Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test typical OS usage after remediation #65

Open
mildas opened this issue Aug 28, 2023 · 1 comment
Open

Test typical OS usage after remediation #65

mildas opened this issue Aug 28, 2023 · 1 comment

Comments

@mildas
Copy link
Contributor

mildas commented Aug 28, 2023

On hardened system, perform typical OS commands as:

  • restart some services (systemctl)
  • add/remove unix user
  • perform denied actions (trigger AVCs)
  • etc.

The idea:

  1. Remediate system
  2. Perform some of the tasks
  3. Scan the system and confirm it passes

The reasons are to check if system is sane and to check typical OS usage doesn't break hardening.

@comps
Copy link
Contributor

comps commented Feb 26, 2024

This should probably also include logging in as a regular unprivileged user.
https://issues.redhat.com/browse/RHEL-24450

Also, we'll have to come up with some way of utilizing our existing /hardening tests for this, ie.

  • add some "hooks" functionality, which other tests (library?) can use to register at specific breakpoints of the hardening test(s), to run extra code on specific places
  • use the hardening tests as context managers (somehow), so other tests can import them and add extra code between the final post-remediation scan and resources being freed (VM undefined)

Or something like that.

Or maybe just some "test typical usage" function in lib that gets executed from all /hardening tests, though I don't like increasing the result scope of the hardening tests (adding non-rule results to TMT results).

Either way, we shouldn't re-run the hardening tests just to run something extra, we should re-use the state they set up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants