Add CIS support for slmicro5

[teacup-on-rockingchair]

Description:

• Make changes to support CIS profile for slmicro5

Rationale:

• Add CIS profile scaffold support for SL Micro5 platform

• Add references and identifiers, where needed enable slmicro5 platform or configure appropriate template variables

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_db_up_to_date' differs.
--- xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
+++ xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q gdm && { rpm --quiet -q kernel; }; then
 
 dconf update
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_db_up_to_date' differs.
--- xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
+++ xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
@@ -18,7 +18,7 @@
     cmd: dconf update
   when:
   - '"gdm" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   tags:
   - CCE-81003-6
   - PCI-DSS-Req-6.2

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_dconf_db_up_to_date'
--- xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
+++ xccdf_org.ssgproject.content_rule_dconf_db_up_to_date
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_enable_dconf_user_profile'
--- xccdf_org.ssgproject.content_rule_enable_dconf_user_profile
+++ xccdf_org.ssgproject.content_rule_enable_dconf_user_profile
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing'.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
@@ -33,8 +33,8 @@
 8.3
 
 [rationale]:
-Providing an advance warning that a password will be expiring gives users 
-time to think of a secure password. Users caught unaware may choose a simple 
+Providing an advance warning that a password will be expiring gives users
+time to think of a secure password. Users caught unaware may choose a simple
 password or write it down where it may be discovered.
 
 [ident]:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { rpm --quiet -q kernel; }; then
 
 chgrp 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -24,7 +24,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   tags:
   - CCE-80800-6
   - CJIS-5.5.2.2
@@ -48,7 +48,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - CCE-80800-6

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg'
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { rpm --quiet -q kernel; }; then
 
 chown 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -24,7 +24,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   tags:
   - CCE-80805-5
   - CJIS-5.5.2.2
@@ -48,7 +48,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - CCE-80805-5

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg'
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { rpm --quiet -q kernel; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -22,7 +22,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   tags:
   - CCE-80814-7
   - NIST-800-171-3.4.5
@@ -44,7 +44,7 @@
   when:
   - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
   - '"grub2-common" in ansible_facts.packages'
-  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - '"kernel" in ansible_facts.packages'
   - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - CCE-80814-7

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg'
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_grub2_uefi_password'
--- xccdf_org.ssgproject.content_rule_grub2_uefi_password
+++ xccdf_org.ssgproject.content_rule_grub2_uefi_password
@@ -1 +1 @@
-oval:ssg-installed_env_is_a_machine:def:1
+oval:ssg-system_with_kernel:def:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_package_openldap-servers_removed' differs.
--- ocil:ssg-package_openldap-servers_removed_ocil:questionnaire:1
+++ ocil:ssg-package_openldap-servers_removed_ocil:questionnaire:1
@@ -2,6 +2,6 @@
 following command:
 $ rpm -q openldap-servers
 The output should show the following:
-package openldap-servers is not installed    
+package openldap-servers is not installed
       Is it the case that it does not?
       

[jan-cerny]

I have built the data stream for the slmicro5 product and I can see that there are reasonable CIS profiles present there. Great job!

@teacup-on-rockingchair Please consider using automatic assignment of rule references at build time based on controls file data instead of manually adding references to each rule.yml file. Using automatic reference assignment reduces data duplication, prevents inconsistencies and promotes the Control file to a primary source of truth. We are already successfully using automatic assignment of rule references in multiple RHEL profiles. Please see https://complianceascode.readthedocs.io/en/latest/manual/developer/03_creating_content.html#using-controls-for-automated-reference-assignment-to-rules. How does this sound to you?

[Mab879]

A number is missing

[teacup-on-rockingchair]

thx should be handled in latest commit

[codeclimate]

Code Climate has analyzed commit 931bc91 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

[Mab879]

Thank you!

[Mab879]

Waving Automatus since not all rules can be ran on containers.