enhance the grub2_argument template to cover more use cases #12375

vojtapolasek · 2024-09-11T09:44:33Z

Description:

modify the OVAL check so that it better covers use cases possible in RHEL 8.
The biggest change is that the check now accepts options both directly in /boot/loader/entries/*.conf files together with options in /boot/grub2/grubenv referenced with the $kernelopts variable.
Test scenarios were also updated to verify this new case.

Rationale:

this fixes the issue https://issues.redhat.com/browse/RHEL-53365

Review Hints:

probably test all rules templated with grub2_argument

…er/entries and options in grubenv These options do not make sense separately.

… argument parsing in RHEL 8

openshift-ci · 2024-09-11T09:44:38Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2024-09-11T09:46:09Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-09-11T10:04:56Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12375
This image was built from commit: c3b668f

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12375

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12375 make deploy-local

jan-cerny

For the rule grub2_audit_argument the test scenarios arg_not_in_entries.fail.sh and wrong_value_entries.fail.sh fail on RHEL 8. It passes on RHEL 9. However, I'm surprised that these test scenarios pass for other rules that use the same template eg. grub2_spectre_v2_argument.

Can you take a look into this problem?

See the Automatus output:

jcerny@fedora:~/work/git/scap-security-guide (pr/12375)$ python3 tests/automatus.py rule --datastream build/ssg-rhel8-ds.xml  --libvirt qemu:///system ssgts_rhel8 grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-09-13-1346/test_suite.log
WARNING - Script correct_value_etcdefault_dir.pass.sh is not applicable on given platform
WARNING - Script invalid_rescue.pass.sh is not applicable on given platform
WARNING - Script correct_value_substring_right.pass.sh is not applicable on given platform
WARNING - Script correct_value_substring_left.pass.sh is not applicable on given platform
WARNING - Script correct_value_noupdate.fail.sh is not applicable on given platform
WARNING - Script arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir_noupdate.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault_dir.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault.fail.sh is not applicable on given platform
WARNING - Script correct_recovery_disabled.pass.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefaultgrub.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh is not applicable on given platform
WARNING - Script arg_not_there_grub_cfg.fail.sh is not applicable on given platform
WARNING - Script double_value_ol7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_ol7.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
INFO - Script correct_value_mix_entries_and_grubenv.pass.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub.fail.sh using profile (all) OK
ERROR - Script wrong_value_entries.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in pass, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_grub2_audit_argument'.
INFO - Script arg_not_in_grubenv_and_not_referenced.pass.sh using profile (all) OK
INFO - Script correct_value_grubenv_only.pass.sh using profile (all) OK
ERROR - Script arg_not_in_entries.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in pass, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_grub2_audit_argument'.
INFO - Script arg_not_in_grubenv_but_referenced.fail.sh using profile (all) OK
INFO - Script wrong_value_grubenv.fail.sh using profile (all) OK
INFO - Script correct_value_remediated.pass.sh using profile (all) OK
INFO - Script double_value_rhel8.fail.sh using profile (all) OK

jan-cerny · 2024-09-13T09:47:59Z

...emplates/grub2_bootloader_argument/tests/arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh

 # platform = Oracle Linux 7
-# Removes audit argument from kernel command line in /etc/default/grub
-if grep -q '^GRUB_CMDLINE_LINUX_DEFAULT=.*audit=.*"'  '/etc/default/grub' ; then
-	sed -i 's/\(^GRUB_CMDLINE_LINUX_DEFAULT=".*\)audit=[^[:space:]]*\(.*"\)/\1 \2/'  '/etc/default/grub'
+# Removes the argument from kernel command line in /etc/default/grub


This test scenario is only for Oracle Linux 7. Have you tested your change on OL 7? Would it make sense to extend the scenario to other operating systems?

I think i resolved it in the latest force push. I made most of such tests which were moved from the grub2_audit_argument applicable to all platforms because checking of /etc/default/grub is relevant for all products.

some of those scenarios were moved to the folder with template test scenarios in the previous commit Also make some scenarios applicable to all platforms. Especially those which check configuration in /etc/default/grub because these are common for all products.

jan-cerny · 2024-09-19T07:49:05Z

shared/templates/grub2_bootloader_argument/tests/correct_recovery_disabled.pass.sh

+# configure the argument in kernel command line in /boot/grub2/grubenv
+#file="/boot/grub2/grubenv"
+#if grep -q '^.*{{{ARG_NAME}}}=.*' "$file"; then
+	# modify the GRUB command-line if the arg already exists
+#	sed -i 's/\(^.*\){{{ARG_NAME}}}=[^[:space:]]*\(.*\)/\1 {{{ARG_NAME_VALUE}}} \2/'  "$file"
+#else
+	# no arg is present, append it
+#	sed -i 's/\(^.*\(vmlinuz\|kernelopts\).*\)/\1 {{{ARG_NAME_VALUE}}}/'  "$file"
+#fi
+


it probably should be removed instead of having it commented out

Fixed in the latest commit.

In the past, the script seemed to be here to help to prepare environment in containers. However, as the complexity of this template increases, I decided to rewrite the script to prepare uniform environment in any case.

codeclimate · 2024-09-20T14:04:19Z

Code Climate has analyzed commit c3b668f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

vojtapolasek · 2024-09-20T14:56:00Z

@jan-cerny I refactored tests. I rewrote the common.sh script so that it prepares a clean environment in any case. Other scenarios can be therefore simpler.

jan-cerny

The tests of rule grub2_audit_argument are passing now for RHEL 8 and RHEL 9 with both Ansible and Bash remediations.

jcerny@fedora:~/work/git/scap-security-guide (pr/12375)$  python3 tests/automatus.py rule  --libvirt qemu:///system ssgts_rhel9 --datastream build/ssg-rhel9-ds.xml grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-09-23-0927/test_suite.log
WARNING - Script correct_value_mix_entries_and_grubenv.pass.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir.pass.sh is not applicable on given platform
WARNING - Script arg_not_in_grubenv_but_referenced.fail.sh is not applicable on given platform
WARNING - Script correct_value_substring_left.pass.sh is not applicable on given platform
WARNING - Script correct_value_grubenv_only.pass.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault_dir.fail.sh is not applicable on given platform
WARNING - Script wrong_value_grubenv.fail.sh is not applicable on given platform
WARNING - Script arg_not_in_grubenv_and_not_referenced.pass.sh is not applicable on given platform
WARNING - Script correct_value_substring_right.pass.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir_noupdate.fail.sh is not applicable on given platform
WARNING - Script double_value_rhel8.fail.sh is not applicable on given platform
WARNING - Script arg_not_there_grub_cfg.fail.sh is not applicable on given platform
WARNING - Script double_value_ol7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_ol7.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
INFO - Script invalid_rescue.pass.sh using profile (all) OK
INFO - Script wrong_value_entries.fail.sh using profile (all) OK
INFO - Script correct_value_noupdate.fail.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script correct_recovery_disabled.pass.sh using profile (all) OK
INFO - Script arg_not_in_entries.fail.sh using profile (all) OK
INFO - Script wrong_value_etcdefault.fail.sh using profile (all) OK
INFO - Script correct_value_remediated.pass.sh using profile (all) OK
INFO - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12375)$  python3 tests/automatus.py rule  --libvirt qemu:///system ssgts_rhel8 --datastream build/ssg-rhel8-ds.xml grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-09-23-0932/test_suite.log
WARNING - Script correct_value_substring_right.pass.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir_noupdate.fail.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault_dir.fail.sh is not applicable on given platform
WARNING - Script invalid_rescue.pass.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir.pass.sh is not applicable on given platform
WARNING - Script correct_value_substring_left.pass.sh is not applicable on given platform
WARNING - Script arg_not_there_grub_cfg.fail.sh is not applicable on given platform
WARNING - Script double_value_ol7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_ol7.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
INFO - Script wrong_value_etcdefault.fail.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script arg_not_in_grubenv_and_not_referenced.pass.sh using profile (all) OK
INFO - Script correct_recovery_disabled.pass.sh using profile (all) OK
INFO - Script correct_value_grubenv_only.pass.sh using profile (all) OK
INFO - Script correct_value_remediated.pass.sh using profile (all) OK
INFO - Script correct_value_noupdate.fail.sh using profile (all) OK
INFO - Script arg_not_in_entries.fail.sh using profile (all) OK
INFO - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script wrong_value_grubenv.fail.sh using profile (all) OK
INFO - Script wrong_value_entries.fail.sh using profile (all) OK
INFO - Script correct_value_mix_entries_and_grubenv.pass.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub.fail.sh using profile (all) OK
INFO - Script arg_not_in_grubenv_but_referenced.fail.sh using profile (all) OK
INFO - Script double_value_rhel8.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12375)$  python3 tests/automatus.py rule  --libvirt qemu:///system ssgts_rhel9 --datastream build/ssg-rhel9-ds.xml --remediate-using ansible grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-09-23-0942/test_suite.log
WARNING - Script correct_value_substring_right.pass.sh is not applicable on given platform
WARNING - Script arg_not_in_grubenv_but_referenced.fail.sh is not applicable on given platform
WARNING - Script arg_not_in_grubenv_and_not_referenced.pass.sh is not applicable on given platform
WARNING - Script correct_value_substring_left.pass.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault_dir.fail.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir_noupdate.fail.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir.pass.sh is not applicable on given platform
WARNING - Script correct_value_grubenv_only.pass.sh is not applicable on given platform
WARNING - Script correct_value_mix_entries_and_grubenv.pass.sh is not applicable on given platform
WARNING - Script wrong_value_grubenv.fail.sh is not applicable on given platform
WARNING - Script double_value_rhel8.fail.sh is not applicable on given platform
WARNING - Script arg_not_there_grub_cfg.fail.sh is not applicable on given platform
WARNING - Script double_value_ol7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_ol7.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
INFO - Script invalid_rescue.pass.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub.fail.sh using profile (all) OK
INFO - Script wrong_value_entries.fail.sh using profile (all) OK
INFO - Script arg_not_in_entries.fail.sh using profile (all) OK
INFO - Script correct_recovery_disabled.pass.sh using profile (all) OK
INFO - Script correct_value_noupdate.fail.sh using profile (all) OK
INFO - Script correct_value_remediated.pass.sh using profile (all) OK
INFO - Script wrong_value_etcdefault.fail.sh using profile (all) OK
INFO - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12375)$  python3 tests/automatus.py rule  --libvirt qemu:///system ssgts_rhel8 --datastream build/ssg-rhel8-ds.xml --remediate-using ansible grub2_audit_argument
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-09-23-0947/test_suite.log
WARNING - Script correct_value_substring_left.pass.sh is not applicable on given platform
WARNING - Script invalid_rescue.pass.sh is not applicable on given platform
WARNING - Script wrong_value_etcdefault_dir.fail.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir_noupdate.fail.sh is not applicable on given platform
WARNING - Script correct_value_substring_right.pass.sh is not applicable on given platform
WARNING - Script correct_value_etcdefault_dir.pass.sh is not applicable on given platform
WARNING - Script arg_not_there_grub_cfg.fail.sh is not applicable on given platform
WARNING - Script double_value_ol7.fail.sh is not applicable on given platform
WARNING - Script wrong_value_ol7.fail.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_grub2_audit_argument
INFO - Script arg_not_in_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script arg_not_in_etcdefaultgrub.fail.sh using profile (all) OK
INFO - Script correct_value_mix_entries_and_grubenv.pass.sh using profile (all) OK
INFO - Script correct_recovery_disabled.pass.sh using profile (all) OK
INFO - Script wrong_value_etcdefault.fail.sh using profile (all) OK
INFO - Script correct_value_noupdate.fail.sh using profile (all) OK
INFO - Script arg_not_in_grubenv_and_not_referenced.pass.sh using profile (all) OK
INFO - Script wrong_value_grubenv.fail.sh using profile (all) OK
INFO - Script correct_value_grubenv_only.pass.sh using profile (all) OK
INFO - Script correct_value_remediated.pass.sh using profile (all) OK
INFO - Script wrong_value_etcdefaultgrub_recovery_disabled.fail.sh using profile (all) OK
INFO - Script wrong_value_entries.fail.sh using profile (all) OK
INFO - Script arg_not_in_entries.fail.sh using profile (all) OK
INFO - Script arg_not_in_grubenv_but_referenced.fail.sh using profile (all) OK
INFO - Script double_value_rhel8.fail.sh using profile (all) OK

vojtapolasek added 4 commits September 10, 2024 11:19

merge JInja booleans for checking of referenced options in /boot/load…

70e1a50

…er/entries and options in grubenv These options do not make sense separately.

modify the oval of grub2_argument template so that it is aligned with…

b4736f5

… argument parsing in RHEL 8

add test scenarios testing newly introduced OVAL tests

19c63ae

revise other test scenarios of grub2_argument template

f6e1fa3

vojtapolasek added OVAL OVAL update. Related to the systems assessments. RHEL8 Red Hat Enterprise Linux 8 product related. Update Template Issues or pull requests related to Templates updates. labels Sep 11, 2024

vojtapolasek added this to the 0.1.75 milestone Sep 11, 2024

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 11, 2024

vojtapolasek marked this pull request as ready for review September 11, 2024 09:44

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 11, 2024

vojtapolasek changed the title ~~enhancew the grub2_argument template to cover more use cases~~ enhance the grub2_argument template to cover more use cases Sep 11, 2024

jan-cerny self-assigned this Sep 13, 2024

jan-cerny requested changes Sep 13, 2024

View reviewed changes

vojtapolasek force-pushed the fix_grub2_argument_locations branch from 96fd588 to 1d6427f Compare September 18, 2024 12:38

jan-cerny reviewed Sep 20, 2024

View reviewed changes

vojtapolasek added 2 commits September 20, 2024 11:32

rewrite the common.sh helper script

09b5b00

In the past, the script seemed to be here to help to prepare environment in containers. However, as the complexity of this template increases, I decided to rewrite the script to prepare uniform environment in any case.

modify test scenarios to use the new common.sh script efficiently

c3b668f

jan-cerny approved these changes Sep 23, 2024

View reviewed changes

jan-cerny merged commit 4a8073c into ComplianceAsCode:master Sep 23, 2024
100 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

enhance the grub2_argument template to cover more use cases #12375

enhance the grub2_argument template to cover more use cases #12375

vojtapolasek commented Sep 11, 2024

openshift-ci bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024 •

edited

Loading

jan-cerny left a comment

jan-cerny Sep 13, 2024

vojtapolasek Sep 18, 2024

jan-cerny Sep 19, 2024

vojtapolasek Sep 20, 2024

codeclimate bot commented Sep 20, 2024

vojtapolasek commented Sep 20, 2024

jan-cerny left a comment

enhance the grub2_argument template to cover more use cases #12375

enhance the grub2_argument template to cover more use cases #12375

Conversation

vojtapolasek commented Sep 11, 2024

Description:

Rationale:

Review Hints:

openshift-ci bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 11, 2024 • edited Loading

jan-cerny left a comment

Choose a reason for hiding this comment

jan-cerny Sep 13, 2024

Choose a reason for hiding this comment

vojtapolasek Sep 18, 2024

Choose a reason for hiding this comment

jan-cerny Sep 19, 2024

Choose a reason for hiding this comment

vojtapolasek Sep 20, 2024

Choose a reason for hiding this comment

codeclimate bot commented Sep 20, 2024

vojtapolasek commented Sep 20, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

github-actions bot commented Sep 11, 2024 •

edited

Loading