Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement workaround for broken file-traversing rules on Ubuntu 24.04 #12959

Merged
merged 6 commits into from
Feb 4, 2025
Merged

Implement workaround for broken file-traversing rules on Ubuntu 24.04 #12959

merged 6 commits into from
Feb 4, 2025

Conversation

mpurg
Copy link
Contributor

@mpurg mpurg commented Feb 2, 2025

Description:

  • Disable OVALs which produce false positives on Ubuntu 24.04:
    • file_permissions_unauthorized_world_writable
    • file_permissions_ungroupowned
    • no_files_unowned_by_user
    • audit_rules_privileged_commands
  • Implement SCE checks

Rationale:

mpurg added 6 commits February 2, 2025 10:29
@mpurg
Override OVAL for file_permissions_unauthorized_world_writable with SCE
3dbb225 
This is a temporary workaround for the broken partition probe in
Ubuntu 24.04 (oscap 1.3.9) which results in the OVAL always
returning true. Bug: OpenSCAP/openscap#2026
@mpurg
Override OVAL for file_permissions_ungroupowned with SCE
8e26f63 
This is a temporary workaround for the broken partition probe in
Ubuntu 24.04 (oscap 1.3.9) which results in the OVAL always
returning true. Bug: OpenSCAP/openscap#2026
@mpurg
Override OVAL for no_files_unowned_by_user with SCE
698c6fe 
This is a temporary workaround for the broken partition probe in
Ubuntu 24.04 (oscap 1.3.9) which results in the OVAL always
returning true. Bug: OpenSCAP/openscap#2026
@mpurg
Override OVAL for audit_rules_privileged_commands with SCE
cb34291 
This is a temporary workaround for the broken partition probe in
Ubuntu 24.04 (oscap 1.3.9) which results in the OVAL always
returning true. Bug: OpenSCAP/openscap#2026
@mpurg
Enable audit_rules_privileged_commands tests on Ubuntu
a327998
@mpurg
Disable tests not applicable to Ubuntu
b8dbc83
@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Feb 2, 2025
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Feb 2, 2025

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@codeclimate CodeClimate
Copy link

codeclimate bot commented Feb 2, 2025

Code Climate has analyzed commit b8dbc83 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

@jan-cerny jan-cerny added this to the 0.1.76 milestone Feb 3, 2025
@jan-cerny jan-cerny self-assigned this Feb 3, 2025
jan-cerny added a commit to jan-cerny/scap-security-guide that referenced this pull request Feb 3, 2025
@jan-cerny
Fix processing platform key in SCE
3d0ec02 
During review of PR ComplianceAsCode#12959 we discovered a bug that SCE checks don't
propagate to the built SCAP data stream if the `platform` key in SCE
header specifies platform using a full product name. We will fix this
problem by reusing the function used for processing `platform` key in
remediation files. That will ensure the behavior in SCE will be the same
as in remediations. The unit test data will be extended so that the test
would fail if this bug isn't fixed.
@jan-cerny jan-cerny mentioned this pull request Feb 3, 2025
Merged
jan-cerny
jan-cerny reviewed Feb 3, 2025
View reviewed changes
...ditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/sce/ubuntu.sh
@@ -0,0 +1,33 @@
#!/usr/bin/env bash
# platform = Ubuntu 24.04
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The SCE check is dropped during the build and isn't part of the built data stream. I have found that it's a bug in processing the platform key by our build system. I have opened a PR that attempts to fix this bug. #12961

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch, thanks for the fix!

@jan-cerny jan-cerny merged commit c4c41e0 into ComplianceAsCode:master Feb 4, 2025
91 of 100 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes

Assignees

@jan-cerny jan-cerny

Labels
needs-ok-to-test Used by openshift-ci bot.
Projects
None yet
Milestone
0.1.76
Development

Successfully merging this pull request may close these issues.
2 participants
@mpurg @jan-cerny