Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Profile to V1R6 #2

Merged
merged 100 commits into from
Dec 9, 2022
Merged

Update Profile to V1R6 #2

merged 100 commits into from
Dec 9, 2022

Conversation

aaronlippold
Copy link
Member

@aaronlippold aaronlippold commented Nov 23, 2022 •
edited by HackerShark
Loading

Changelog

TODO Items

--

New Controls from V1R1 - > V1R6

  • SV ...
  • SV ...

Updates

  • Merged in base work from community partners
  • Linted controls and profile to follow current standards
  • Updated README

Enhancements

  • Added container aware logic for containers for Not Applicable
    • Then sub-logic for community edition, ubuntu Pro FIPS 140-2 builds etc
  • Added logic to know when we are on the Community Edition vs the Ubuntu Pro with FIPS 140-2 modules etc
  • ...

Fixes

  • Used core resources when possible
  • ...

@aaronlippold aaronlippold added the enhancement New feature or request label Nov 23, 2022
em-c-rod
em-c-rod reviewed Nov 28, 2022
View reviewed changes
Copy link

@em-c-rod em-c-rod left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Preliminary review on several controls. Left some comments and questions. Has this profile been run against the target? If so, can the results be posted in this PR? Also, whether in this PR or another, we should add a GitHub workflow to run the profile.

controls/SV-238196.rb Outdated
impact 0.5
tag severity: "medium "
tag gtitle: "SRG-OS-000002-GPOS-00002 "
tag gid: "V-238196 "
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should the gid be updated to SV or is it correct to have V-? Also, is it fine to have spaces at the end of the tags?

controls/SV-238198.rb Outdated
# banner_text = input('banner_text')
# clean_banner = banner_text.gsub(/[\r\n\s]/, '')
# gdm3_defaults_file="/etc/gdm3/greeter.dconf-defaults"
# describe 'The SSHD Banner is set to the standard banner and has the correct text' do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this commented out?

controls/SV-238210.rb Outdated
it { should be_installed }
end

describe sshd_config do
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For another control that looks at a config file, first there is a check if config_file_exists. Is this a situation where this logic should also be encapsulated to make sure the thing it is checking exists and we don't have errors?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The resources themselves should do this an bubble up an error if the object was not found, you can check the file resource or file_reader utility to see if this is in there by default

HackerShark and others added 21 commits November 28, 2022 12:28
@HackerShark
changing logic to use grub config resource
6b38fa9 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
updating logic, putting quotes around numbers in case command line re…
9fd9788 
…turns a number to better handle the logic loop. Using parse_config_file resource rather than file resource.

Signed-off-by: HackerShark <[email protected]>
@HackerShark
developed new controls logic for new controls. Moved config files loc…
da7a4e8 
…ation to inputs where it made sense.

Signed-off-by: HackerShark <[email protected]>
@HackerShark
added new inputs for controls
ca28d42 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
added new inputs for controls
14fb9a6 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
updating control logic to fix profile error
a0906a8 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
removed miscellaneous character that was stopping control from running
3310f6e 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
fixed typo
f4eea60 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
updating README
7115042 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
fixed linting issues
77ae270 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
added containerized logic
927e7c0 
Signed-off-by: HackerShark <[email protected]>
@HackerShark
added fips logic and containerized logic, also updated inspec.yml and…
cac07d4 
… added an inputs.yml file

Signed-off-by: HackerShark <[email protected]>
@aaronlippold @wdower
Started adding test-kitchen testing
af2fe01 
Signed-off-by: GitHub <[email protected]>
@HackerShark @wdower
updating gitignore to not upload pem files. Created github workflow f…
8519a92 
…iles

Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
commenting out vanilla logic until vanilla playbook is created
3944bb1 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
adding ec2 workflow
c03c600 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
updating yaml file extension to yml
901ad8f 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
deleting old yaml file
dee8f30 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
removing vanilla until vanilla playbook is created
ef6a6b1 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
fixing naming of json file
11051a9 
Signed-off-by: HackerShark <[email protected]>
@HackerShark @wdower
fixing naming convention across the profile
1df7a74 
Signed-off-by: HackerShark <[email protected]>
aaronlippold and others added 19 commits December 8, 2022 12:10
@aaronlippold
moving away from pip to repo install
6c73fc5 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
upddated playbook for bug in conditional, added missing variable, mov…
dbdf5c3 
…ed off pip3 ansible install

Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
updated the ansible verbosity to be less detailed
1a5a5fc 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
updated vanilla threshold to account for current errors
26a47c2 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
updated vagrant testing to only run on release
1b88b74 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
ensured that all the kictchen files run as sudo, updated the FIPS con…
b921f19 
…trols to better use inputs.

Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
Updating profile.json in the repository
75fb020
@aaronlippold
resolved all profile errors for ec2 and container, excluded a couple …
5cd74e6 
…more controls in the container context, fixed a few control style issues, updated all thresholds for current values

Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
Updating profile.json in the repository
2909a91
@aaronlippold
added suggested fix to ansible, ran cookstyle -a. added fips awarenes…
bb1240d 
…s for NA conditions, small style fixes

Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
Updating profile.json in the repository
adb6a47
@aaronlippold
fixed missing input defn
6a7450e 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
Updating profile.json in the repository
8f9d763
@aaronlippold
updated local and github actions to create Markdown reports
a4db7f1 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
debugging markdown report workflows
1cd0822 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
updated scripts to be less complicated
7f763a5 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
started adding host,container tags
7ce7ece 
Signed-off-by: Aaron Lippold <[email protected]>
@aaronlippold
Updating profile.json in the repository
f9bf8a9
@HackerShark
adding file that lists which controls are applicable and not applicab…
2ffc7f8 
…le for containers

Signed-off-by: HackerShark <[email protected]>
@aaronlippold aaronlippold changed the title Refactor and Rebase to the current V1R6 Update Profile to V1R6 Dec 9, 2022
georgedias
georgedias reviewed Dec 9, 2022
View reviewed changes
container.hardened.threshold.yml
@@ -0,0 +1,3 @@
---
compliance.min: 48
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I notice that issue #8 addresses this low value

@wdower
Copy link
Contributor

wdower commented Dec 9, 2022

This PR has snowballed into something unwieldy, since we did the kitchen implementation in the same branch we were doing the profile update in.

However, the profile is in a better state after this update than it was before, and the new Test Kitchen pipeline is not reporting any broken tests. We should merge this into main, rebranch, and continue refining the tests.

LGTM for now

@wdower wdower closed this Dec 9, 2022
@wdower wdower reopened this Dec 9, 2022
@wdower wdower merged commit 886f7be into main Dec 9, 2022
@wdower wdower deleted the ubuntu-updates branch December 9, 2022 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@em-c-rod em-c-rod em-c-rod left review comments

@wdower wdower wdower approved these changes

@georgedias georgedias georgedias approved these changes

Assignees

@HackerShark HackerShark

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@aaronlippold @wdower @georgedias @em-c-rod @HackerShark