Add dconf_gnome_disable_automount to RHEL STIG profile.

[ggbecker]

Description:

• Select rule to STIG profile
• Update references section
• Add RHEL8 cce
• Enable remediation for Fedora
• Change severity to medium as defined by DISA STIG

Rationale:

• Rule is part of newer STIG: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-100023?version=v2r7

Update1: Rule has been broken down into three rules, each of them checks for a specific parameter in gnome dconf configuration.

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[vojtapolasek]

I am trying to run tests for this rule with upstream test suite and VM and the rule errors out as "not applicable". I see there is
platform: machine
Is that needed? Is this the reason why the test reports "not applicable"?

[ggbecker]

I am trying to run tests for this rule with upstream test suite and VM and the rule errors out as "not applicable". I see there is
platform: machine
Is that needed? Is this the reason why the test reports "not applicable"?

My initial guess is that you need to have dconf installed in your testing VM.

[redhatrises]

This rule needs to be broken into at least 3 separate rules.

[vojtapolasek]

This rule needs to be broken into at least 3 separate rules.

What is your reasoning? Would it make sense to have in a profile for example only two of these three config variables configured?

[redhatrises]

This rule needs to be broken into at least 3 separate rules.

What is your reasoning? Would it make sense to have in a profile for example only two of these three config variables configured?

Yes. It would. It also produces better security content.

[ggbecker]

This rule needs to be broken into at least 3 separate rules.

What is your reasoning? Would it make sense to have in a profile for example only two of these three config variables configured?

Yes. It would. It also produces better security content.

Ok, I'll add this to my backlog and will get back to it soon.

[JAORMX]

/retest

[ggbecker]

This rule needs to be broken into at least 3 separate rules.

What is your reasoning? Would it make sense to have in a profile for example only two of these three config variables configured?

Yes. It would. It also produces better security content.

Ok, I'll add this to my backlog and will get back to it soon.

@redhatrises rule has been broken down into three rules. Can you verify them?

[ggbecker]

@redhatrises can you check this one?

[redhatrises]

Looks good except for the duplicate STIGIDs. We should remove them, and ask for new ones.

[ggbecker]

Looks good except for the duplicate STIGIDs. We should remove them, and ask for new ones.

I assume that it can take a while until they (DISA) split the rules and assign new STIG ids to them. So, do we want to wait for that? And how do we initiate this request to DISA?

[vojtapolasek]

Looks very good, just small fixes needed, please see comments.

[vojtapolasek]

Oh, while running SST test suite, unfortunately none of ansible remediations seem to pass the test. Bash is ok.

[ggbecker]

Oh, while running SST test suite, unfortunately none of ansible remediations seem to pass the test. Bash is ok.

I'll eventually get back to this pull request when I have time.

[ggbecker]

Oh, while running SST test suite, unfortunately none of ansible remediations seem to pass the test. Bash is ok.

I have addressed all the requests and fixed the ansible remediation (it was missing no_extra_spaces: yes). The OVAL regex doesn't expect any space between the = separator.

The only thing left now is the duplicated STIG ids. But I'm not sure how to proceed. @redhatrises Do you how to ask DISA for new STIG ids? Should we merge this pull request as it is and open a new one to assign new STIG ids when they become available?

[openshift-ci-robot]

@ggbecker: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-rhcos4-e8	144e295	link	/test e2e-aws-rhcos4-e8

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[redhatrises]

Looks good except for the duplicate STIGIDs. We should remove them, and ask for new ones.

I assume that it can take a while until they (DISA) split the rules and assign new STIG ids to them. So, do we want to wait for that? And how do we initiate this request to DISA?

Yes, we do want to wait for that. There should be no duplicate STIG IDs.

[ggbecker]

Looks good except for the duplicate STIGIDs. We should remove them, and ask for new ones.

I assume that it can take a while until they (DISA) split the rules and assign new STIG ids to them. So, do we want to wait for that? And how do we initiate this request to DISA?

Yes, we do want to wait for that. There should be no duplicate STIG IDs.

Ok, also I remember seeing duplicated STIG ids in the project. I will try to find all of them and publish in a new issue.

[redhatrises]

/retest

[openscap-ci]

Changes identified:
Rules:
 dconf_gnome_disable_automount
 dconf_gnome_disable_automount_open
 dconf_gnome_disable_autorun
Profiles:
 ncp on rhel7
 stig on rhel7

Show details

Rule dconf_gnome_disable_automount:
 Node moved within OVAL check.
 Attribute value changed in OVAL check.
 Node deleted from OVAL check.
 Template usage changed in ansible remediation.
 Ansible remediation changed.
 Text changed in OVAL check.
 Deleted attribute from OVAL check.
Rule dconf_gnome_disable_automount_open:
 Ansible remediation newly added.
 OVAL check is newly added.
 Bash remediation is newly added.
Rule dconf_gnome_disable_autorun:
 Ansible remediation newly added.
 OVAL check is newly added.
 Bash remediation is newly added.
Profile ncp on rhel7:
 Rule dconf_gnome_disable_autorun, dconf_gnome_disable_automount_open added to ncp profile.
Profile stig on rhel7:
 Rule dconf_gnome_disable_automount_open, dconf_gnome_disable_automount, dconf_gnome_disable_autorun added to stig profile.

Recommended tests to execute:
 build_product rhel7
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_automount
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_automount
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_automount_open
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_automount_open
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_autorun
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-rhel7-ds.xml dconf_gnome_disable_autorun
 tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel7-ds.xml ncp
 tests/test_suite.py profile --libvirt qemu:///system test-suite-vm --datastream build/ssg-rhel7-ds.xml stig