Add NIST 800-53 Fedora Control (Based on RHEL10 control file) - #15014
Open
ggbecker wants to merge 7 commits into
Open
Add NIST 800-53 Fedora Control (Based on RHEL10 control file)#15014ggbecker wants to merge 7 commits into
ggbecker wants to merge 7 commits into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
ggbecker
force-pushed
the
add-nist-800-53-fedora-control
branch
from
August 21, 2026 16:01
6892774 to
be84c75
Compare
ggbecker
force-pushed
the
add-nist-800-53-fedora-control
branch
from
August 31, 2026 11:30
3dc2687 to
d5d8f50
Compare
ggbecker
marked this pull request as ready for review
August 31, 2026 17:30
ggbecker
requested review from
Mab879,
jan-cerny,
marcusburghardt and
vojtapolasek
as code owners
August 31, 2026 17:30
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Initial copy of NIST 800-53 Revision 5 control files from RHEL10 to Fedora product as a base for Fedora-specific adaptations. This commit is a direct copy without any modifications.
Modify the copied NIST 800-53 control files to use Fedora-specific rules and variable values: Changes in nist_800_53.yml: - Update policy title from "RHEL10" to "Fedora" - Change product field from "rhel10" to "fedora" Changes in si.yml: - Replace ensure_redhat_gpgkey_installed with ensure_fedora_gpgkey_installed Changes in au.yml: - var_auditd_admin_space_left_action: cis_rhel10 -> cis_fedora - var_auditd_space_left_action: cis_rhel10 -> cis_fedora - var_auditd_disk_error_action: cis_rhel10 -> cis_fedora - var_auditd_disk_full_action: cis_rhel10 -> cis_fedora - var_multiple_time_servers: rhel -> fedora Changes in ia.yml: - var_password_hashing_algorithm: cis_rhel10 -> cis_fedora - var_password_hashing_algorithm_pam: cis_rhel10 -> cis_fedora Changes in var_password_hashing_algorithm_pam.var: - Add cis_fedora: yescrypt|sha512 option to support Fedora controls These changes ensure the controls use Fedora-appropriate rules and configuration values for compliance testing.
Add Fedora to the list of default products in the gemara export and test workflow scripts: - export_to_gemara.py: Add fedora to DEFAULT_PRODUCTS list - test_workflow_local.sh: Add fedora to PRODUCTS list This enables automatic generation of gemara artifacts for Fedora NIST 800-53 controls alongside RHEL products. Tested with: python3 utils/nist_sync/export_to_gemara.py --products fedora Result: 1196 controls, 439 rules, 539 mappings successfully generated
_write_xccdf_profile() unconditionally wrote 'platform: {product}' into the
generated nist_800_53.profile. This happens to be valid for rhel8/rhel9/rhel10
(bare product IDs that match a CPE platform name) but breaks the build for
any product where it isn't, e.g. fedora ('Unsupported platform 'fedora' in a
profile').
No other product-scoped profile under products/{product}/profiles/ sets a
platform field — it's redundant since the profile's location already scopes
it to that product. Drop it instead of special-casing per-product validity.
Add infrastructure for end-to-end testing of Fedora NIST 800-53
controls using Vagrant and Ansible:
New files:
- vagrant/Vagrantfile.fedora: official Fedora 44 Cloud libvirt box,
downloaded directly from download.fedoraproject.org
- vagrant/populate_inventory_fedora.sh: generate the Ansible inventory
([fedora_scanner] group) for the Fedora VM
- ansible/setup_fedora.yml: one-time setup playbook — installs complyctl,
the OpenSCAP provider, a local OCI registry, oras, and always deploys
the locally built data stream (the packaged scap-security-guide RPM
predates in-development profiles and would silently shadow it)
- ansible/scan_fedora.yml: runs 'complyctl get' + 'complyctl scan' against
the XDG-layout workspace expected by current complyctl, across all
baselines (Low/Moderate/High)
Usage:
cd utils/nist_sync/vagrant
VAGRANT_VAGRANTFILE=Vagrantfile.fedora vagrant up
bash populate_inventory_fedora.sh
cd ..
ansible-playbook -i ansible/inventory.ini ansible/setup_fedora.yml \
-e complyctl_bin=/path/to/complyctl \
-e provider_bin=~/.complytime/providers/complyctl-provider-openscap
ansible-playbook -i ansible/inventory.ini ansible/scan_fedora.yml
This enables the same Complytime E2E testing workflow used for RHEL
products to be applied to Fedora. Validated end-to-end: full 439-rule
nist_800_53 profile evaluates 407 requirements (190 passed, 217 failed)
on a stock Fedora 44 Cloud image.
Include Fedora alongside RHEL 8/9/10 in the automatic Gemara artifact generation and complytime-policies synchronization workflow.
The pinned SHA (3d3c42e5...) resolves to actions/checkout v7.0.1, not v4 as the comment claimed. This is the same class of mistake flagged in PR ComplianceAsCode#14685's review (actions/upload-artifact was pinned to a v4 comment but a v7.0.0 SHA) — verify comments against the actual tagged version, not just assume the SHA matches its label.
ggbecker
force-pushed
the
add-nist-800-53-fedora-control
branch
from
August 31, 2026 17:34
d5d8f50 to
492664b
Compare
|
@ggbecker: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Add a NIST 800-53 Revision 5 control file for Fedora, based on the RHEL10 control file, to enable Complytime compliance scanning on Fedora systems.
nist_800_53control files for Fedora (e.g.ensure_redhat_gpgkey_installed→ensure_fedora_gpgkey_installed,cis_rhel10→cis_fedoravariable selectors)export_to_gemara.py)platform: {product}field broke the build for any product without a bare-name CPE match (Fedora)utils/nist_sync/vagrant/Vagrantfile.fedora,ansible/setup_fedora.yml,ansible/scan_fedora.yml) to run the same Complytime E2E testing workflow already used for RHEL, against a Fedora 44 Cloud VMupdate-policiesworkflow that syncs Gemara artifacts tocomplytime/complytime-policiesValidated end-to-end: the full 439-rule
nist_800_53profile builds correctly and a Complytime scan on a stock Fedora 44 VM evaluates 407 requirements (190 passed, 217 failed).Review Hints:
products/fedora/controls/nist_800_53/*.yml— diff againstproducts/rhel10/controls/nist_800_53/*.ymlto review only the Fedora-specific adaptationsutils/nist_sync/export_to_gemara.py— theplatform:field removal is a general fix, not Fedora-only; it affects how the tailoring profile is generated for every productproducts/fedora/profiles/nist_800_53.profileis gitignored like the RHEL ones (regenerated byexport_to_gemara.py, not committed)utils/nist_sync/vagrant/Vagrantfile.fedora+ansible/setup_fedora.yml+ansible/scan_fedora.ymlcis-nist-sync.ymlautomation (that tooling is RHEL-specific — hardcoded CIS RHEL benchmark version mapping); this PR does not change that