Repository navigation
Add APT, update-notifier-motd and user dot directory rules - #15326
realstuffie wants to merge 3 commits into
Conversation
These 11 rules come from ComplianceAsCode#15097, so that both the CIS Ubuntu 26.04 profile and the CIS Debian 13 v1.1.0 mapping can use them. Both benchmarks number the controls the same way: - 1.2.1.10 and 1.2.1.11: apt_sources_list_https and apt_sources_list_d_https check that repositories use https. - 1.2.1.12 to 1.2.1.15: apt_configure_allow_insecure_repositories, apt_configure_allow_weak_repositories, apt_configure_allow_downgrade_to_insecure_repositories and apt_configure_check_date check APT's repository security settings. - 1.6.11 and 1.6.12: service_update-notifier-motd_disabled and timer_update-notifier-motd_disabled check that update-notifier's MOTD refresh is off. - 7.2.11: accounts_user_dot_dirs_ownership, accounts_user_dot_dirs_groupownership and accounts_user_dot_dirs_permissions check interactive users' dot directories. The checks and fixes target Ubuntu for now. The rules are registered in the apt and coreutils components and a new update-notifier-common component.
CIS 7.2.11, in Ubuntu 26.04 v1.0.0 and Debian 13 v1.1.0, searches each interactive user's whole home directory for dot directories. The checks and fixes looked only at the top level, so a nested directory such as ~/src/project/.git with mode 0775 passed. The rules' OCIL already describes a recursive search. Drop the depth limit from the checks and fixes, and add a test with a nested dot directory to each rule.
|
Hi @realstuffie. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
The “Build, Lint Ansible Roles on Fedora Latest” job failed because the runner lost connection, not because of this change. It looks like a one-off: this gate passed in the other recent runs. |
The CI yamllint configuration expects list items under a key to be indented. The component files this PR changes used unindented lists, so the lint job failed on them. Indent the items in apt.yml, coreutils.yml and update-notifier-common.yml and drop a trailing blank line. The lists themselves don't change.
Description:
apt_sources_list_httpsandapt_sources_list_d_httpscheck that repositories use https.apt_configure_allow_insecure_repositories,apt_configure_allow_weak_repositories,apt_configure_allow_downgrade_to_insecure_repositoriesandapt_configure_check_datecheck APT's repository security settings.service_update-notifier-motd_disabledandtimer_update-notifier-motd_disabledcheck that update-notifier's MOTD refresh is off.accounts_user_dot_dirs_ownership,accounts_user_dot_dirs_groupownershipandaccounts_user_dot_dirs_permissionscheck interactive users' dot directories.components/apt.yml,components/coreutils.ymland a newcomponents/update-notifier-common.yml.Rationale:
Review Hints:
multi_platform_ubuntu). Debian 13 support can follow in a separate PR. SCE isn't enabled for debian13, so the seven SCE-only checks would need OVAL there../build_product ubuntu2404 --datastream-onlywith a temporary profile selecting all 11 rules: each rule gets its checks and fixes, andoscap ds sds-validatepasses.