Hello all,
I would like to introduce a planed improvement within the area of
applicability of rules / groups / profiles for specific platforms. I
would like to ask you to provide feedback, especially with regards to
content authoring experience.
Currently, you can use the "platform:" keyword to mark a part of SSG
content as applicable for a given platform. This can be done in scope of
profile, group and rule.
Notice that these three scopes are listed in the specific order, as they
go in hierarchy from profile (highest level) to rule (lowest level).
Currently, platforms propagate through this hierarchy. So if you specify
that some profile is applicable only to "machine" platform, all rules
within this profile will be applicable only to the "machine" platform.
The same is true for groups; all rules within a group will inherit a
platform specified for the group.
These platforms are connected with implicit AND. Please note that
currently you can specify only ONE platform per profile / group / rule.
But what if you want to make rule applicable to combination of
platforms? For example there is a rule for ntpd OR chrony:
https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/se...
This is currently not possible.
Or what if you want to make rule applicable to conjunction of platforms,
e.g. rule should be applied if Grub2 is installed and UEFI is used.
https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/sy...
https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/sy...
This is currently possible, but it involves creating groups and abusing
the fact that group applicability is connected with AND with rule
applicability (XCCDF specification).
We would like to change this and make applicability more flexible.
Changes are planed for profile, group and rule definitions.
The first change should allow to define multiple independent platforms.
A new keyword "platforms" will be added. It will expect a list of
platforms. All platforms in the list will be connected with "OR". For
example, for the rule about ntpd and chrony, you could specify:
```
platforms:
- ntp
- chrony
```
The change is backward compatible, it is still possible to specify
single platform through
```
platform: platform_name
```
This change is already being implemented here:
https://github.com/ComplianceAsCode/content/pull/6661
We chose this approach because it is easy to implement. XCCDF
specification already allows to specify multiple platforms per
group/profile/rule and they are implicitly connected with OR.
The next step will be implementing of support for specification of
multiple combined platforms (joining platforms with AND).
The specification would utilize the previous syntax but additionally it
could include a special character, e.g. &.
To specify applicability only for cases when Grub2 and UEFI are present
at the same time, it could be:
```
platforms:
- grub2 & uefi
```
To specify platform for Zipl or Grub2 bootloader but only if UEFI is
used, it could be:
```
platforms:
- zipl & uefi
- grub2 & uefi
```
This change would start using CPE applicability language to define new
platforms which would be created at build time.
What do you think about this initiative? Awaiting your feedback.
Best regards,
Vojtech Polasek
Software engineer, security compliance
Red Hat <
https://www.redhat.com>
vpolasek(a)redhat.com <mailto:vpolasek@redhat.com>
<
https://www.redhat.com>