OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 #11887

yuumasato · 2024-04-25T10:10:16Z

Description:

Add to default.profile rules that were once shipped in RHCOS4 Benchmark.
- These rules don't have a prodtype and were not added to RHCOS4's default.profile

Rationale:

These rules might be used in TailoredProfiles.

Review Hints:

Build and check that the rules are included in the data stream.

github-actions · 2024-04-25T10:11:47Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-04-25T10:15:20Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11887
This image was built from commit: e2f1116

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11887

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11887 make deploy-local

rhmdnd · 2024-04-25T16:51:41Z

/test

openshift-ci · 2024-04-25T16:51:44Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-images
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-images
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rhmdnd · 2024-04-25T16:52:10Z

/test e2e-aws-rhcos4-stig

rhmdnd · 2024-04-25T18:27:11Z

STIG failures here should be getting addressed in #11790

rhmdnd

/lgtm

yuumasato · 2024-04-26T08:11:46Z

Rebased to re-kick some testing farm tests

xiaojiey · 2024-04-26T08:45:52Z

/hold for test

xiaojiey · 2024-04-26T09:02:45Z

@yuumasato One question, is rule rhcos4-file-permissions-sudo dropped on purpose? Thanks.
Verified with 4.16.0-0.nightly-2024-04-23-032717 + ghcr.io/complianceascode/k8scontent:11887:

% oc get rules --no-headers | grep upstream | wc -l
    1065
% oc get rules --no-headers | grep -Ev upstream | wc -l
    1060
% oc get rules --no-headers | grep upstream | awk '{print $1}' | sed 's/upstream-//g' | sort > upstream_rules
% oc get rules --no-headers | grep -Ev upstream | awk '{print $1}' | sort > downstream_rules
% diff upstream_rules downstream_rules 
3d2
< ocp4-acs-sensor-exists
345d343
< rhcos4-accounts-maximum-age-login-defs
718a717
> rhcos4-file-permissions-sudo
902d900
< rhcos4-partition-for-tmp
980d977
< rhcos4-sshd-set-keepalive
996,997d992
< rhcos4-sudo-remove-no-authenticate
< rhcos4-sudo-remove-nopasswd

These rules don't have a prodtype, and they were not added to RHCOS4's default.profile.

yuumasato · 2024-04-26T09:21:03Z

@xiaojiey Nice catch, the rule should be there.
I have updated the PR.

openshift-ci · 2024-04-26T09:23:51Z

@yuumasato: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-stig	`df276b7`	link	true	`/test e2e-aws-rhcos4-stig`
ci/prow/4.13-images	`e2f1116`	link	true	`/test 4.13-images`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

xiaojiey · 2024-04-26T09:35:25Z

Pre-merge verification pass with 4.16.0-0.nightly-2024-04-23-032717 + ghcr.io/complianceascode/k8scontent:11887

% oc get rules --no-headers | grep upstream | awk '{print $1}' | sed 's/upstream-//g' | sort > upstream_rules
% oc get rules --no-headers | grep -Ev upstream | awk '{print $1}' | sort > downstream_rules                 
% diff upstream_rules downstream_rules 
3d2
< ocp4-acs-sensor-exists
345d343
< rhcos4-accounts-maximum-age-login-defs
903d900
< rhcos4-partition-for-tmp
981d977
< rhcos4-sshd-set-keepalive
997,998d992
< rhcos4-sudo-remove-no-authenticate
< rhcos4-sudo-remove-nopasswd
% cat upstream_rules | wc -l
    1066
% cat downstream_rules| wc -l
    1060

xiaojiey · 2024-04-26T09:35:50Z

/lgtm

codeclimate · 2024-04-26T09:35:59Z

Code Climate has analyzed commit e2f1116 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

yuumasato added OpenShift OpenShift product related. CoreOS CoreOS product related. labels Apr 25, 2024

yuumasato added this to the 0.1.73 milestone Apr 25, 2024

yuumasato changed the title ~~RHCOS4 : Add back rules that were once shipped~~ OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 Apr 25, 2024

rhmdnd requested review from xiaojiey and BhargaviGudi April 25, 2024 18:28

rhmdnd approved these changes Apr 25, 2024

View reviewed changes

yuumasato force-pushed the OCPBUGS-32794-maintain-rule-selection branch from df276b7 to c242b67 Compare April 26, 2024 08:10

openshift-ci bot added the do-not-merge/hold Used by openshift-ci-robot bot. label Apr 26, 2024

Add back rules once shipped in RHCOS4 Benchmark

e2f1116

These rules don't have a prodtype, and they were not added to RHCOS4's default.profile.

yuumasato force-pushed the OCPBUGS-32794-maintain-rule-selection branch from c242b67 to e2f1116 Compare April 26, 2024 09:20

yuumasato merged commit 3982af5 into ComplianceAsCode:master Apr 26, 2024
112 of 113 checks passed

yuumasato deleted the OCPBUGS-32794-maintain-rule-selection branch April 26, 2024 10:01

marcusburghardt assigned rhmdnd May 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 #11887

OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 #11887

yuumasato commented Apr 25, 2024

github-actions bot commented Apr 25, 2024

github-actions bot commented Apr 25, 2024 •

edited

rhmdnd commented Apr 25, 2024

openshift-ci bot commented Apr 25, 2024

rhmdnd commented Apr 25, 2024

rhmdnd commented Apr 25, 2024

rhmdnd left a comment

yuumasato commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

yuumasato commented Apr 26, 2024

openshift-ci bot commented Apr 26, 2024

xiaojiey commented Apr 26, 2024 •

edited

xiaojiey commented Apr 26, 2024

codeclimate bot commented Apr 26, 2024

OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 #11887

OCPBUGS-32794: Add back rules that were once shipped in RHCOS4 #11887

Conversation

yuumasato commented Apr 25, 2024

Description:

Rationale:

Review Hints:

github-actions bot commented Apr 25, 2024

github-actions bot commented Apr 25, 2024 • edited

rhmdnd commented Apr 25, 2024

openshift-ci bot commented Apr 25, 2024

rhmdnd commented Apr 25, 2024

rhmdnd commented Apr 25, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

yuumasato commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

yuumasato commented Apr 26, 2024

openshift-ci bot commented Apr 26, 2024

xiaojiey commented Apr 26, 2024 • edited

xiaojiey commented Apr 26, 2024

codeclimate bot commented Apr 26, 2024

github-actions bot commented Apr 25, 2024 •

edited

xiaojiey commented Apr 26, 2024 •

edited