' differs:
--- old datastream
+++ new datastream
@@ -50,7 +50,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -95,7 +95,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -104,7 +105,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -120,7 +122,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -139,7 +141,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -148,7 +151,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -183,7 +187,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -228,7 +232,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -237,7 +242,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -253,7 +259,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -272,7 +278,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -281,7 +288,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit' differs:
--- old datastream
+++ new datastream
@@ -13,7 +13,9 @@
 do
 ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
 OTHER_FILTERS=""
- AUID_FILTERS=""
+ 
+ AUID_FILTERS="-F auid>=1000 -F auid!=unset"
+ 
 SYSCALL="finit_module"
 KEY="modules"
 SYSCALL_GROUPING="init_module finit_module"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit' differs:
--- old datastream
+++ new datastream
@@ -52,7 +52,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -97,7 +97,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -106,7 +107,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -124,7 +126,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -143,7 +145,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -152,7 +155,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -189,7 +193,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -234,7 +238,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -243,7 +248,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -261,7 +267,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -280,7 +286,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -289,7 +296,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present

bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init' differs:
--- old datastream
+++ new datastream
@@ -13,7 +13,9 @@
 do
 ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
 OTHER_FILTERS=""
- AUID_FILTERS=""
+ 
+ AUID_FILTERS="-F auid>=1000 -F auid!=unset"
+ 
 SYSCALL="init_module"
 KEY="modules"
 SYSCALL_GROUPING="init_module finit_module"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init' differs:
--- old datastream
+++ new datastream
@@ -52,7 +52,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -97,7 +97,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -106,7 +107,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -124,7 +126,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -143,7 +145,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -152,7 +155,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -189,7 +193,7 @@
 find:
 paths: /etc/audit/rules.d
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: '*.rules'
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -234,7 +238,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -243,7 +248,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present
@@ -261,7 +267,7 @@
 find:
 paths: /etc/audit
 contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
- -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
+ -S |,)\w+)* -F auid>=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
 patterns: audit.rules
 register: find_command
 loop: '{{ (syscall_grouping + syscalls) | unique }}'
@@ -280,7 +286,8 @@
 lineinfile:
 path: '{{ audit_file }}'
 regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
- | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
+ | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid>=1000 -F auid!=unset (?:-k
+ |-F key=)\w+)
 line: \1\2\3{{ missing_syscalls | join("\3") }}\4
 backrefs: true
 state: present
@@ -289,7 +296,8 @@
 - name: Add the audit rule to {{ audit_file }}
 lineinfile:
 path: '{{ audit_file }}'
- line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=module-change
+ line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid>=1000
+ -F auid!=unset -F key=module-change
 create: true
 mode: o-rwx
 state: present

[vojtapolasek]

/ok-to-test

[JAORMX]

/ok-to-test

[ggbecker]

I'm pushing for this change to be applied as well for STIG EL7. This way we don't need the jinja macros and it makes the content more accurate. Unfortunately the change takes some time to propagate so we will need to live with these ifs for some time.

[vojtapolasek]

/retest

[vojtapolasek]

Hello, thank you for the changes, they look sane.
However, it would be good if you could modify tests as well. You will have to create another set of tests. One will be for OL8 and RHEL8, other will be for the rest.
You can see example of such tests here:
https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/auditing/grub2_audit_argument/tests
Notice the

# platform = Red Hat Enterprise Linux 7

and similar lines at the top of test scenarios.

[Xeicker]

Hello, thank you for the changes, they look sane. However, it would be good if you could modify tests as well. You will have to create another set of tests. One will be for OL8 and RHEL8, other will be for the rest. You can see example of such tests here: https://github.com/ComplianceAsCode/content/tree/master/linux_os/guide/system/auditing/grub2_audit_argument/tests Notice the

# platform = Red Hat Enterprise Linux 7

and similar lines at the top of test scenarios.

I was considering to use JINJA instead, as in https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/service_enabled.fail.sh

Because in this case there are many platforms that should be included in previous tests and only RHEL8 and OL8 for the new ones. So the JINJA approach would be easier

[vojtapolasek]

OK, that is a solution as well. Let's try and see.

[vojtapolasek]

/retest

[vojtapolasek]

Hello,
thank you for tests. There is one more thing to get done - test scenarios have to account for the case when the directory /etc/audit/rules.d does not exist. Can you add some condition at the begining of scenarios to create it?
Thank you.

[vojtapolasek]

/retest

[vojtapolasek]

/retest

[vojtapolasek]

I am approving this. thank you for all the changes. the failing tests are not related to the rules you have modified, it might be problemin the algorithm which selects rules to test.
Let's wait for the Openshift CI.

[openshift-ci]

@Xeicker: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-high	c0ae24e	link	true	/test e2e-aws-rhcos4-high
ci/prow/e2e-aws-rhcos4-moderate	c0ae24e	link	true	/test e2e-aws-rhcos4-moderate

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[vojtapolasek]

There are temporary problems with Openshift CI and rule modifications do not touch OCP content. Merging.