Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update create_scap_delta_tailoring and apply it to OL8 build #12684

Merged
merged 2 commits into from
Dec 10, 2024

Conversation

Xeicker
Copy link
Contributor

@Xeicker Xeicker commented Dec 6, 2024

Description:

  • Update cmake to also create default tailoring as RHEL does. This is a tailoring file that includes all the rules not included in DISA benchmark
  • Update the script that creates this tailoring profile as it had a bug when multiple rules cover the same STIG ID
  • Also the script had an issue that added all rules to the tailoring profile instead of only the ones that wanted to remove

Rationale:

  • Add this tailoring file to OL8 rpm
  • The pythons script was removing rules of stig profile using the tailoring file, that shouldn't be removed

Review Hints:

I executed this:

## Obtain the stig ids present in the benchmark
$ grep -oP "(?<=>)OL08-00-\d{6}(?=<)" shared/references/disa-stig-ol8-v2r2-xccdf-scap.xml | sort | uniq > covered_ids.txt
## Obtain removed stig ids:
$ grep 'selected="false"' build/ol8/tailoring/ol8_stig_delta_tailoring.xml | grep -oP "(?<=xccdf_org.ssgproject.content_rule_).*?(?=\")" | xargs -i grep -oP "OL08-00-\d{6}" build/ol8/rules/{}.yml | sort | uniq > tailored_ids.txt

## Verified that there aren't stig_ids removed that aren't covered in the benchmark
$ comm -23 tailored_ids.txt covered_ids.txt

Before this update the rules harden_sshd_macs_openssh_conf_crypto_policy and harden_sshd_macs_opensshserver_conf_crypto_policy where removed even when the STIG id OL08-00-010290 is not covered in the DISA benchmark

Handle case when stig ids covered by multiple rules
Update "selected" comparison to use strings, previously was comparing
bool to string

Signed-off-by: Edgar Aguilar <[email protected]>
@Xeicker Xeicker added Infrastructure Our content build system Oracle Linux Oracle Linux product related. labels Dec 6, 2024
@Xeicker Xeicker added this to the 0.1.76 milestone Dec 6, 2024
Copy link

github-actions bot commented Dec 6, 2024

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

codeclimate bot commented Dec 6, 2024

Code Climate has analyzed commit 226ba2b and detected 1 issue on this pull request.

Here's the issue category breakdown:

Category Count
Style 1

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

@Mab879 Mab879 self-assigned this Dec 6, 2024
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@Mab879 Mab879 merged commit dcdfb39 into ComplianceAsCode:master Dec 10, 2024
105 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Infrastructure Our content build system Oracle Linux Oracle Linux product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants