Improve Rsyslog rules to support RainerScript syntax #12010

jan-cerny · 2024-05-20T15:48:24Z

Description:

Improve OVAL checks so that the rule will pass if the modern Rainer script syntax is used. Up until now these rules passed only when the legacy configuration is used.

This changes OVAL in the following rules:

rsyslog_cron_logging
rsyslog_encrypt_offload_actionsendstreamdriverauthmode
rsyslog_encrypt_offload_actionsendstreamdrivermode
rsyslog_encrypt_offload_defaultnetstreamdriver

For more details, please read commit messages of all commits.

Rationale:

Fixes: https://issues.redhat.com/browse/RHEL-1816

We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax, so-called Rainer script, is used to configure cron logging. We will allow both forms. We will use the current form in the remediation. Resolves: RHEL-1816

…driverauthmode We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

…drivermode We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

…driver We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

github-actions · 2024-05-20T15:50:27Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-05-20T15:53:24Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_cron_logging'.
--- xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
+++ xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
@@ -7,7 +7,10 @@
 cron job status. If cron is not logging to rsyslog, it
 can be implemented by adding the following to the RULES section of
 /etc/rsyslog.conf:
+If the legacy syntax is used:
 cron.*                                                  /var/log/cron
+If the modern syntax (RainerScript) is used:
+cron.* action(type="omfile" file="/var/log/cron")
 
 [reference]:
 1

OVAL for rule 'xccdf_org.ssgproject.content_rule_rsyslog_cron_logging' differs.
--- oval:ssg-rsyslog_cron_logging:def:1
+++ oval:ssg-rsyslog_cron_logging:def:1
@@ -1,3 +1,5 @@
 criteria OR
 criterion oval:ssg-test_cron_logging_rsyslog:tst:1
+criterion oval:ssg-test_cron_logging_rsyslog_rainer:tst:1
 criterion oval:ssg-test_cron_logging_rsyslog_dir:tst:1
+criterion oval:ssg-test_cron_logging_rsyslog_dir_rainer:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_rsyslog_cron_logging' differs.
--- ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1
+++ ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1
@@ -2,5 +2,7 @@
 run the following command:
 grep -rni "cron\.\*" /etc/rsyslog.*
 cron.*                                                  /var/log/cron
+or
+cron.* action(type="omfile" file="/var/log/cron")
       Is it the case that cron is not logging to rsyslog?
       
New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode'.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
@@ -10,6 +10,11 @@
 encrypt and off-load auditing.
 
 When using rsyslogd to off-load logs the remote system must be authenticated.
+
+Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
+$ActionSendStreamDriverAuthMode x509/name
+Alternatively, use the RainerScript syntax:
+action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")
 
 [reference]:
 CCI-001851

OVAL for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode' differs.
--- oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1
+++ oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1
@@ -1,4 +1,6 @@
 criteria AND
 criteria OR
 criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_rainer:tst:1
 criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir_rainer:tst:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode'.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
@@ -10,6 +10,12 @@
 encrypt and off-load auditing.
 
 When using rsyslogd to off-load logs off a encrpytion system must be used.
+
+Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
+$ActionSendStreamDriverMode 1
+
+Alternatively, use the RainerScript syntax:
+action(type="omfwd" ... StreamDriverMode="1")
 
 [reference]:
 CCI-001851

OVAL for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode' differs.
--- oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1
+++ oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1
@@ -1,4 +1,6 @@
 criteria AND
 criteria OR
 criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_rainer:tst:1
 criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir_rainer:tst:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver'.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
@@ -10,6 +10,12 @@
 encrypt and off-load auditing.
 
 When using rsyslogd to off-load logs off an encryption system must be used.
+
+Set the following configuration option in /etc/rsyslog.conf or in a file in /etc/rsyslog.d (using legacy syntax):
+$DefaultNetstreamDriver gtls
+
+Alternatively, use the RainerScript syntax:
+global(DefaultNetstreamDriver="gtls")
 
 [reference]:
 CCI-001851

OVAL for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver' differs.
--- oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1
+++ oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1
@@ -1,4 +1,6 @@
 criteria AND
 criteria OR
 criterion oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_rainer:tst:1
 criterion oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1
+criterion oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir_rainer:tst:1

github-actions · 2024-05-20T15:55:18Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12010
This image was built from commit: e5bfb40

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12010

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12010 make deploy-local

marcusburghardt

Besides the comments in specific files, the remediation for rule rsyslog_cron_logging is not working when the /etc/rsyslog.conf file is deleted, more specifically in the test scenario no_rsyslog_file.fail.sh. After the remediation, the rsyslog service can't be started. This issue was not introduced by this PR, but was revealed now. Could you take a look on it, please?

...de/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/oval/shared.xml

..._rsyslog_log_file_configuration/rsyslog_cron_logging/tests/cron_set_rainer_rsyslog_d.pass.sh

...og_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/oval/shared.xml

...og_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/oval/shared.xml

...syslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml

Files in /etc/rsyslog.d should have the .conf extension: From rsyslog.conf: \# Include all config files in /etc/rsyslog.d/ include(file="/etc/rsyslog.d/*.conf" mode="optional")

jan-cerny · 2024-05-27T15:51:17Z

@marcusburghardt

Besides the comments in specific files, the remediation for rule rsyslog_cron_logging is not working when the /etc/rsyslog.conf file is deleted, more specifically in the test scenario no_rsyslog_file.fail.sh. After the remediation, the rsyslog service can't be started. This issue was not introduced by this PR, but was revealed now. Could you take a look on it, please?

Isn't the test scenario no_rsyslog_file.fail.sh stupid? It completely deletes the configuration files. I don't know if we can expect that the remediation for the rule will restore the configuration file and configure all other options that aren't directly mentioned in the rule.

marcusburghardt · 2024-05-28T06:35:52Z

rsyslog_cron_logging

Yes, I agree this test scenario is very weak. It is fine to remove the files in /etc/rsyslog.d but is not fine to remove the whole rsyslog.conf. The test scenario no_cron_logging.fail.sh seems enough to me.

Perhaps, just to keep a test without rsyslog.d files, we could just rename the no_rsyslog_file.fail.sh to no_rsyslog_d_files.fail.sh with a content similar to this:

#!/bin/bash

rm -rf /etc/rsyslog.d
sed -i '/^[[:space:]]*cron\.\*/d' /etc/rsyslog.conf

marcusburghardt

Thanks @jan-cerny . It is much better after using variables for regex. Nice!!
I only suggested some comments to align the name of this rsyslog syntax to the official documentation: RainerScript

Once we solve the test scenario issue I believe we are good to merge.

...de/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/oval/shared.xml

..._os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml

...syslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/oval/shared.xml

The test scenario deleted the configuration file and that caused the service to not start. We can't expect that the remediation of a single rule will restore all other configuration option. Instead, the test scenario will be changed to only remove the configuration option but keep the configuration file.

jan-cerny · 2024-05-28T08:28:42Z

/retest

jan-cerny · 2024-05-28T08:29:38Z

I have changed and renamed the test scenario no_rsyslog_file.fail.sh. I have changed occurrences to RainerScript.

Rsyslog isn't installed by default. Missing header caused all test scenarios evaluated as notapplicable on some test back ends.

codeclimate · 2024-05-28T11:36:52Z

Code Climate has analyzed commit e5bfb40 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

marcusburghardt

Nice work. Thanks

jan-cerny added 4 commits May 20, 2024 15:39

Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…

9b191b8

…driverauthmode We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

Add Rainer script support to rsyslog_encrypt_offload_actionsendstream…

0e418bc

…drivermode We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

Add Rainer script support to rsyslog_encrypt_offload_defaultnetstream…

847a9c0

…driver We extend the OVAL check so that it will also pass if the Rsyslog's modern syntax Rainer script has been used. Resolves: RHEL-1816

jan-cerny added bugfix Fixes to reported bugs. OVAL OVAL update. Related to the systems assessments. labels May 20, 2024

jan-cerny added this to the 0.1.74 milestone May 20, 2024

marcusburghardt self-assigned this May 22, 2024

marcusburghardt requested changes May 27, 2024

View reviewed changes

jan-cerny added 9 commits May 27, 2024 16:46

Extract regex to a Jinja variable

5786c4a

Add .conf extension to the configuration files

65a6ea4

Files in /etc/rsyslog.d should have the .conf extension: From rsyslog.conf: \# Include all config files in /etc/rsyslog.d/ include(file="/etc/rsyslog.d/*.conf" mode="optional")

Extract legaxy regex

a035ce2

Extract regexes to a variable

6cb73c7

Update rule description with the Rainer script syntax

66d0a44

Update rule description with Rainer script syntax

846e2fa

Extract regexes to variables

85ab249

Extract regexes to variables

48aab45

Update rule description with Rainer script syntax

768762d

marcusburghardt requested changes May 28, 2024

View reviewed changes

jan-cerny added 2 commits May 28, 2024 10:16

Use correct name of RainerScript

d8157f5

jan-cerny added 2 commits May 28, 2024 11:39

Ensure the directories are set up

4da9bdb

Add packages header to the test scenarios

e5bfb40

Rsyslog isn't installed by default. Missing header caused all test scenarios evaluated as notapplicable on some test back ends.

marcusburghardt approved these changes May 28, 2024

View reviewed changes

marcusburghardt merged commit 4718919 into ComplianceAsCode:master May 28, 2024
112 of 113 checks passed

marcusburghardt changed the title ~~Improve Rsyslog rules to support Rainer script syntax~~ Improve Rsyslog rules to support RainerScript syntax May 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve Rsyslog rules to support RainerScript syntax #12010

Improve Rsyslog rules to support RainerScript syntax #12010

jan-cerny commented May 20, 2024

github-actions bot commented May 20, 2024

github-actions bot commented May 20, 2024 •

edited

Loading

github-actions bot commented May 20, 2024 •

edited

Loading

marcusburghardt left a comment

jan-cerny commented May 27, 2024

marcusburghardt commented May 28, 2024

marcusburghardt left a comment

jan-cerny commented May 28, 2024

jan-cerny commented May 28, 2024

codeclimate bot commented May 28, 2024

marcusburghardt left a comment

Improve Rsyslog rules to support RainerScript syntax #12010

Improve Rsyslog rules to support RainerScript syntax #12010

Conversation

jan-cerny commented May 20, 2024

Description:

Rationale:

github-actions bot commented May 20, 2024

github-actions bot commented May 20, 2024 • edited Loading

github-actions bot commented May 20, 2024 • edited Loading

marcusburghardt left a comment

Choose a reason for hiding this comment

jan-cerny commented May 27, 2024

marcusburghardt commented May 28, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

jan-cerny commented May 28, 2024

jan-cerny commented May 28, 2024

codeclimate bot commented May 28, 2024

marcusburghardt left a comment

Choose a reason for hiding this comment

github-actions bot commented May 20, 2024 •

edited

Loading

github-actions bot commented May 20, 2024 •

edited

Loading