Skip to content

Ensure that all rules in RHEL ANSSI have references - #13867

Merged
jan-cerny merged 1 commit into
ComplianceAsCode:masterfrom
Mab879:13857-fix
Sep 12, 2025
Merged

Ensure that all rules in RHEL ANSSI have references#13867
jan-cerny merged 1 commit into
ComplianceAsCode:masterfrom
Mab879:13857-fix

Conversation

@Mab879

@Mab879 Mab879 commented Sep 5, 2025

Copy link
Copy Markdown
Member

Description:

All rules that were only in RHEL profile files were added control then excluded from all other products. In theory the only change in the XCCDF should adding references.

Rationale:

Ensure that all rules have references.

Fixes #13857

Review Hints:

  1. Build on master and copy the ANSSI profiles using the script below to the testing data.
Script for Copying the needed files
for i in /path/to/master/build/*/profiles/anssi*; do
  product=$(echo "$i" | cut -f8 -d"/")
  store_dir="tests/data/profile_stability/$product"
  profile=$(echo "$i" | rev | cut -f1 -d"/" | rev)
  if ! [[ -d $store_dir ]]
  then
    mkdir $store_dir
    jq -r '.selections|sort[]' < "$i" > "$store_dir/$profile"
  fi
done
  1. Checkout this PR
  2. Build this branch for all RHEL products
  3. cd build
  4. Run ctest -j$(nproc) -R stable --output-on-failure and stable-profiles should pass.

@Mab879 Mab879 added this to the 0.1.79 milestone Sep 5, 2025
@Mab879
Mab879 requested a review from a team as a code owner September 5, 2025 13:00
@Mab879 Mab879 added the RHEL Red Hat Enterprise Linux product related. label Sep 5, 2025
@Mab879
Mab879 requested review from a team as code owners September 5, 2025 13:00
@Mab879 Mab879 added Update Profile Issues or pull requests related to Profiles updates. ANSSI ANSSI Benchmark related. labels Sep 5, 2025
Comment thread controls/anssi.yml Outdated
- package_audit_installed

- audit_rules_mac_modification_etc_selinux

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You need to add ldap_client_tls_cacertpath and ldap_client_start_tls to the control file.

- '!accounts_password_pam_retry'
- '!file_groupowner_etc_chrony_keys'
- accounts_password_pam_pwhistory_remember
- '!ldap_client_start_tls'

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You will also need to remove the additional selections from the RHEL 8 and RHEL 10 profiles.

Comment thread controls/anssi.yml
- sssd_ldap_configure_tls_reqcert
- sssd_ldap_start_tls
- ldap_client_start_tls
- ldap_client_tls_cacertpath

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You need to add service_chronyd_enabled, audit_rules_mac_modification_etc_selinux and no_nis_in_nsswitch to the control file as well.

@jan-cerny jan-cerny left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have built RHEL 8 and RHEL 10 data streams from this PR and I have verified that the rules listed in issue #13857 started to have the ANSSI reference present as a reference child element.

@jan-cerny

Copy link
Copy Markdown
Member

/packit build

@teacup-on-rockingchair teacup-on-rockingchair left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@jan-cerny
jan-cerny merged commit db31807 into ComplianceAsCode:master Sep 12, 2025
130 of 132 checks passed
@Mab879
Mab879 deleted the 13857-fix branch September 12, 2025 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ANSSI ANSSI Benchmark related. RHEL Red Hat Enterprise Linux product related. Update Profile Issues or pull requests related to Profiles updates.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing ANSSI references in several rules

3 participants