From fe7cc53e13cdc612ef67a7ba39e1cac3e4b45ea5 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:46:50 +0200 Subject: [PATCH 01/14] Add OCP Virt rules to STIG control CNTR-OS-000090 Map 4 OpenShift Virtualization rules to CNTR-OS-000090 (RBAC access controls) per DISA STIG V2R6 which added OCP Virt checks for seccomp profile permissions, cache directory permissions, migration tools RBAC, and nested virtualization. Rules added: - kubevirt-restrict-migration-tools-access (manual) - kubevirt-nested-virtualization-disabled (OVAL, node) - kubevirt-seccomp-profile-permissions (file_permissions, node) - kubevirt-cache-directory-permissions (file_permissions, node) Closes: CMP-4294, CMP-4295, CMP-4296, CMP-4297 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 24c278e48ff4..8235fcbdc5f9 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -120,6 +120,10 @@ controls: title: OpenShift RBAC access controls must be enforced. rules: - rbac_least_privilege + - kubevirt-restrict-migration-tools-access + - kubevirt-nested-virtualization-disabled + - kubevirt-seccomp-profile-permissions + - kubevirt-cache-directory-permissions status: automated - id: CNTR-OS-000100 From e12ec9b0dcc70828aff0f050668920455685484e Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:47:16 +0200 Subject: [PATCH 02/14] Add OCP Virt rules to STIG control CNTR-OS-000100 Map 2 OpenShift Virtualization rules to CNTR-OS-000100 (network policy enforcement) per DISA STIG V2R6 which added OCP Virt checks for SR-IOV spoofchk and Bridge CNI MAC-spoof filtering. Rules added: - kubevirt-sriov-spoofchk-on (CEL) - kubevirt-bridge-mac-spoof-filtering (CEL) Closes: CMP-4298 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 8235fcbdc5f9..4c83053e9b01 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -134,6 +134,8 @@ controls: rules: - configure_network_policies - configure_network_policies_namespaces + - kubevirt-sriov-spoofchk-on + - kubevirt-bridge-mac-spoof-filtering status: automated - id: CNTR-OS-000110 From 35731d3132e145b56b974ecc03cbdbdb5d0873c7 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:48:02 +0200 Subject: [PATCH 03/14] Add OCP Virt rule to STIG control CNTR-OS-000110 Map OpenShift Virtualization rule to CNTR-OS-000110 (approved authorizations for information flow) per DISA STIG V2R6 which added a check that downward metrics must be disabled on HyperConverged CR. Rules added: - kubevirt-downward-metrics-disabled (CEL) Closes: CMP-4299, CMP-4300 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 4c83053e9b01..419e4c1185a1 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -145,6 +145,7 @@ controls: the container platform based on organization-defined information flow control policies. rules: - project_config_and_template_network_policy + - kubevirt-downward-metrics-disabled status: automated - id: CNTR-OS-000130 From e3defaaece7e695105ff57d716c731b0b0dfd090 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:48:41 +0200 Subject: [PATCH 04/14] Add OCP Virt rule to STIG control CNTR-OS-000150 Map OpenShift Virtualization rule to CNTR-OS-000150 (audit records for auditable events) per DISA STIG V2R6 which added a check that VM disk errorPolicy must not be set to "ignore". Rules added: - kubevirt-disk-error-policy-not-ignore (CEL) Closes: CMP-4301 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 419e4c1185a1..3c1cfb0188c5 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -168,6 +168,7 @@ controls: rules: - audit_profile_set - service_auditd_enabled + - kubevirt-disk-error-policy-not-ignore status: automated - id: CNTR-OS-000160 From e1e687e53aed1707c9fca56418c244d820c5b950 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:49:21 +0200 Subject: [PATCH 05/14] Add OCP Virt rule to STIG control CNTR-OS-000400 Map OpenShift Virtualization rule to CNTR-OS-000400 (disable root and terminate network connections) per DISA STIG V2R6 which added a check that the nonRoot feature gate must be enabled on HyperConverged CR. Rules added: - kubevirt-nonroot-feature-gate-is-enabled (CEL) Closes: CMP-4302 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 3c1cfb0188c5..42a7aa3d518a 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -462,6 +462,7 @@ controls: rules: - oauth_or_oauthclient_inactivity_timeout - sshd_disable_root_login + - kubevirt-nonroot-feature-gate-is-enabled status: automated - id: CNTR-OS-000430 From 73659c6af88b14fe2a3b8bef483eb437bbdd43b8 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:49:51 +0200 Subject: [PATCH 06/14] Add OCP Virt rule to STIG control CNTR-OS-000500 Map OpenShift Virtualization rule to CNTR-OS-000500 (separate user functionality from management) per DISA STIG V2R6 which added a check to restrict VNC access via token.kubevirt.io:generate rolebinding. Rules added: - kubevirt-restrict-vnc-access-to-workloads (manual) Closes: CMP-4303 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 42a7aa3d518a..ceea5f3b240f 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -539,7 +539,8 @@ controls: - medium title: OpenShift must separate user functionality (including user interface services) from information system management functionality. - rules: [] + rules: + - kubevirt-restrict-vnc-access-to-workloads notes: >- Satisfies SRG-APP-000211-CTR-000530. We cannot have an automated check for this rule at the moment. From 56f19bcb0bdcfda25dfafaaa2c3b1755b75c8948 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:50:18 +0200 Subject: [PATCH 07/14] Add OCP Virt rules to STIG control CNTR-OS-000560 Map 3 OpenShift Virtualization rules to CNTR-OS-000560 (prevent unauthorized info transfer via shared resources) per DISA STIG V2R6 which added checks for persistent reservation, shareable disks, and KSM. Rules added: - kubevirt-persistent-reservation-disabled (CEL) - kubevirt-no-shareable-disks (CEL) - kubevirt-ksm-disabled (CEL) Closes: CMP-4304, CMP-4305, CMP-4306 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index ceea5f3b240f..42091b293386 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -578,6 +578,9 @@ controls: - coreos_vsyscall_kernel_argument - sysctl_kernel_dmesg_restrict - sysctl_kernel_perf_event_paranoid + - kubevirt-persistent-reservation-disabled + - kubevirt-no-shareable-disks + - kubevirt-ksm-disabled status: automated - id: CNTR-OS-000570 From 076828ee6871a9f54d76f2c9f56508e95e048a70 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:50:45 +0200 Subject: [PATCH 08/14] Add OCP Virt rule to STIG control CNTR-OS-000740 Map OpenShift Virtualization rule to CNTR-OS-000740 (prevent installation of unverified patches) per DISA STIG V2R6 which added a check for jsonpatch annotations on HyperConverged CR. Rules added: - kubevirt-no-jsonpatch-annotations (CEL) Closes: CMP-4307 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 42091b293386..7c417bf27d66 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -728,6 +728,7 @@ controls: rules: - cluster_version_operator_exists - cluster_version_operator_verify_integrity + - kubevirt-no-jsonpatch-annotations status: automated - id: CNTR-OS-000760 From ac8cb88e29ca69bc4d24ceb3d7339a27ba013801 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:51:07 +0200 Subject: [PATCH 09/14] Add OCP Virt rule to STIG control CNTR-OS-001020 Map OpenShift Virtualization rule to CNTR-OS-001020 (disable USB storage kernel module) per DISA STIG V2R6 which added a check that no permitted host devices are configured on HyperConverged CR. Rules added: - kubevirt-no-permitted-host-devices (CEL) Closes: CMP-4308 Co-Authored-By: Claude Opus 4.6 --- controls/stig_ocp4.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/stig_ocp4.yml b/controls/stig_ocp4.yml index 7c417bf27d66..be34b0eeb4d7 100644 --- a/controls/stig_ocp4.yml +++ b/controls/stig_ocp4.yml @@ -1071,6 +1071,7 @@ controls: - service_sshd_disabled - service_usbguard_enabled - usbguard_allow_hid_and_hub + - kubevirt-no-permitted-host-devices status: automated - id: CNTR-OS-001030 From e0488663a9b205c7dbb75e85efc3e0f2a3b19c8d Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 01:57:42 +0200 Subject: [PATCH 10/14] Add stig-virt CEL profile for OCP Virtualization STIG checks Creates a new profile that selects all kubevirt rules from the STIG control file using filter_rules, following the same pattern as the existing stig/stig-node profile split. The scanner_type: CEL ensures this profile is excluded from XCCDF data streams and only appears in CEL content output. Co-Authored-By: Claude Opus 4.6 --- products/ocp4/profiles/stig-virt.profile | 25 ++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 products/ocp4/profiles/stig-virt.profile diff --git a/products/ocp4/profiles/stig-virt.profile b/products/ocp4/profiles/stig-virt.profile new file mode 100644 index 000000000000..2dae02f8914f --- /dev/null +++ b/products/ocp4/profiles/stig-virt.profile @@ -0,0 +1,25 @@ +--- +documentation_complete: true + +metadata: + version: V2R6 + SMEs: + - Vincent056 + - rhmdnd + - yuumasato + - abushkin-redhat + +reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip + +title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Virtualization Extension' + +description: |- + This profile contains CEL-based checks for OpenShift Virtualization + that align to the DISA STIG for Red Hat OpenShift Container Platform 4. + +scanner_type: CEL + +filter_rules: '"kubevirt" in id_' + +selections: + - stig_ocp4:all From 8ff7a2b4209f31650c1ba85826ba3b92ba0dc8d5 Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 02:12:27 +0200 Subject: [PATCH 11/14] Fix XCCDF build crash when profiles select CEL-only rules Rules with only CEL checks (cel/shared.yml, no OVAL or template) are excluded from the XCCDF rule tree but can still be selected by XCCDF profiles via control files. get_variables_of_rules() crashed with TypeError because dict.get() returned None for these rules. Default to an empty set since CEL-only rules have no XCCDF variables. Co-Authored-By: Claude Opus 4.6 --- ssg/build_yaml.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssg/build_yaml.py b/ssg/build_yaml.py index e16d21c81a35..743281107c7e 100644 --- a/ssg/build_yaml.py +++ b/ssg/build_yaml.py @@ -698,7 +698,7 @@ def get_variables_of_rules(profiles, rule_ids, rules_and_variables_dict): """ selected_variables = set() for rule in rule_ids: - selected_variables.update(rules_and_variables_dict.get(rule)) + selected_variables.update(rules_and_variables_dict.get(rule, set())) for profile in profiles: selected_variables.update(profile.variables.keys()) return selected_variables From f2b319d95557eb51a64a699ee56b6842334699ab Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 14:06:02 +0200 Subject: [PATCH 12/14] Exclude node kubevirt rules from stig-virt CEL profile Node kubevirt rules are already automated in the stig-node XCCDF profile, so exclude them from the stig-virt CEL profile to avoid showing them as manual. Co-Authored-By: Claude Opus 4.6 --- products/ocp4/profiles/stig-virt.profile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/products/ocp4/profiles/stig-virt.profile b/products/ocp4/profiles/stig-virt.profile index 2dae02f8914f..4bad76278932 100644 --- a/products/ocp4/profiles/stig-virt.profile +++ b/products/ocp4/profiles/stig-virt.profile @@ -19,7 +19,8 @@ description: |- scanner_type: CEL -filter_rules: '"kubevirt" in id_' +# Exclude node kubevirt rules — those are automated in the stig-node XCCDF profile +filter_rules: '"kubevirt" in id_ and "ocp4-node" not in platforms' selections: - stig_ocp4:all From ac70d17bad47fedc4053e7549adc1363b32ef20c Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 14:44:49 +0200 Subject: [PATCH 13/14] Add versioned stig-virt-v2r6 snapshot profile Split stig-virt into a versioned snapshot (stig-virt-v2r6) with the actual selections and filter, and a tip profile (stig-virt) that extends it. Follows the same pattern as the stig/stig-node platform split. Co-Authored-By: Claude Opus 4.6 --- products/ocp4/profiles/stig-virt-v2r6.profile | 26 +++++++++++++++++++ products/ocp4/profiles/stig-virt.profile | 6 +---- 2 files changed, 27 insertions(+), 5 deletions(-) create mode 100644 products/ocp4/profiles/stig-virt-v2r6.profile diff --git a/products/ocp4/profiles/stig-virt-v2r6.profile b/products/ocp4/profiles/stig-virt-v2r6.profile new file mode 100644 index 000000000000..4bad76278932 --- /dev/null +++ b/products/ocp4/profiles/stig-virt-v2r6.profile @@ -0,0 +1,26 @@ +--- +documentation_complete: true + +metadata: + version: V2R6 + SMEs: + - Vincent056 + - rhmdnd + - yuumasato + - abushkin-redhat + +reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip + +title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Virtualization Extension' + +description: |- + This profile contains CEL-based checks for OpenShift Virtualization + that align to the DISA STIG for Red Hat OpenShift Container Platform 4. + +scanner_type: CEL + +# Exclude node kubevirt rules — those are automated in the stig-node XCCDF profile +filter_rules: '"kubevirt" in id_ and "ocp4-node" not in platforms' + +selections: + - stig_ocp4:all diff --git a/products/ocp4/profiles/stig-virt.profile b/products/ocp4/profiles/stig-virt.profile index 4bad76278932..491a959407d7 100644 --- a/products/ocp4/profiles/stig-virt.profile +++ b/products/ocp4/profiles/stig-virt.profile @@ -19,8 +19,4 @@ description: |- scanner_type: CEL -# Exclude node kubevirt rules — those are automated in the stig-node XCCDF profile -filter_rules: '"kubevirt" in id_ and "ocp4-node" not in platforms' - -selections: - - stig_ocp4:all +extends: stig-virt-v2r6 From f58d771bc8952ddff8fa3eea4802dbb5897fba9a Mon Sep 17 00:00:00 2001 From: Watson Yuuma Sato Date: Tue, 25 Aug 2026 23:52:10 +0200 Subject: [PATCH 14/14] Rename stig-virt profile to stig-vm-extension Rename to align with the CIS VM extension profile naming convention (cis-vm-extension). --- .../{stig-virt-v2r6.profile => stig-vm-extension-v2r6.profile} | 0 .../profiles/{stig-virt.profile => stig-vm-extension.profile} | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename products/ocp4/profiles/{stig-virt-v2r6.profile => stig-vm-extension-v2r6.profile} (100%) rename products/ocp4/profiles/{stig-virt.profile => stig-vm-extension.profile} (94%) diff --git a/products/ocp4/profiles/stig-virt-v2r6.profile b/products/ocp4/profiles/stig-vm-extension-v2r6.profile similarity index 100% rename from products/ocp4/profiles/stig-virt-v2r6.profile rename to products/ocp4/profiles/stig-vm-extension-v2r6.profile diff --git a/products/ocp4/profiles/stig-virt.profile b/products/ocp4/profiles/stig-vm-extension.profile similarity index 94% rename from products/ocp4/profiles/stig-virt.profile rename to products/ocp4/profiles/stig-vm-extension.profile index 491a959407d7..441979ef8de5 100644 --- a/products/ocp4/profiles/stig-virt.profile +++ b/products/ocp4/profiles/stig-vm-extension.profile @@ -19,4 +19,4 @@ description: |- scanner_type: CEL -extends: stig-virt-v2r6 +extends: stig-vm-extension-v2r6