Add a script for finding unused rules #12110

Mab879 · 2024-07-01T17:24:59Z

Description:

Add a script for finding unused rules

Rationale:

To help find outdated rules when removing a product.

Review Hints:

Remove or adjusting profiles is out of scope of this PR. This needs to be addressed on a case-by-case basis.

github-actions · 2024-07-01T17:26:20Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-07-01T17:38:02Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12110
This image was built from commit: 329047c

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12110

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12110 make deploy-local

jan-cerny

The script prints for example rule ensure_amazon_gpgkey_installed which isn't used in a data stream but it is linked as a related rule in a control in the cis_al2023 control file. This means we need to be careful when removing rules, we can't remove all of the rules produced by this script.

docs/manual/developer/05_tools_and_utilities.md

utils/find_unused_rules.py

docs/manual/developer/05_tools_and_utilities.md

Mab879 · 2024-07-08T16:29:13Z

/packit retest-failed

jan-cerny

I have run the script and it works great.

But, you still have some typos left.

jan-cerny · 2024-07-09T06:13:55Z

docs/manual/developer/05_tools_and_utilities.md

+Example useage:
+
+```bash
+$ ./build_products --derivatives


It's better than build_project, but the correct name is build_product.

jan-cerny · 2024-07-09T06:16:59Z

docs/manual/developer/05_tools_and_utilities.md

@@ -743,3 +743,24 @@ An example of how to execute the script to generate roles locally:
 $ ./build_product rhel9
 $ ./utils/ansible_playbook_to_role.py --dry-run output
 ```
+
+### `utils/find_unused_rules.py` &ndash; List Rules That Are Not Used In Any Datastream


Data Stream

jan-cerny · 2024-07-09T06:17:14Z

docs/manual/developer/05_tools_and_utilities.md

+### `utils/find_unused_rules.py` &ndash; List Rules That Are Not Used In Any Datastream
+
+This script will output rules are not in any data streams.
+To prevent false positives the script will not run if the number of build datas treams less than the total number of products in the project.


built data streams

jan-cerny · 2024-07-09T06:17:27Z

utils/find_unused_rules.py

+It requires that all products (and derivatives) are built.
+To do this run ./build_product --derivatives
+The script has the following return codes:
+    0 - All rules are used in the datastreams,


data streams

jan-cerny · 2024-07-09T06:17:36Z

utils/find_unused_rules.py

+To do this run ./build_product --derivatives
+The script has the following return codes:
+    0 - All rules are used in the datastreams,
+    1 - Some rules are not used in the datastreams,


data streams

jan-cerny · 2024-07-09T06:17:59Z

docs/manual/developer/05_tools_and_utilities.md

+The script works by adding off the rule ids from the data streams to a `set`.
+Then the script converts the keys of `rule_dirs.json` to a set.
+The set of rules in the data stream is subtracted to from the set of rules in `rule_dirs.json`.
+The differnce is then output to the user.


jan-cerny · 2024-07-09T06:18:28Z

docs/manual/developer/05_tools_and_utilities.md

+The set of rules in the data stream is subtracted to from the set of rules in `rule_dirs.json`.
+The differnce is then output to the user.
+
+Example useage:


jan-cerny · 2024-07-09T06:20:36Z

utils/find_unused_rules.py

+BUILD_DIR = SSG_ROOT.joinpath("build")
+RULE_DIR_JSON = BUILD_DIR.joinpath("rule_dirs.json")
+EPILOG = """
+This script lists rules that are not used in any datastreams.


data streams

jan-cerny · 2024-07-09T06:21:06Z

utils/find_unused_rules.py

+        ds_products.add(ds.name.split("-")[1])
+    if products_count > len(datastream_files):
+        print("Not all products are built, cowardly refusing to continue.", file=sys.stderr)
+        print(f"Products: {products_count}, Datastreams: {len(datastream_files)}", file=sys.stderr)


Data streams:

jan-cerny · 2024-07-09T06:26:07Z

docs/manual/developer/05_tools_and_utilities.md

+
+This script will output rules are not in any data streams.
+To prevent false positives the script will not run if the number of build datas treams less than the total number of products in the project.
+The script assumes that `./build_project --derivatives` will be ran before the script is used.


codeclimate · 2024-07-09T14:54:49Z

Code Climate has analyzed commit 329047c and detected 1 issue on this pull request.

Here's the issue category breakdown:

Category	Count
Style	1

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

jan-cerny

I have followed the steps in the Example usage doc text. I have reviewed the generated output. This is a great enhancement.

jan-cerny · 2024-07-10T06:22:46Z

The CI fail on OL 7 isn't caused by the contents of this PR. I am fine with the line exceeding its length in this case.

Mab879 added the Infrastructure Our content build system label Jul 1, 2024

Mab879 added this to the 0.1.74 milestone Jul 1, 2024

Mab879 added 3 commits July 1, 2024 12:41

Add script to list rules taht are not used in any data stream

44b81bb

Add docs for utils/find_unused_rules.py

4f94a57

Fix code climate issues in utils/find_unused_rules.py

5d14c90

Mab879 force-pushed the add_script_for_unused_rules branch from 19ec07d to 5d14c90 Compare July 1, 2024 17:41

Mab879 mentioned this pull request Jul 1, 2024

Remove rhel7 only rules #12112

Merged

jan-cerny self-assigned this Jul 2, 2024

jan-cerny reviewed Jul 4, 2024

View reviewed changes

Mab879 added a commit to Mab879/content that referenced this pull request Jul 8, 2024

Address code review comments from ComplianceAsCode#12110

2fbb3fd

Mab879 added a commit to Mab879/content that referenced this pull request Jul 8, 2024

Address code review comments from ComplianceAsCode#12110

d8274c9

Mab879 force-pushed the add_script_for_unused_rules branch from 2fbb3fd to d8274c9 Compare July 8, 2024 14:11

Mab879 requested a review from jan-cerny July 8, 2024 21:20

jan-cerny requested changes Jul 9, 2024

View reviewed changes

Address code review comments from ComplianceAsCode#12110

329047c

Mab879 force-pushed the add_script_for_unused_rules branch from d8274c9 to 329047c Compare July 9, 2024 14:12

jan-cerny approved these changes Jul 10, 2024

View reviewed changes

jan-cerny merged commit d690091 into ComplianceAsCode:master Jul 10, 2024
92 of 94 checks passed

Mab879 deleted the add_script_for_unused_rules branch July 10, 2024 09:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a script for finding unused rules #12110

Add a script for finding unused rules #12110

Mab879 commented Jul 1, 2024

github-actions bot commented Jul 1, 2024

github-actions bot commented Jul 1, 2024 •

edited

Loading

jan-cerny left a comment

Mab879 commented Jul 8, 2024

jan-cerny left a comment

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

jan-cerny Jul 9, 2024

codeclimate bot commented Jul 9, 2024

jan-cerny left a comment

jan-cerny commented Jul 10, 2024

Add a script for finding unused rules #12110

Add a script for finding unused rules #12110

Conversation

Mab879 commented Jul 1, 2024

Description:

Rationale:

Review Hints:

github-actions bot commented Jul 1, 2024

github-actions bot commented Jul 1, 2024 • edited Loading

jan-cerny left a comment

Choose a reason for hiding this comment

Mab879 commented Jul 8, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codeclimate bot commented Jul 9, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

jan-cerny commented Jul 10, 2024

github-actions bot commented Jul 1, 2024 •

edited

Loading