OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d #13218

jan-cerny · 2025-03-21T17:48:51Z

This PR updates rule audit_rules_sudoers and audit_rules_sudoers_d. Instead of static checks and remediations it will now use the template audit_rules_watch. This change has 3 advantages:

reduces code duplication
adds support for modern style of audit watches to the rule
removes inconsistencies inside the rule

For more information, please read commit messages of all commits.

github-actions · 2025-03-21T17:55:02Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts'.
--- xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts
+++ xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification_network_scripts
@@ -3,14 +3,17 @@
 Record Events that Modify the System's Network Environment
 
 [description]:
-If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following line to a file with suffix .rules in the
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
 directory /etc/audit/rules.d:
+
 -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts
+
 If the auditd daemon is configured to use the auditctl
-utility to read audit rules during daemon startup, add the following line to
-/etc/audit/audit.rules file:
+utility to read audit rules during daemon startup, add the following lines to
+/etc/audit/audit.rules:
+
 -w /etc/sysconfig/network-scripts -p wa -k audit_rules_networkconfig_modification_network_scripts
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers'.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers
@@ -4,14 +4,22 @@
 
 [description]:
 At a minimum, the audit system should collect administrator actions
-for all users and root. If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the default),
-add the following line to a file with suffix .rules in the directory
-/etc/audit/rules.d:
+for all users and root.
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
 -w /etc/sudoers -p wa -k actions
+
 If the auditd daemon is configured to use the auditctl
-utility to read audit rules during daemon startup, add the following line to
-/etc/audit/audit.rules file:
+utility to read audit rules during daemon startup, add the following lines to
+/etc/audit/audit.rules:
+
 -w /etc/sudoers -p wa -k actions
 
 [reference]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers' differs.
--- ocil:ssg-audit_rules_sudoers_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_sudoers_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers" with the following command:
+
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/sudoers" with the following command:
 
 $ sudo auditctl -l | grep /etc/sudoers
 
--w /etc/sudoers -p wa -k identity
+-w /etc/sudoers -p wa -k actions
       Is it the case that the command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers
@@ -2,6 +2,12 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
+
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
 #

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d'.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
@@ -4,14 +4,22 @@
 
 [description]:
 At a minimum, the audit system should collect administrator actions
-for all users and root. If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the default),
-add the following line to a file with suffix .rules in the directory
-/etc/audit/rules.d:
+for all users and root.
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
 -w /etc/sudoers.d/ -p wa -k actions
+
 If the auditd daemon is configured to use the auditctl
-utility to read audit rules during daemon startup, add the following line to
-/etc/audit/audit.rules file:
+utility to read audit rules during daemon startup, add the following lines to
+/etc/audit/audit.rules:
+
 -w /etc/sudoers.d/ -p wa -k actions
 
 [reference]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d' differs.
--- ocil:ssg-audit_rules_sudoers_d_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_sudoers_d_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/sudoers.d/" with the following command:
 
-$ sudo auditctl -l | grep/etc/sudoers.d
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/etc/sudoers" with the following command:
 
--w /etc/sudoers.d/ -p wa -k identity
+$ sudo auditctl -l | grep /etc/sudoers
+
+-w /etc/sudoers -p wa -k actions
       Is it the case that the command does not return a line, or the line is commented out?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
+++ xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d
@@ -2,6 +2,12 @@
 if rpm --quiet -q audit && rpm --quiet -q kernel; then
 
 # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
+
+
+
+
+
+
 # Create a list of audit *.rules files that should be inspected for presence and correctness
 # of a particular audit rule. The scheme is as follows:
 #

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_sudo_log_events'.
--- xccdf_org.ssgproject.content_rule_audit_sudo_log_events
+++ xccdf_org.ssgproject.content_rule_audit_sudo_log_events
@@ -10,6 +10,23 @@
 Verify the operating system audits activities performed during nonlocal
 maintenance and diagnostic sessions. Run the following command:
 $ sudo auditctl -l | grep sudo.log
+-w /var/log/sudo.log -p wa -k maintenance
+
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
+
+-w /var/log/sudo.log -p wa -k maintenance
+
+If the auditd daemon is configured to use the auditctl
+utility to read audit rules during daemon startup, add the following lines to
+/etc/audit/audit.rules:
+
 -w /var/log/sudo.log -p wa -k maintenance
 
 [reference]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_sudo_log_events' differs.
--- ocil:ssg-audit_sudo_log_events_ocil:questionnaire:1
+++ ocil:ssg-audit_sudo_log_events_ocil:questionnaire:1
@@ -1,7 +1,8 @@
-Verify the operating system audits activities performed during nonlocal
-maintenance and diagnostic sessions. Run the following command:
-$ sudo auditctl -l | grep sudo.log
+
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/var/log/sudo.log" with the following command:
+
+$ sudo auditctl -l | grep /var/log/sudo.log
+
 -w /var/log/sudo.log -p wa -k maintenance
-
       Is it the case that Audit rule is not present?
       
New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock'.
--- xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock
+++ xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock
@@ -4,18 +4,21 @@
 
 [description]:
 The audit system already collects login information for all users
-and root. If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d in order to watch for attempted manual
-edits of files involved in storing logon events:
+and root.
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
 
 -w 'xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir' -p wa -k logins
 
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file in order to watch for unattempted manual
-edits of files involved in storing logon events:
+/etc/audit/audit.rules:
 
 -w 'xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_dir' -p wa -k logins
 

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock' differs.
--- ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1
@@ -1,4 +1,5 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/etc/security/opasswd" with the following command:
+
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "" with the following command:
 
 $ sudo auditctl -l | grep 
 

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog'.
--- xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog
+++ xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog
@@ -4,18 +4,21 @@
 
 [description]:
 The audit system already collects login information for all users
-and root. If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d in order to watch for attempted manual
-edits of files involved in storing logon events:
+and root.
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
 
 -w /var/log/lastlog -p wa -k logins
 
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file in order to watch for unattempted manual
-edits of files involved in storing logon events:
+/etc/audit/audit.rules:
 
 -w /var/log/lastlog -p wa -k logins
 

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog' differs.
--- ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1
@@ -1,4 +1,5 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/lastlog" with the following command:
+
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/var/log/lastlog" with the following command:
 
 $ sudo auditctl -l | grep /var/log/lastlog
 

New content has different text for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog'.
--- xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog
+++ xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog
@@ -4,18 +4,21 @@
 
 [description]:
 The audit system already collects login information for all users
-and root. If the auditd daemon is configured to use the
-augenrules program to read audit rules during daemon startup (the
-default), add the following lines to a file with suffix .rules in the
-directory /etc/audit/rules.d in order to watch for attempted manual
-edits of files involved in storing logon events:
+and root.
+
+
+
+
+If the auditd daemon is configured to use the augenrules
+program to read audit rules during daemon startup (the default), add the
+following lines to a file with suffix .rules in the
+directory /etc/audit/rules.d:
 
 -w /var/log/tallylog -p wa -k logins
 
 If the auditd daemon is configured to use the auditctl
 utility to read audit rules during daemon startup, add the following lines to
-/etc/audit/audit.rules file in order to watch for unattempted manual
-edits of files involved in storing logon events:
+/etc/audit/audit.rules:
 
 -w /var/log/tallylog -p wa -k logins
 

OCIL for rule 'xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog' differs.
--- ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1
+++ ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1
@@ -1,7 +1,7 @@
-Verify Red Hat Enterprise Linux 8 generates audit records for all account creations, modifications, disabling, and termination events that affect "/var/log/tallylog" with the following command:
+
+Verify Red Hat Enterprise Linux 8 generates audit records for all events that affect "/var/log/tallylog" with the following command:
 
 $ sudo auditctl -l | grep /var/log/tallylog
-
 
 -w /var/log/tallylog -p wa -k logins
       Is it the case that the command does not return a line, or the line is commented out?

Mab879 · 2025-03-27T17:31:16Z

This PR is ready for a rebase @jan-cerny.

teacup-on-rockingchair

Nice stuff 🙇

Unify rule descriptions of rules using the `audit_rules_watch` template. This reduces code duplication.

The rule audit_rules_sudoers will now use template audit_rules_watch instead of static checks and remediations. This change has 3 advantages: 1. reduces code duplication 2. adds support for modern style of audit watches to the rule 3. removes inconsistencies inside the rule

Create a Jinja macro for OCIL text for rules using the `audit_login_events` platform. This unifies code and reduces code duplication. The OCIL code will suppport the modern style watches.

This commit adds support for directories in the audit_rules_watch template if using the modern style of watches. In modern style, the "-F" option needs to be "path" for individual files and "dir" for directories.

The rule audit_rules_mac_modification_etc_selinux configures an audit watch for the "/etc/selinux" directory. If modern style watches are used, we need to pass the "path" parameter in a directory format because the template needs to generate a different audit watch for directories. They need to contain "-F dir" instead of "-F path".

We can use template audit_rules_watch to generate checks, remediations and tests for rule audit_rules_sudoers_d. This will reduce code duplication. Additionally, this will add support for modern style watches on RHEL 10 for this rule because the template already implements them.

jan-cerny · 2025-03-28T09:43:15Z

I have rebased this PR on the top of the latest upstream master branch.

qlty-cloud-legacy · 2025-03-28T10:15:29Z

Code Climate has analyzed commit 299099f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.0% (0.0% change).

View more on Code Climate.

Mab879 · 2025-03-28T14:08:58Z

Automatus tests pass locally

jan-cerny requested review from a team as code owners March 21, 2025 17:48

jan-cerny added the Update Rule Issues or pull requests related to Rules updates. label Mar 21, 2025

jan-cerny added this to the 0.1.77 milestone Mar 21, 2025

jan-cerny marked this pull request as draft March 25, 2025 13:09

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 25, 2025

jan-cerny mentioned this pull request Mar 27, 2025

OPENSCAP-4951: Support modern watches in audit_rules_sysadmin_actions #13242

Merged

jan-cerny changed the title ~~OPENSCAP- 4949 - Change audit watches in rule audit_rules_sudoers~~ OPENSCAP- 4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers Mar 27, 2025

jan-cerny changed the title ~~OPENSCAP- 4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers~~ OPENSCAP- 4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d Mar 27, 2025

jan-cerny marked this pull request as ready for review March 27, 2025 14:56

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 27, 2025

jan-cerny mentioned this pull request Mar 27, 2025

OPENSCAP-4952: Use template in audit_rules_time_watch_localtime #13244

Merged

jan-cerny changed the title ~~OPENSCAP- 4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d~~ OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d Mar 27, 2025

Mab879 self-assigned this Mar 27, 2025

teacup-on-rockingchair approved these changes Mar 28, 2025

View reviewed changes

jan-cerny added 7 commits March 28, 2025 10:29

Unify rule descriptions

163ec1e

Unify rule descriptions of rules using the `audit_rules_watch` template. This reduces code duplication.

Unify OCIL

ecd52fc

Create a Jinja macro for OCIL text for rules using the `audit_login_events` platform. This unifies code and reduces code duplication. The OCIL code will suppport the modern style watches.

Add support for directories in audit_rules_watch

65bbeb9

This commit adds support for directories in the audit_rules_watch template if using the modern style of watches. In modern style, the "-F" option needs to be "path" for individual files and "dir" for directories.

Fix missing variable in a test scenario

5d87de2

jan-cerny force-pushed the audit_rules_sudoers branch from f38bff9 to 299099f Compare March 28, 2025 09:42

Mab879 approved these changes Mar 28, 2025

View reviewed changes

Mab879 merged commit 117eccf into ComplianceAsCode:master Mar 28, 2025
108 of 110 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d #13218

OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d #13218

Uh oh!

jan-cerny commented Mar 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Mar 21, 2025 •

edited

Loading

Uh oh!

Mab879 commented Mar 27, 2025

Uh oh!

teacup-on-rockingchair left a comment

Uh oh!

jan-cerny commented Mar 28, 2025

Uh oh!

qlty-cloud-legacy bot commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d #13218

OPENSCAP-4949, OPENSCAP-4950 - Change audit watches in rule audit_rules_sudoers and audit_rules_sudoers_d #13218

Uh oh!

Conversation

jan-cerny commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mab879 commented Mar 27, 2025

Uh oh!

teacup-on-rockingchair left a comment

Choose a reason for hiding this comment

Uh oh!

jan-cerny commented Mar 28, 2025

Uh oh!

qlty-cloud-legacy bot commented Mar 28, 2025

Uh oh!

Mab879 commented Mar 28, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jan-cerny commented Mar 21, 2025 •

edited

Loading

github-actions bot commented Mar 21, 2025 •

edited

Loading