Skip to content

Fix AL2023 STIG profile content and privileged command audit rules #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Jpierre-01 wants to merge 1 commit into
base: remove-merge-commit
Choose a base branch
from
Open

Fix AL2023 STIG profile content and privileged command audit rules #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ..._configure_rules/audit_privileged_commands/audit_rules_privileged_commands/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ function add_audit_rule()
local PRIV_CMD="$1"
local OTHER_FILTERS="-F path=$PRIV_CMD -F perm=x"
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
for ARCH in "${RULE_ARCHS[@]}" ; do
ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
Expand Down
2 changes: 1 addition & 1 deletion ..._commands/audit_rules_privileged_commands/tests/augenrules_extra_rules_configured.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu

./generate_privileged_commands_rule.sh {{{ uid_min }}} privileged /etc/audit/rules.d/privileged.rules
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules
echo "-a always,exit -F arch=b64 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion ...dit_privileged_commands/audit_rules_privileged_commands/tests/augenrules_one_rule.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash
# packages = audit
# platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path=/usr/bin/sudo -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules
echo "-a always,exit -F arch=b64 -F path=/usr/bin/sudo -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/privileged.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion ...ged_commands/audit_rules_privileged_commands/tests/augenrules_two_rules_sep_files.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# packages = audit
# platform = multi_platform_fedora,multi_platform_rhel,Oracle Linux 7,Oracle Linux 8,multi_platform_ubuntu

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path=/usr/bin/newgrp -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules
echo "-a always,exit -F arch=b64 -F path=/usr/bin/newgrp -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules
echo "-a always,exit -F arch=b32 -F path=/usr/bin/notrelevant -F perm=x -F auid>={{{ uid_min }}} -F auid!=unset -F key=privileged" >> /etc/audit/rules.d/priv.rules
Expand Down
2 changes: 1 addition & 1 deletion ...leged_commands/audit_rules_privileged_commands/tests/generate_privileged_commands_rule.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ AUID=$1
KEY=$2
RULEPATH=$3
for file in $(find / -not \( -fstype afs -o -fstype autofs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2> /dev/null); do
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
for ARCH in "${RULE_ARCHS[@]}" ; do
echo "-a always,exit -F arch=$ARCH -F path=$file -F perm=x -F auid>=$AUID -F auid!=unset -k $KEY" >> $RULEPATH
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/services/ssh/sshd_approved_macs.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ options:
stig: hmac-sha2-512,hmac-sha2-256
stig_extended: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
stig_rhel9: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512
stig_al2023: hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
default: hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
cis_sle12: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
cis_sle15: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
Expand Down
6 changes: 3 additions & 3 deletions linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,11 @@ references:
ocil_clause: 'the package is not installed'

{{% if 'sle' not in product %}}
{{{ complete_ocil_entry_package(package="rsyslog-gnutls") }}}
{{{ complete_ocil_entry_package_installed(package="rsyslog-gnutls") }}}
{{% elif 'amzn' in families %}}
{{{ complete_ocil_entry_package(package="rsyslog-openssl") }}}
{{{ complete_ocil_entry_package_installed(package="rsyslog-openssl") }}}
{{% else %}}
{{{ complete_ocil_entry_package(package="rsyslog-module-gtls") }}}
{{{ complete_ocil_entry_package_installed(package="rsyslog-module-gtls") }}}
{{% endif %}}

template:
Expand Down
1 change: 1 addition & 0 deletions products/al2023/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,4 @@ ssg_build_html_srgmap_tables(${PRODUCT})

ssg_build_html_stig_tables(${PRODUCT})
ssg_build_html_stig_tables_per_profile(${PRODUCT} "stig")

4 changes: 3 additions & 1 deletion products/al2023/profiles/stig.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,4 +55,6 @@ selections:
- grub2_audit_argument
- file_permissions_var_log_audit
- rsyslog_logging_configured

# Variable refine-values
- sshd_approved_macs=stig_al2023

13 changes: 0 additions & 13 deletions products/al2023/transforms/constants.xslt
View file
Open in desktop

This file was deleted.

8 changes: 0 additions & 8 deletions products/al2023/transforms/xccdf-apply-overlay-stig.xslt
View file
Open in desktop

This file was deleted.

9 changes: 0 additions & 9 deletions products/al2023/transforms/xccdf2table-profileccirefs.xslt
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/ansible.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
# complexity = low
# disruption = low

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
- name: {{{ rule_title }}} - Set architecture for audit {{{ PATH }}}
ansible.builtin.set_fact:
audit_arch: "b64"
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/bash.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ SYSCALL=""
KEY="privileged"
SYSCALL_GROUPING="{{{ SYSCALL_GROUPING }}}"

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
[ "$(getconf LONG_BIT)" = "32" ] && RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")
for ARCH in "${RULE_ARCHS[@]}"
do
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/kubernetes.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ spec:
storage:
files:
- contents:
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A
{{% else %}}
source: data:,-a%20always%2Cexit%20-F%20path%3D{{{ PATH }}}{{{ perm_x }}}%20-F%20auid%3E%3D{{{ auid }}}%20-F%20auid%21%3Dunset%20-F%20key%3Dprivileged%0A
Expand Down
6 changes: 3 additions & 3 deletions shared/templates/audit_rules_privileged_commands/oval.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{%- if product in ["al2023", "almalinux9", "al2023", "debian12", "debian13", "fedora", "ol7", "ol8", "ol9", "ol10", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
{{%- if product in ["al2023", "almalinux9", "debian12", "debian13", "fedora", "ol7", "ol8", "ol9", "ol10", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
{{%- set perm_x="(?:[\s]+-F[\s]+perm=x)" %}}
{{%- endif %}}
<def-group>
Expand All @@ -10,7 +10,7 @@
<!-- Test the {{{ audit_tool }}} case -->
<criteria operator="AND">
<extend_definition comment="audit {{{ audit_tool }}}" definition_ref="audit_rules_{{{ audit_tool }}}" />
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
<criterion comment="audit {{{ audit_tool }}} 32-bit {{{ NAME }}}" test_ref="test_{{{ rule_id }}}_{{{ audit_tool }}}_32bit" />
<criteria operator="OR">
<!-- System either isn't 64-bit => we just check presence of 32-bit version of {{{ NAME }}} audit rule -->
Expand Down Expand Up @@ -49,7 +49,7 @@
{{% endmacro %}}

{{% for audit_tool in ["augenrules", "auditctl"] %}}
{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
{{{ arpc_tftst(audit_tool, "32") }}}
{{{ arpc_tftst(audit_tool, "64") }}}
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/tests/auditctl_correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ source common.sh

{{{ setup_auditctl_environment() }}}

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules
echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/tests/auditctl_missing_perm_x.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ source common.sh

{{{ setup_auditctl_environment() }}}

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules
echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/audit.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/tests/augenrules_comented_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

source common.sh

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "# -a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
echo "# -a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/tests/augenrules_correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

source common.sh

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid>={{{ auid }}} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
{{% else %}}
Expand Down
2 changes: 1 addition & 1 deletion shared/templates/audit_rules_privileged_commands/tests/augenrules_missing_auid.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

source common.sh

{{% if product in ["fedora", "rhel10"] %}}
{{% if product in ["al2023", "fedora", "rhel10"] %}}
echo "-a always,exit -F arch=b32 -F path={{{ PATH }}} ${perm_x} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
echo "-a always,exit -F arch=b64 -F path={{{ PATH }}} ${perm_x} -F auid!=unset -k test_key" >> /etc/audit/rules.d/test_key.rules
{{% else %}}
Expand Down