Add ocp4 pci dss references #12309

yuumasato · 2024-08-16T09:23:56Z

Description:

Removes ocp4 rule from pcidss_4.yml.
Rule audit_profile_set is an OCP4, and it was breaking auto referencing in pcidss_4_ocp4.yml
Adds auto referencing to pcidss_4_ocp4.yml.
Add capability to import all controls of a specific level from a foreign policy.
- For example, the OCP4 PCI-DSS v4.0 control file imports all OCP4 CIS controls in Req 2.2 with cis_ocp_1_4_0:all:level_2

Rationale:

Ensures the rules used in PCI-DSS v4 profile reference the requirement they are supporting.

Review Hints:

Checkout compliance-operator
gh co 594
$ CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12309 make deploy-local

$ oc get rule ocp4-api-server-tls-cert -oyaml
...
id: xccdf_org.ssgproject.content_rule_api_server_tls_cert
kind: Rule
metadata:
  annotations:
    compliance.openshift.io/image-digest: pb-upstream-ocp45qsp7
    compliance.openshift.io/profiles: upstream-ocp4-high,upstream-ocp4-nerc-cip,upstream-ocp4-cis-1-4,upstream-ocp4-moderate-rev-4,upstream-ocp4-cis,upstream-ocp4-cis-1-5,upstream-ocp4-moderate,upstream-ocp4-pci-dss,upstream-ocp4-pci-dss-3-2,upstream-ocp4-high-rev-4,upstream-ocp4-pci-dss-4-0
    compliance.openshift.io/rule: api-server-tls-cert
    control.compliance.openshift.io/CIS-OCP: 1.2.28
    control.compliance.openshift.io/NERC-CIP: CIP-003-8 R4.2;CIP-007-3 R5.1
    control.compliance.openshift.io/NIST-800-53: SC-8;SC-8(1);SC-8(2)
    control.compliance.openshift.io/PCI-DSS: Req-2.2;Req-2.2.3;Req-2.3
->  control.compliance.openshift.io/PCI-DSS-4-0: 2.2.5;2.2.7;4.2.1  <-
    control.compliance.openshift.io/STIG: SRG-APP-000441-CTR-001090;SRG-APP-000442-CTR-001095
    policies.open-cluster-management.io/controls: CIP-003-8 R4.2,CIP-007-3 R5.1,SC-8,SC-8(1),SC-8(2),Req-2.2,Req-2.2.3,Req-2.3,SRG-APP-000441-CTR-001090,SRG-APP-000442-CTR-001095,1.2.28,2.2.5,2.2.7,4.2.1
    policies.open-cluster-management.io/standards: NERC-CIP,NIST-800-53,PCI-DSS,STIG,CIS-OCP,PCI-DSS-4-0
...

github-actions · 2024-08-16T09:25:22Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-08-16T09:45:04Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12309
This image was built from commit: 4d8484e

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12309

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12309 make deploy-local

controls/pcidss_4.yml

controls/pcidss_4_ocp4.yml

rhmdnd · 2024-08-21T20:23:14Z

I deployed this change into a cluster, then attempted to verify each rule in the PCI-DSS profiles has the expected reference, but only a handful of them did. Here are the steps I used to reproduce:

Grab a list of all the rules associated with the profile

$  oc get profiles ocp4-pci-dss-node-4-0 -o yaml > 4-0-node-rules.txt

Trimmed out all the data but rules separated by newlines

$ head 4-0-node-rules.txt 
ocp4-directory-access-var-log-kube-audit
ocp4-directory-access-var-log-oauth-audit
ocp4-directory-access-var-log-ocp-audit
ocp4-directory-permissions-var-log-kube-audit
ocp4-directory-permissions-var-log-oauth-audit
ocp4-directory-permissions-var-log-ocp-audit
ocp4-etcd-unique-ca
ocp4-file-groupowner-cni-conf
ocp4-file-groupowner-controller-manager-kubeconfig
ocp4-file-groupowner-etcd-data-dir

Check annotations for each rule

$ for r in $(cat 4-0-node-rules.txt); do oc get rules $r -o json | jq '.metadata.annotations."control.compliance.openshift.io/PCI-DSS-4-0"'; done                                                                                                                                                                                                                                                                    130 ↵
"10.3.2"
"10.3.2"
"10.3.2"
"10.3.2"
"10.3.2"
"10.3.2"
null
null
null
null
null
null
null
null
null
null
null
null

Is this expected?

yuumasato · 2024-08-22T10:04:36Z

Interesting, the rules without PCI-DSS-4-0 annotation references are the rules we inherited from CiS, because we extend the CIS profiles as part of requirement 2.2.1 which is is about developing, implementing and maintaining configuration standards consistent with industry-accepted hardening standards. So we include CIS rules.

The auto-referencing works on the rules selected in the Control file, these are rules added by extension.
Another point is that these inherited rules miss PCI-DSS 3.2.1 references as well.

Let me see if I can make it work...

yuumasato · 2024-08-26T12:58:18Z

@rhmdnd All the CIS rules added as part of 2.2 now have PCI-DSS references.

yuumasato · 2024-08-26T13:00:43Z

@Mab879 @jan-cerny in c63cb65 I have extended nesting of controls to support all key, works like in the *.profile files. Please take a look.

The reason I change from extending CIS profile to importing all CIS controls, is to take advantage of the auto-referencing of rules in the control file.

rhmdnd · 2024-08-26T21:21:44Z

products/ocp4/profiles/pci-dss-4-0.profile

@@ -18,8 +18,6 @@ description: |-

 filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'

-# Req-2.2
-extends: cis


Is it safe to assume this is the old way of doing things, and what you did on 2438f12#diff-67844ce694c84c54b76dac7610bc6443a329477c4a685417d3aaa1eae7b6e29cR391 is how we should be doing it moving forward?

I guess so, if one wants to take advantage of auto-referencing in control files.

rhmdnd

/lgtm

Works for me in my cluster with the latest profiles, thanks!

yuumasato · 2024-08-27T08:30:57Z

@Mab879 @jan-cerny Test added for the import of controls with all key.

xiaojiey · 2024-08-27T09:05:53Z

/hold for test

The audit_profile_set rule is an OCP rule, and is not necessary in this control file. Also, this rules is already selected in the pcidss_4_ocp4 control file, and breaks the auto referencing feature

Let's auto ref the PCI-DSS v4.0 rules

New platforms for node were added and these profiles were not updated to exclude these new node platforms.

Allow a control to extend all controls of a policy with 'all' key.

Change Control.add_references() to iterate over the selected rules, not the listed rules. There can be differences on the rules in 'selected' and 'rules'. When the Control is resolved, the final list of selected rules is in 'selected'. This is particularly more evident when we are importing other controls.

When a profile extends another one, the rules on the extended profile are not auto referenced. This patch importa the CIS into PCI-DSS, allowing the CIS rules to have PCI-DSS added automatically.

Test import of all controls of a specific level.

yuumasato · 2024-08-27T13:10:00Z

Rebased to address codeclimate issues.

codeclimate · 2024-08-27T13:49:53Z

Code Climate has analyzed commit 4d8484e and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.1% change).

View more on Code Climate.

jan-cerny

I have built the ocp4 product and reviewed the resolved control file at build/ocp4/controls/pcidss_4_ocp4.yml. The control includes rules form the CIS controls. It seems to work correctly.

xiaojiey · 2024-08-30T09:58:20Z

@yuumasato I am not sure if there is anything wrong.
Now I can see all rules have
"control.compliance.openshift.io/PCI-DSS-4-0": "4.2.1;4.2" annotations. Is it expected behavior? Thanks.

1. Check all rules in ocp4-pci-dss-4-0 and ocp4-pci-dss-node-4-0
% oc get profile upstream-ocp4-pci-dss-4-0 -o=jsonpath={.rules} | jq -r > ocp4_pci_40     
% oc get profile upstream-ocp4-pci-dss-node-4-0 -o=jsonpath={.rules} | jq -r >> ocp4_pci_40
2. #Trim the data in ocp4_pci_40 and save all rules info into a file called rules. And check the annotation.
% for rule in `cat rules`; do oc get rule $r -o json | jq '.metadata.annotations."control.compliance.openshift.io/PCI-DSS-4-0"'; done 
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
"4.2.1;4.2"
...

xiaojiey · 2024-08-30T09:59:57Z

/hold for test

xiaojiey · 2024-08-30T11:51:44Z

sorry, a stupid typo error. The PR works well.

% for rule in `cat rules`; do oc get rule $rule -o json | jq '.metadata.annotations."control.compliance.openshift.io/PCI-DSS-4-0"'; done 
"2.2.1;2.2"
"2.2.1;2.2"
"11.5.1.1;11.5.1;11.5"
"10.7.2;10.7"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2"
"2.2.1;2.2.5;2.2.7;2.2"
"2.2.1;2.2.5;2.2.7;2.2"
"2.2.1;2.2;3.5.1.3;3.5.1;3.5"
"2.2.1;2.2.5;2.2.7;2.2"
...

yuumasato added the OpenShift OpenShift product related. label Aug 16, 2024

yuumasato requested review from rhmdnd, xiaojiey and Vincent056 August 16, 2024 09:51

rhmdnd added this to the 0.1.75 milestone Aug 16, 2024

rhmdnd reviewed Aug 16, 2024

View reviewed changes

controls/pcidss_4.yml Show resolved Hide resolved

rhmdnd reviewed Aug 16, 2024

View reviewed changes

controls/pcidss_4_ocp4.yml Show resolved Hide resolved

yuumasato force-pushed the add_ocp4_pci_dss_references branch 2 times, most recently from 9d7e6d8 to 2c447bd Compare August 26, 2024 12:55

yuumasato force-pushed the add_ocp4_pci_dss_references branch from 2c447bd to 2438f12 Compare August 26, 2024 14:12

rhmdnd reviewed Aug 26, 2024

View reviewed changes

rhmdnd approved these changes Aug 26, 2024

View reviewed changes

yuumasato added Infrastructure Our content build system pci-dss labels Aug 27, 2024

openshift-ci bot added the do-not-merge/hold Used by openshift-ci-robot bot. label Aug 27, 2024

yuumasato added 7 commits August 27, 2024 15:09

Remove ocp4 rule from rhel control

4838606

The audit_profile_set rule is an OCP rule, and is not necessary in this control file. Also, this rules is already selected in the pcidss_4_ocp4 control file, and breaks the auto referencing feature

Add pcidss4 reference to OCP4 control

9de4d0f

Let's auto ref the PCI-DSS v4.0 rules

Update version-less PCI-DSS profile to v4.0

9d92335

Update PCI-DSS platform profile filters

c2a587c

New platforms for node were added and these profiles were not updated to exclude these new node platforms.

Expand control processing to 'all' key

dba80db

Allow a control to extend all controls of a policy with 'all' key.

Import OCP4 CIS rather than extending it

7d982e8

When a profile extends another one, the rules on the extended profile are not auto referenced. This patch importa the CIS into PCI-DSS, allowing the CIS rules to have PCI-DSS added automatically.

Add test for imports of 'all' controls

4d8484e

Test import of all controls of a specific level.

yuumasato force-pushed the add_ocp4_pci_dss_references branch from 5d69b16 to 4d8484e Compare August 27, 2024 13:09

yuumasato requested review from Mab879 and jan-cerny August 27, 2024 14:11

jan-cerny self-assigned this Aug 30, 2024

jan-cerny approved these changes Aug 30, 2024

View reviewed changes

jan-cerny merged commit f088dcf into ComplianceAsCode:master Aug 30, 2024
100 checks passed

yuumasato deleted the add_ocp4_pci_dss_references branch August 30, 2024 11:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ocp4 pci dss references #12309

Add ocp4 pci dss references #12309

yuumasato commented Aug 16, 2024 •

edited

Loading

github-actions bot commented Aug 16, 2024

github-actions bot commented Aug 16, 2024 •

edited

Loading

rhmdnd commented Aug 21, 2024

yuumasato commented Aug 22, 2024

yuumasato commented Aug 26, 2024

yuumasato commented Aug 26, 2024 •

edited

Loading

rhmdnd Aug 26, 2024

yuumasato Aug 27, 2024

rhmdnd left a comment

yuumasato commented Aug 27, 2024 •

edited

Loading

xiaojiey commented Aug 27, 2024

yuumasato commented Aug 27, 2024

codeclimate bot commented Aug 27, 2024

jan-cerny left a comment

xiaojiey commented Aug 30, 2024 •

edited

Loading

xiaojiey commented Aug 30, 2024

xiaojiey commented Aug 30, 2024

Add ocp4 pci dss references #12309

Add ocp4 pci dss references #12309

Conversation

yuumasato commented Aug 16, 2024 • edited Loading

Description:

Rationale:

Review Hints:

github-actions bot commented Aug 16, 2024

github-actions bot commented Aug 16, 2024 • edited Loading

rhmdnd commented Aug 21, 2024

yuumasato commented Aug 22, 2024

yuumasato commented Aug 26, 2024

yuumasato commented Aug 26, 2024 • edited Loading

rhmdnd Aug 26, 2024

Choose a reason for hiding this comment

yuumasato Aug 27, 2024

Choose a reason for hiding this comment

rhmdnd left a comment

Choose a reason for hiding this comment

yuumasato commented Aug 27, 2024 • edited Loading

xiaojiey commented Aug 27, 2024

yuumasato commented Aug 27, 2024

codeclimate bot commented Aug 27, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

xiaojiey commented Aug 30, 2024 • edited Loading

xiaojiey commented Aug 30, 2024

xiaojiey commented Aug 30, 2024

yuumasato commented Aug 16, 2024 •

edited

Loading

github-actions bot commented Aug 16, 2024 •

edited

Loading

yuumasato commented Aug 26, 2024 •

edited

Loading

yuumasato commented Aug 27, 2024 •

edited

Loading

xiaojiey commented Aug 30, 2024 •

edited

Loading