Firewall technology related rules per service and package change logic according to interactive profile variable #11818

teacup-on-rockingchair · 2024-04-14T04:03:59Z

Description:

Make sure that behaviour of rules about nftables,iptables and firewalld are mutually exclusive and the default behaviour of the checks and remediations is based on external interactive variable, that is part of the profile definition

Rationale:

Add oval macro to check external variable vs expected value
Add variable to set default firewall technology used
Set relevant values for SLE platforms
Templates for pkg installed/removed and svc enabled/disabled, guarded by ext varaiable
The idea is the oval checks and remediation to check provided external variable, and thus honour if really to check/install/remove certain package or service
Enable nftable service on SLE only if active firewall technology is set to be nftables
Disable nftable service on SLE only if active firewall technology is set to be firewalld or iptables
Removing nftable package on SLE makes sense only if active firewall technology is set to be firewalld or iptables
Installing iptables package on SLE only if active firewall technology is set to be iptables
Enable iptables service on SLE only if active firewall technology is set to be iptables
Disable firewalld service on SLE only if active firewall technology is set to be nftables or iptables
Removing package on SLE makes sense only if active firewall technology is set to be nftables or iptables
Enable firewalld service on SLE only if active firewall technology is set to be firewalld
Installing firewalld package on SLE only if active firewall technology is set to be firewalld

Review Hints:

For now the proposed change is applied to SLE platforms only, and if proves to be a good approach can distribute to other platforms also
The use case would be that the user will have in its profile defined default firewall technology, one of iptables,nftables,ufw, firewalld ,and if the system has been modified a non-default option for that, one can use scap-workbench or similar tool, or define a new alternative profile to the original one (CIS is currently the one having conflicting rules ) , or via command line arguments of the oscap tool, if that is the weapon of choice to run checks and remediations.

openshift-ci · 2024-04-14T04:04:04Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2024-04-14T04:05:32Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-04-14T04:10:23Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11818
This image was built from commit: f2480f3

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11818

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11818 make deploy-local

teacup-on-rockingchair · 2024-04-28T09:29:53Z

/test all

marcusburghardt · 2024-05-02T07:25:38Z

/packit build

dodys · 2024-05-10T11:34:47Z

should we change this pr to work across different vendors?
@marcusburghardt @Mab879 @Xeicker

Xeicker · 2024-05-16T16:24:23Z

should we change this pr to work across different vendors? @marcusburghardt @Mab879 @Xeicker

For the moment it is not necessary for Oracle Linux

… is set to be iptables

…set to be iptables

…s set to be nftables or iptables

…y is set to be nftables or iptables

… set to be firewalld

…y is set to be firewalld

Given variable should actually mark the state in which package should not be removed because it is needed by the setup

@Mab879

Thanks to @Mab879 for raising the flag I missed that during rebase

marcusburghardt · 2025-01-10T07:56:18Z

I removed myself as assignee as, unfortunately, I won't be able to review/test it again for the next few weeks.

Mab879

Sorry, for the late review.

Hopefully we can get this moving along again.

shared/templates/package_installed_guard_var/ansible.template

shared/templates/package_removed_guard_var/ansible.template

shared/templates/service_enabled_guard_var/ansible.template

shared/templates/service_enabled_guard_var/oval.template

.../guide/system/network/network-iptables/iptables_activation/service_iptables_enabled/rule.yml

linux_os/guide/system/network/network-nftables/service_nftables_enabled/rule.yml

Co-authored-by: Matthew Burket <m@tthewburket.com>

@Mab879

Thanks to @Mab879 for the support

codeclimate · 2025-01-21T10:34:20Z

Code Climate has analyzed commit 8f0fdfe and detected 6 issues on this pull request.

Here's the issue category breakdown:

Category	Count
Duplication	6

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

Mab879

Waving the Automatus Tests as they pass locally.

Waving the Code Climate issues as I don't think they are worth solving.

Overriding CODEOWNERS since @teacup-on-rockingchair cannot merge his own PRs.

Thanks @teacup-on-rockingchair working on this for all this time.

mpurg · 2025-01-24T11:11:45Z

shared/templates/package_installed_guard_var/bash.template

+{{{ bash_instantiate_variables(VARIABLE) }}}
+
+{{% if OPERATION == "pattern match" %}}
+  if [[ "{{{ VALUE }}}" =~ ${{{ VARIABLE }}} ]]; then


@teacup-on-rockingchair I think the operation here should be flipped.
The implementation searches for VARIABLE regex inside VALUE, instead of searching for VALUE regex in VARIABLE.
If VALUE=firewalld|nftables, then it will match when VARIABLE is set to any substring of VALUE, or an empty string, or regex special characters like ..

This change modifies the firewall package/service rules to use the templates `..._guard_var` introduced in ComplianceAsCode#11818 to selectively install the firewall that is chosen by the var_network_filtering_service It also fixes the platform applicability on Ubuntu 24.04 since it both required firewalld and required that conflicting services be disabled when installing packages. This interfered with the logic introduced in the new templates and could result in a package/service not be installed/enabled. For example, if the user selected 'nftables' as their firewall using the new template and variable, the rule package_nftables_installed would still be marked as not applicable because the ufw service is enabled by default on some installations. The proposed solution removes the applicability check and installs the package depending only on the choice of var_network_filtering_service, irrespective of the status of the ufw service.

The variable is used to select the desired timesync service (systemd-timesync vs chrony) in package/service install/enable rules when using _guard_var templates. Analogous to var_network_filtering_service introduced in ComplianceAsCode#11818

teacup-on-rockingchair added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. SLES SUSE Linux Enterprise Server product related. New Template Issues or pull requests related to new Templates. labels Apr 14, 2024

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 14, 2024

jan-cerny changed the title ~~Firewall technology related rules per service and package change logic accprding to interactive profile variable~~ Firewall technology related rules per service and package change logic according to interactive profile variable Apr 15, 2024

teacup-on-rockingchair marked this pull request as ready for review April 15, 2024 15:30

teacup-on-rockingchair requested a review from a team as a code owner April 15, 2024 15:30

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 15, 2024

teacup-on-rockingchair marked this pull request as draft April 16, 2024 14:29

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 16, 2024

teacup-on-rockingchair marked this pull request as ready for review April 22, 2024 12:22

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 22, 2024

teacup-on-rockingchair added this to the 0.1.73 milestone Apr 30, 2024

vojtapolasek modified the milestones: 0.1.73, 0.1.74 Apr 30, 2024

teacup-on-rockingchair force-pushed the firewall_by_profile_variable branch from 6188277 to fc100a9 Compare May 2, 2024 10:49

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label May 9, 2024

teacup-on-rockingchair force-pushed the firewall_by_profile_variable branch from fc100a9 to 87ba124 Compare May 21, 2024 03:40

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label May 21, 2024

marcusburghardt self-assigned this May 31, 2024

Mab879 removed this from the 0.1.74 milestone Jul 29, 2024

teacup-on-rockingchair added 10 commits December 12, 2024 17:54

Installing iptables package on SLE only if active firewall technology…

3a65275

… is set to be iptables

Enable iptables service on SLE only if active firewall technology is …

93fc615

…set to be iptables

Disable firewalld service on SLE only if active firewall technology i…

53f09ca

…s set to be nftables or iptables

Removing package on SLE makes sense only if active firewall technolog…

55fd107

…y is set to be nftables or iptables

Enable firewalld service on SLE only if active firewall technology is…

67b3616

… set to be firewalld

Installing firewalld package on SLE only if active firewall technolog…

7df2ff6

…y is set to be firewalld

Fix bash template to produce shellcheck compliant code

75126ba

Package removed template guarded is with inverted logic

e8ef4d7

Given variable should actually mark the state in which package should not be removed because it is needed by the setup

Invert the logic for variable dependency for service disabled rules

6ae92ca

Replace machine with more relevant system_with_kernel platform

8f0fdfe

Thanks to @Mab879 for raising the flag I missed that during rebase

marcusburghardt removed their assignment Jan 10, 2025

teacup-on-rockingchair force-pushed the firewall_by_profile_variable branch from 504b19e to 1e36548 Compare January 12, 2025 10:21

teacup-on-rockingchair requested a review from jan-cerny January 12, 2025 10:22

teacup-on-rockingchair force-pushed the firewall_by_profile_variable branch from 1e36548 to 6ae92ca Compare January 17, 2025 16:02

teacup-on-rockingchair mentioned this pull request Jan 17, 2025

Review ip6tables related rules #11054

Open

Mab879 requested changes Jan 17, 2025

View reviewed changes

Mab879 self-assigned this Jan 17, 2025

teacup-on-rockingchair and others added 4 commits January 21, 2025 11:50

Update shared/templates/package_removed_guard_var/ansible.template

55f0f79

Co-authored-by: Matthew Burket <m@tthewburket.com>

Update shared/templates/service_enabled_guard_var/ansible.template

b7a296e

Co-authored-by: Matthew Burket <m@tthewburket.com>

Update shared/templates/package_installed_guard_var/ansible.template

b96d658

Co-authored-by: Matthew Burket <m@tthewburket.com>

Simplify template removing obsolete oval < 5.11 version support

440dd03

Thanks to @Mab879 for the support

Mab879 approved these changes Jan 21, 2025

View reviewed changes

Mab879 merged commit 4016027 into ComplianceAsCode:master Jan 21, 2025
103 of 109 checks passed

mpurg reviewed Jan 24, 2025

View reviewed changes

mpurg mentioned this pull request Jan 27, 2025

Switch to _guard_var templates for firewall rules on Ubuntu 24.04 #12902

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Firewall technology related rules per service and package change logic according to interactive profile variable #11818

Firewall technology related rules per service and package change logic according to interactive profile variable #11818

teacup-on-rockingchair commented Apr 14, 2024 •

edited

Loading

openshift-ci bot commented Apr 14, 2024

github-actions bot commented Apr 14, 2024

github-actions bot commented Apr 14, 2024 •

edited

Loading

teacup-on-rockingchair commented Apr 28, 2024

marcusburghardt commented May 2, 2024

dodys commented May 10, 2024

Xeicker commented May 16, 2024

marcusburghardt commented Jan 10, 2025

Mab879 left a comment

codeclimate bot commented Jan 21, 2025

Mab879 left a comment

mpurg Jan 24, 2025 •

edited

Loading

Firewall technology related rules per service and package change logic according to interactive profile variable #11818

Firewall technology related rules per service and package change logic according to interactive profile variable #11818

Conversation

teacup-on-rockingchair commented Apr 14, 2024 • edited Loading

Description:

Rationale:

Review Hints:

openshift-ci bot commented Apr 14, 2024

github-actions bot commented Apr 14, 2024

github-actions bot commented Apr 14, 2024 • edited Loading

teacup-on-rockingchair commented Apr 28, 2024

marcusburghardt commented May 2, 2024

dodys commented May 10, 2024

Xeicker commented May 16, 2024

marcusburghardt commented Jan 10, 2025

Mab879 left a comment

Choose a reason for hiding this comment

codeclimate bot commented Jan 21, 2025

Mab879 left a comment

Choose a reason for hiding this comment

mpurg Jan 24, 2025 • edited Loading

Choose a reason for hiding this comment

teacup-on-rockingchair commented Apr 14, 2024 •

edited

Loading

github-actions bot commented Apr 14, 2024 •

edited

Loading

mpurg Jan 24, 2025 •

edited

Loading