Skip to content

Commit 0ed2a47

Browse files
compscomps
committed
add a fedora-cis sanity test using Packit / Testing Farm
The .packit.yaml code churn is due to me renaming tests/tmt-plans to tests/tmt and then having a /plans/ and /tests/ under it, for tmt-specific plans and (fmf) tests. Signed-off-by: Jiri Jaburek <comps@nomail.dom>
1 parent ec4d15c commit 0ed2a47

6 files changed

Lines changed: 213 additions & 29 deletions

File tree

‎.packit.yaml‎

Lines changed: 35 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ jobs:
2626
- &test-static-checks
2727
job: tests
2828
trigger: pull_request
29-
fmf_path: tests/tmt-plans
29+
fmf_path: tests/tmt
3030
identifier: /static-checks
31-
tmt_plan: /static-checks$
31+
tmt_plan: /plans/contest/static-checks$
3232
targets:
3333
centos-stream-8: {}
3434
centos-stream-9: {}
@@ -38,95 +38,101 @@ jobs:
3838

3939
- <<: *test-static-checks
4040
identifier: /rpmbuild-ctest-fedora
41-
tmt_plan: /rpmbuild-ctest-fedora$
41+
tmt_plan: /plans/contest/rpmbuild-ctest-fedora$
4242
targets:
4343
fedora-all: {}
4444
- <<: *test-static-checks
4545
identifier: /hardening/host-os/ansible/anssi_bp28_high
46-
tmt_plan: /hardening/host-os/ansible/anssi_bp28_high$
46+
tmt_plan: /plans/contest/hardening/host-os/ansible/anssi_bp28_high$
4747
- <<: *test-static-checks
4848
identifier: /hardening/host-os/ansible/ccn_advanced
49-
tmt_plan: /hardening/host-os/ansible/ccn_advanced$
49+
tmt_plan: /plans/contest/hardening/host-os/ansible/ccn_advanced$
5050
targets:
5151
centos-stream-9: {}
5252
- <<: *test-static-checks
5353
identifier: /hardening/host-os/ansible/cis
54-
tmt_plan: /hardening/host-os/ansible/cis$
54+
tmt_plan: /plans/contest/hardening/host-os/ansible/cis$
5555
- <<: *test-static-checks
5656
identifier: /hardening/host-os/ansible/cis_server_l1
57-
tmt_plan: /hardening/host-os/ansible/cis_server_l1$
57+
tmt_plan: /plans/contest/hardening/host-os/ansible/cis_server_l1$
5858
- <<: *test-static-checks
5959
identifier: /hardening/host-os/ansible/cis_workstation_l1
60-
tmt_plan: /hardening/host-os/ansible/cis_workstation_l1$
60+
tmt_plan: /plans/contest/hardening/host-os/ansible/cis_workstation_l1$
6161
- <<: *test-static-checks
6262
identifier: /hardening/host-os/ansible/cis_workstation_l2
63-
tmt_plan: /hardening/host-os/ansible/cis_workstation_l2$
63+
tmt_plan: /plans/contest/hardening/host-os/ansible/cis_workstation_l2$
6464
- <<: *test-static-checks
6565
identifier: /hardening/host-os/ansible/cui
66-
tmt_plan: /hardening/host-os/ansible/cui$
66+
tmt_plan: /plans/contest/hardening/host-os/ansible/cui$
6767
targets:
6868
centos-stream-8: {}
6969
centos-stream-9: {}
7070
- <<: *test-static-checks
7171
identifier: /hardening/host-os/ansible/e8
72-
tmt_plan: /hardening/host-os/ansible/e8$
72+
tmt_plan: /plans/contest/hardening/host-os/ansible/e8$
7373
- <<: *test-static-checks
7474
identifier: /hardening/host-os/ansible/hipaa
75-
tmt_plan: /hardening/host-os/ansible/hipaa$
75+
tmt_plan: /plans/contest/hardening/host-os/ansible/hipaa$
7676
- <<: *test-static-checks
7777
identifier: /hardening/host-os/ansible/ism_o
78-
tmt_plan: /hardening/host-os/ansible/ism_o$
78+
tmt_plan: /plans/contest/hardening/host-os/ansible/ism_o$
7979
- <<: *test-static-checks
8080
identifier: /hardening/host-os/ansible/ospp
81-
tmt_plan: /hardening/host-os/ansible/ospp$
81+
tmt_plan: /plans/contest/hardening/host-os/ansible/ospp$
8282
- <<: *test-static-checks
8383
identifier: /hardening/host-os/ansible/pci-dss
84-
tmt_plan: /hardening/host-os/ansible/pci-dss$
84+
tmt_plan: /plans/contest/hardening/host-os/ansible/pci-dss$
8585
- <<: *test-static-checks
8686
identifier: /hardening/host-os/ansible/stig
87-
tmt_plan: /hardening/host-os/ansible/stig$
87+
tmt_plan: /plans/contest/hardening/host-os/ansible/stig$
8888

8989
- <<: *test-static-checks
9090
identifier: /hardening/host-os/oscap/anssi_bp28_high
91-
tmt_plan: /hardening/host-os/oscap/anssi_bp28_high$
91+
tmt_plan: /plans/contest/hardening/host-os/oscap/anssi_bp28_high$
9292
- <<: *test-static-checks
9393
identifier: /hardening/host-os/oscap/ccn_advanced
94-
tmt_plan: /hardening/host-os/oscap/ccn_advanced$
94+
tmt_plan: /plans/contest/hardening/host-os/oscap/ccn_advanced$
9595
targets:
9696
centos-stream-9: {}
9797
- <<: *test-static-checks
9898
identifier: /hardening/host-os/oscap/cis
99-
tmt_plan: /hardening/host-os/oscap/cis$
99+
tmt_plan: /plans/contest/hardening/host-os/oscap/cis$
100100
- <<: *test-static-checks
101101
identifier: /hardening/host-os/oscap/cis_server_l1
102-
tmt_plan: /hardening/host-os/oscap/cis_server_l1$
102+
tmt_plan: /plans/contest/hardening/host-os/oscap/cis_server_l1$
103103
- <<: *test-static-checks
104104
identifier: /hardening/host-os/oscap/cis_workstation_l1
105-
tmt_plan: /hardening/host-os/oscap/cis_workstation_l1$
105+
tmt_plan: /plans/contest/hardening/host-os/oscap/cis_workstation_l1$
106106
- <<: *test-static-checks
107107
identifier: /hardening/host-os/oscap/cis_workstation_l2
108-
tmt_plan: /hardening/host-os/oscap/cis_workstation_l2$
108+
tmt_plan: /plans/contest/hardening/host-os/oscap/cis_workstation_l2$
109109
- <<: *test-static-checks
110110
identifier: /hardening/host-os/oscap/cui
111-
tmt_plan: /hardening/host-os/oscap/cui$
111+
tmt_plan: /plans/contest/hardening/host-os/oscap/cui$
112112
targets:
113113
centos-stream-8: {}
114114
centos-stream-9: {}
115115
- <<: *test-static-checks
116116
identifier: /hardening/host-os/oscap/e8
117-
tmt_plan: /hardening/host-os/oscap/e8$
117+
tmt_plan: /plans/contest/hardening/host-os/oscap/e8$
118118
- <<: *test-static-checks
119119
identifier: /hardening/host-os/oscap/hipaa
120-
tmt_plan: /hardening/host-os/oscap/hipaa$
120+
tmt_plan: /plans/contest/hardening/host-os/oscap/hipaa$
121121
- <<: *test-static-checks
122122
identifier: /hardening/host-os/oscap/ism_o
123-
tmt_plan: /hardening/host-os/oscap/ism_o$
123+
tmt_plan: /plans/contest/hardening/host-os/oscap/ism_o$
124124
- <<: *test-static-checks
125125
identifier: /hardening/host-os/oscap/ospp
126-
tmt_plan: /hardening/host-os/oscap/ospp$
126+
tmt_plan: /plans/contest/hardening/host-os/oscap/ospp$
127127
- <<: *test-static-checks
128128
identifier: /hardening/host-os/oscap/pci-dss
129-
tmt_plan: /hardening/host-os/oscap/pci-dss$
129+
tmt_plan: /plans/contest/hardening/host-os/oscap/pci-dss$
130130
- <<: *test-static-checks
131131
identifier: /hardening/host-os/oscap/stig
132-
tmt_plan: /hardening/host-os/oscap/stig$
132+
tmt_plan: /plans/contest/hardening/host-os/oscap/stig$
133+
134+
- <<: *test-static-checks
135+
identifier: fedora-cis
136+
tmt_plan: /plans/fedora-cis$
137+
targets:
138+
fedora-all: {}

tests/tmt-plans/.fmf/version renamed to tests/tmt/.fmf/version

File renamed without changes.

tests/tmt-plans/main.fmf renamed to tests/tmt/plans/contest.fmf

File renamed without changes.

‎tests/tmt/plans/fedora-cis.fmf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
discover:
2+
how: fmf
3+
test: /tests/fedora-cis
4+
execute:
5+
how: tmt
6+
report:
7+
how: html

‎tests/tmt/tests/fedora-cis/main.fmf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
summary: Runs oscap remediation using the CIS profile
2+
description: |-
3+
This ensures that the CIS profile is in a fairly good condition on Fedora,
4+
to be used for ComplyTime demos, and as a baseline profile for the community
5+
to target if they choose to adapt the ComplyTime tooling.
6+
test: ./test.sh
7+
duration: 1h
8+
require:
9+
- openscap-scanner
10+
- openscap-report
11+
- scap-security-guide

‎tests/tmt/tests/fedora-cis/test.sh‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
#!/bin/bash
2+
#
3+
# THIS TEST IS DESTRUCTIVE AND RE-BOOTS THE SYSTEM MULTIPLE TIMES,
4+
#
5+
# To be run via TMT, a test execution tool, see
6+
# https://tmt.readthedocs.io/en/stable/
7+
#
8+
9+
persistent_store=/var/tmp/test-fedora-cis
10+
11+
orig_ds=/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml
12+
ds="$persistent_store/ds.xml"
13+
14+
rules_to_unselect=(
15+
#
16+
# CONTENT ISSUES
17+
#
18+
19+
# possibly https://github.com/ComplianceAsCode/content/issues/12740
20+
aide_build_database
21+
aide_check_audit_tools
22+
23+
# possibly fails because there is no /tmp in fstab?
24+
mount_option_tmp_noexec
25+
26+
# probably needs 'cronie' on Fedora:
27+
# No match for argument: cron
28+
package_cron_installed
29+
service_crond_enabled
30+
31+
# remediation fails with:
32+
# ssh_keys is not a defined group on the system
33+
file_groupownership_sshd_private_key
34+
35+
# remediations fail without any output
36+
'audit_[a-zA-Z0-9_]*'
37+
38+
# remediation exits with:
39+
# No suitable fix found.
40+
auditd_data_disk_error_action
41+
auditd_data_disk_full_action
42+
43+
#
44+
# TESTING FARM ENVIRONMENT ISSUES
45+
#
46+
47+
# this is a mandatory prerequisite for TMT
48+
package_rsync_removed
49+
50+
# we can't really remediate partitioning layout on Testing Farm
51+
'partition_for_[a-zA-Z0-9_]*'
52+
53+
# likely caused by Testing Farm specific 'test' user
54+
accounts_password_last_change_is_in_past
55+
ensure_pam_wheel_group_empty
56+
use_pam_wheel_group_for_su
57+
58+
# /mnt/scratchspace on Testing Farm
59+
dir_perms_world_writable_sticky_bits
60+
61+
#
62+
# CONTEST (TEST SUITE) ISSUES
63+
#
64+
65+
# avoid this globally, so we don't have to change passwords
66+
# or call 'chage' in every type of remediation
67+
accounts_password_set_max_life_existing
68+
accounts_password_set_max_life_root
69+
70+
# also just allow root without -oPermitRootLogin=yes hacks
71+
sshd_disable_root_login
72+
sshd_disable_root_password_login
73+
74+
#
75+
# RULES WITHOUT AUTOMATED REMEDIATION
76+
#
77+
grub2_password
78+
sshd_limit_user_access
79+
)
80+
81+
function fatal {
82+
printf 'error: %s\n' "$*" >&2
83+
exit 1
84+
}
85+
86+
function + {
87+
local rc
88+
{ set -x; } 2>/dev/null
89+
"$@"
90+
{ rc=$?; set +x; } 2>/dev/null
91+
return $rc
92+
}
93+
94+
function unselect {
95+
local ds="$1" rules=("${@:2}")
96+
local rule e_args=()
97+
for rule in "${rules[@]}"; do
98+
e_args+=(-e "/<xccdf-1.2:select idref=\"xccdf_org.ssgproject.content_rule_${rule}\" /s/selected=\"true\"/selected=\"false\"/")
99+
done
100+
+ sed "${e_args[@]}" "$ds" || fatal "unselect sed failed"
101+
}
102+
103+
case "$TMT_REBOOT_COUNT" in
104+
0)
105+
echo "Creating $persistent_store"
106+
+ rm -rf "$persistent_store"
107+
+ mkdir -p "$persistent_store"
108+
109+
echo "Unselecting problematic rules"
110+
+ unselect "$orig_ds" "${rules_to_unselect[@]}" > "$ds"
111+
112+
echo "First remediation before reboot"
113+
+ oscap xccdf eval --profile cis --remediate --progress \
114+
--results-arf "$persistent_store/remediation-arf.xml" \
115+
"$ds"
116+
[[ $? -eq 0 || $? -eq 2 ]] || fatal "oscap failed to remediate"
117+
+ tmt-reboot
118+
;;
119+
1)
120+
echo "Second remediation"
121+
+ oscap xccdf eval --profile cis --remediate --progress \
122+
--results-arf "$persistent_store/remediation2-arf.xml" \
123+
"$ds"
124+
[[ $? -eq 0 || $? -eq 2 ]] || fatal "oscap failed to remediate"
125+
+ tmt-reboot
126+
;;
127+
2)
128+
echo "Final scan"
129+
+ oscap xccdf eval --profile cis --progress \
130+
--results-arf "$persistent_store/scan-arf.xml" \
131+
--report "$persistent_store/report.html" \
132+
"$ds"
133+
oscap_rc=$?
134+
135+
echo "Rendering first remediation via oscap-report"
136+
+ oscap-report \
137+
"$persistent_store/remediation-arf.xml" \
138+
> "$persistent_store/remediation.html"
139+
140+
echo "Packing results"
141+
+ gzip -9 "$persistent_store"/*.xml
142+
+ mv -v "$persistent_store"/* "$TMT_TEST_DATA/."
143+
+ rm -rf "$persistent_store"
144+
145+
case "$oscap_rc" in
146+
0) ;;
147+
2)
148+
fatal "some checks failed, see report.html"
149+
;;
150+
*)
151+
fatal "oscap failed to scan"
152+
;;
153+
esac
154+
;;
155+
*)
156+
fatal "TMT_REBOOT_COUNT undefined, not running under TMT?"
157+
;;
158+
esac
159+
160+
exit 0

0 commit comments

Comments
 (0)