-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
V1r2 #37
Conversation
Signed-off-by: wdower <will@dower.dev>
…ta not run yet) Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <will@dower.dev>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
… use (can add keys to the hash for other file mode checks later Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
…Y have the 'is_router' caveat if that caveat is explicitly described in the check text Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: Aaron Lippold <lippold@gmail.com>
…, bumped upload-artifact version, removed unneeded pipeline step Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
… in 257937 Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
… name conflicts Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
…h, adding some caveat inputs for network settings that need to be enabled Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Co-authored-by: Amndeep Singh Mann <me@asm.works>
} | ||
|
||
parameter = 'kernel.core_pattern' | ||
value = 1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
value = 1 | |
value = "|/bin/false" |
!virtualization.system.eql?('docker') | ||
} | ||
|
||
exempt_home_users = input('exempt_home_users') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
input naming is inconsistent - sometimes 'exempt' vs 'exemptions' and having that keyword at the beginning or end of the name (beginning here, others have it at the end)
@@ -23,4 +23,14 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,14 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,14 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,14 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,10 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,10 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
|
||
describe file('/etc/group') do | ||
it { should exist } | ||
its('group') { should cmp 'root' } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can't we use the grouped_into function here?
this comment applies to all the controls that are having us (as opposed to presumably the resource) directly do string comparison to check the group
its('group') { should cmp 'root' } | |
it { should be_grouped_into 'root' } |
@@ -23,4 +23,10 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,10 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
@@ -23,4 +23,10 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
|
||
audit_tools = ['/sbin/auditctl', '/sbin/aureport', '/sbin/ausearch', '/sbin/autrace', '/sbin/auditd', '/sbin/rsyslogd', '/sbin/augenrules'] | ||
|
||
failing_tools = audit_tools.reject { |at| file(at).owned_by?('root') } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
huh, I think I like reject better than the filter NOTs that have been happening elsewhere. maybe this could be added as another todo item on the consistency fixes issue?
|
||
audit_tools = ['/sbin/auditctl', '/sbin/aureport', '/sbin/ausearch', '/sbin/autrace', '/sbin/auditd', '/sbin/rsyslogd', '/sbin/augenrules'] | ||
|
||
failing_tools = audit_tools.reject { |at| file(at).group == 'root' } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this should probably still be using the grouped_into func instead of doing a straight string comparison
failing_tools = audit_tools.reject { |at| file(at).group == 'root' } | |
failing_tools = audit_tools.reject { |at| file(at).grouped_into? 'root' } |
@@ -29,4 +29,15 @@ | |||
tag 'documentable' | |||
tag cci: ['CCI-000366'] | |||
tag nist: ['CM-6 b'] | |||
tag 'host', 'container' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tag 'host', 'container' | |
tag 'host' | |
tag 'container' |
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Co-authored-by: Amndeep Singh Mann <me@asm.works>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
…imdall for an easier time hooking it up with kitchen Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
…7949 Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Signed-off-by: wdower <57142072+wdower@users.noreply.github.com>
Initializing profile repo at v1r2.