RHCOS4: Updated rule for rhel9 based RHCOS #10343

Vincent056 · 2023-03-21T03:34:27Z

Description:

Added a new CPE for RHEL9 RHCOS, disabled iptables rule for rhel9-rhcos4, and added a new rule to detect if iptables-nft is being installed.

Fix rule ensure_logrotate_activated.

Rationale:

iptables is being replaced by iptables-nft in RHEL9 based RHCOS.

The newer logrotate use systemd timer instead of cron.

github-actions · 2023-03-21T04:01:28Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-03-21T04:03:07Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated'.
--- xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
+++ xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
@@ -5,7 +5,7 @@
 [description]:
 The logrotate utility allows for the automatic rotation of
 log files. The frequency of rotation is specified in /etc/logrotate.conf,
-which triggers a cron task. To configure logrotate to run daily, add or correct
+which triggers a cron task or a timer. To configure logrotate to run daily, add or correct
 the following line in /etc/logrotate.conf:
 # rotate log files frequency
 daily

OVAL for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated' differs.
--- oval:ssg-ensure_logrotate_activated:def:1
+++ oval:ssg-ensure_logrotate_activated:def:1
@@ -1,4 +1,6 @@
 criteria AND
 criterion oval:ssg-test_logrotate_conf_daily_setting:tst:1
 criterion oval:ssg-test_logrotate_conf_no_other_keyword:tst:1
+criteria OR
 criterion oval:ssg-test_cron_daily_logrotate_existence:tst:1
+extend_definition oval:ssg-timer_logrotate_enabled:def:1

jhrozek · 2023-03-21T10:46:27Z

linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/oval/shared.xml

-      test_ref="test_cron_daily_logrotate_existence" />
+      <criteria comment="Check if either logrotate timer or cron job is eneabled" operator="OR">
+        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="test_cron_daily_logrotate_existence" />
+        <extend_definition comment="check kubeletconfig master" definition_ref="timer_logrotate_enabled" />


copy-paste?

jhrozek · 2023-03-21T10:46:37Z

linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/oval/shared.xml

@@ -8,8 +8,10 @@
      test_ref="test_logrotate_conf_daily_setting" />
      <criterion comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf"
      test_ref="test_logrotate_conf_no_other_keyword" />
-      <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)"
-      test_ref="test_cron_daily_logrotate_existence" />
+      <criteria comment="Check if either logrotate timer or cron job is eneabled" operator="OR">


typo: eneabled

jhrozek · 2023-03-21T10:47:44Z

linux_os/guide/system/logging/log_rotation/package_logrotate_installed/rule.yml

@@ -0,0 +1,38 @@
+documentation_complete: true
+
+title: 'Ensure logrotate is Installed'


Where is this rule used?

It's needed by timer enabled template

jhrozek · 2023-03-21T10:48:37Z

/retest

jhrozek · 2023-03-21T12:46:42Z

/retest

We recently have Compliance Operator to build latest image using master branch, this PR change the CatalogSource image reference to that image.

Vincent056 · 2023-03-22T07:35:21Z

/retest

Vincent056 · 2023-03-22T16:43:15Z

/test e2e-aws-rhcos4-high

Vincent056 · 2023-03-22T16:43:24Z

/test e2e-aws-ocp4-high-node

Vincent056 · 2023-03-22T16:43:35Z

/test e2e-aws-ocp4-high

jhrozek · 2023-03-23T08:58:43Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

Vincent056 · 2023-03-23T09:34:14Z

/test e2e-aws-rhcos4-high /test e2e-aws-rhcos4-e8 /test e2e-aws-rhcos4-moderate

I think I need to fix the CPE, probably have some issues with the regex matching, the other fix has worked.

Vincent056 · 2023-03-23T09:39:47Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

Vincent056 · 2023-03-23T20:19:21Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

Vincent056 · 2023-03-23T23:21:27Z

/test e2e-aws-rhcos4-high

Vincent056 · 2023-03-23T23:45:57Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

openshift-ci · 2023-03-24T01:49:03Z

@Vincent056: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ocp4-pci-dss	`8ca6e26`	link	true	`/test e2e-aws-ocp4-pci-dss`
ci/prow/e2e-aws-ocp4-pci-dss-node	`8ca6e26`	link	true	`/test e2e-aws-ocp4-pci-dss-node`
ci/prow/e2e-aws-ocp4-moderate	`8ca6e26`	link	true	`/test e2e-aws-ocp4-moderate`
ci/prow/e2e-aws-ocp4-cis-node	`8ca6e26`	link	true	`/test e2e-aws-ocp4-cis-node`
ci/prow/e2e-aws-ocp4-stig-node	`8ca6e26`	link	true	`/test e2e-aws-ocp4-stig-node`
ci/prow/e2e-aws-ocp4-e8	`8ca6e26`	link	true	`/test e2e-aws-ocp4-e8`
ci/prow/e2e-aws-ocp4-stig	`8ca6e26`	link	true	`/test e2e-aws-ocp4-stig`
ci/prow/e2e-aws-ocp4-cis	`8ca6e26`	link	true	`/test e2e-aws-ocp4-cis`
ci/prow/e2e-aws-ocp4-moderate-node	`8ca6e26`	link	true	`/test e2e-aws-ocp4-moderate-node`
ci/prow/e2e-aws-ocp4-high	`3d869aa`	link	true	`/test e2e-aws-ocp4-high`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Vincent056 · 2023-03-24T02:57:20Z

/test e2e-aws-rhcos4-high

Vincent056 · 2023-03-24T04:32:43Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

Added a new CPE for rhel9 rhcos, disabled iptables rule for rhel9-rhcos4, iptables is being replaced by iptables-nft. Added a new rule to detect if iptables-nft is being installed.

Vincent056 · 2023-03-24T06:14:03Z

/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-moderate

Vincent056 · 2023-03-24T06:14:22Z

Changed expected e2e test result.

codeclimate · 2023-03-24T07:05:00Z

Code Climate has analyzed commit f723e01 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.8% (0.0% change).

View more on Code Climate.

jhrozek

LGTM

jhrozek · 2023-03-24T09:58:25Z

Actually, let's hold the merge, the automatus failures look related...

jhrozek · 2023-03-24T11:50:31Z

@Vincent056 it looks like we can ignore this error:

ERROR - Rule 'xccdf_org.ssgproject.content_rule_package_iptables-nft_installed' isn't present in benchmark 'xccdf_org.ssgproject.content_benchmark_RHEL-8' in '/tmp/ssgts-ds-ztez_y1t'

but what about this one?

 ERROR - Script logrotate_no_cron_daily.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in error, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated'.

Vincent056 · 2023-03-24T18:19:57Z

@Vincent056 it looks like we can ignore this error:

ERROR - Rule 'xccdf_org.ssgproject.content_rule_package_iptables-nft_installed' isn't present in benchmark 'xccdf_org.ssgproject.content_benchmark_RHEL-8' in '/tmp/ssgts-ds-ztez_y1t'

but what about this one?

 ERROR - Script logrotate_no_cron_daily.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in error, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated'.

systemd is not working in the fedora container, should we just remove this test? The e2e has passed, so the timer detection is working as expected.

Vincent056 · 2023-03-24T18:21:38Z

@Vincent056 it looks like we can ignore this error:
ERROR - Rule 'xccdf_org.ssgproject.content_rule_package_iptables-nft_installed' isn't present in benchmark 'xccdf_org.ssgproject.content_benchmark_RHEL-8' in '/tmp/ssgts-ds-ztez_y1t'
but what about this one?
 ERROR - Script logrotate_no_cron_daily.fail.sh using profile (all) found issue:
ERROR - Rule evaluation resulted in error, instead of expected fail during initial stage 
ERROR - The initial scan failed for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated'.
systemd is not working in the fedora container, should we just ignore this issue, or remove this test? The e2e has passed, so the timer detection is working as expected.

System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down

jhrozek · 2023-03-24T18:33:26Z

systemd is not working in the fedora container, should we just remove this test? The e2e has passed, so the timer detection is working as expected.

I do not know why I missed this. Thank you.

This is needed since ComplianceAsCode#10343 added test for the logrotate timer

Vincent056 force-pushed the rhcos4-rhel9 branch 2 times, most recently from f5d6aea to 3ee1cfc Compare March 21, 2023 03:59

Vincent056 force-pushed the rhcos4-rhel9 branch 3 times, most recently from 57880b9 to 8ca6e26 Compare March 21, 2023 04:57

jhrozek reviewed Mar 21, 2023

View reviewed changes

OCP change CatalogSource used to deploy CO

8e74687

We recently have Compliance Operator to build latest image using master branch, this PR change the CatalogSource image reference to that image.

Vincent056 force-pushed the rhcos4-rhel9 branch from 8ca6e26 to e3259cb Compare March 22, 2023 07:39

rhmdnd mentioned this pull request Mar 22, 2023

OCP change CatalogSource used to deploy CO #10347

Merged

Merge branch 'ComplianceAsCode:master' into master

99a1d40

Vincent056 force-pushed the rhcos4-rhel9 branch from e3259cb to 3d869aa Compare March 22, 2023 16:40

Vincent056 force-pushed the rhcos4-rhel9 branch from 3d869aa to 19f1291 Compare March 23, 2023 09:39

Vincent056 force-pushed the rhcos4-rhel9 branch from 19f1291 to 324d127 Compare March 23, 2023 23:36

Vincent056 force-pushed the rhcos4-rhel9 branch 3 times, most recently from aa07865 to 2bd6cfb Compare March 24, 2023 04:32

RHCOS4: Updated rule for rhel9 based RHCOS

f723e01

Added a new CPE for rhel9 rhcos, disabled iptables rule for rhel9-rhcos4, iptables is being replaced by iptables-nft. Added a new rule to detect if iptables-nft is being installed.

Vincent056 force-pushed the rhcos4-rhel9 branch from 2bd6cfb to f723e01 Compare March 24, 2023 06:13

jhrozek approved these changes Mar 24, 2023

View reviewed changes

jhrozek merged commit 2c18502 into ComplianceAsCode:master Mar 24, 2023

Mab879 added a commit to Mab879/content that referenced this pull request Mar 27, 2023

Disable logrotate timer in ensure_logrotate_activated tests

ef388fe

This is needed since ComplianceAsCode#10343 added test for the logrotate timer

Mab879 mentioned this pull request Mar 27, 2023

Disable logrotate timer in ensure_logrotate_activated tests #10375

Merged

Mab879 added a commit to Mab879/content that referenced this pull request Mar 27, 2023

Disable logrotate timer in ensure_logrotate_activated tests

72099ea

This is needed since ComplianceAsCode#10343 added test for the logrotate timer

Mab879 mentioned this pull request Mar 27, 2023

Disable logrotate timer in ensure_logrotate_activated tests #10376

Merged

marcusburghardt assigned jhrozek Nov 23, 2023

marcusburghardt added the OpenShift OpenShift product related. label Nov 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RHCOS4: Updated rule for rhel9 based RHCOS #10343

RHCOS4: Updated rule for rhel9 based RHCOS #10343

Vincent056 commented Mar 21, 2023 •

edited

Loading

github-actions bot commented Mar 21, 2023 •

edited

Loading

github-actions bot commented Mar 21, 2023 •

edited

Loading

jhrozek Mar 21, 2023

Vincent056 Mar 21, 2023

jhrozek Mar 21, 2023

jhrozek Mar 21, 2023

Vincent056 Mar 21, 2023

jhrozek commented Mar 21, 2023

jhrozek commented Mar 21, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

jhrozek commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

openshift-ci bot commented Mar 24, 2023 •

edited

Loading

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

codeclimate bot commented Mar 24, 2023

jhrozek left a comment

jhrozek commented Mar 24, 2023

jhrozek commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

jhrozek commented Mar 24, 2023 •

edited

Loading

		@@ -0,0 +1,38 @@
		documentation_complete: true

		title: 'Ensure logrotate is Installed'

RHCOS4: Updated rule for rhel9 based RHCOS #10343

RHCOS4: Updated rule for rhel9 based RHCOS #10343

Conversation

Vincent056 commented Mar 21, 2023 • edited Loading

Description:

Rationale:

github-actions bot commented Mar 21, 2023 • edited Loading

github-actions bot commented Mar 21, 2023 • edited Loading

jhrozek Mar 21, 2023

Choose a reason for hiding this comment

Vincent056 Mar 21, 2023

Choose a reason for hiding this comment

jhrozek Mar 21, 2023

Choose a reason for hiding this comment

jhrozek Mar 21, 2023

Choose a reason for hiding this comment

Vincent056 Mar 21, 2023

Choose a reason for hiding this comment

jhrozek commented Mar 21, 2023

jhrozek commented Mar 21, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

Vincent056 commented Mar 22, 2023

jhrozek commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

Vincent056 commented Mar 23, 2023

openshift-ci bot commented Mar 24, 2023 • edited Loading

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

codeclimate bot commented Mar 24, 2023

jhrozek left a comment

Choose a reason for hiding this comment

jhrozek commented Mar 24, 2023

jhrozek commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

Vincent056 commented Mar 24, 2023

jhrozek commented Mar 24, 2023 • edited Loading

Vincent056 commented Mar 21, 2023 •

edited

Loading

github-actions bot commented Mar 21, 2023 •

edited

Loading

github-actions bot commented Mar 21, 2023 •

edited

Loading

openshift-ci bot commented Mar 24, 2023 •

edited

Loading

jhrozek commented Mar 24, 2023 •

edited

Loading