Dne 13. 11. 20 v 11:16 Watson Sato napsal(a):
I like the idea. How about adding example answers? They can illustrate and hint to what is expected.
Good idea, I will propose them below. Thank you.
On Thu, Nov 12, 2020 at 8:39 AM Vojtech Polasek <vpolasek@redhat.com mailto:vpolasek@redhat.com> wrote:
Dne 11. 11. 20 v 20:50 Gabe Alford napsal(a):Looks good. I assume that this is going to be in addition to and not a replacement of the existing template? Having more than one issue template that GH creates a menu for you to choose is kinda nice.Correct, this will be an additional template, the existing one for reporting issues whill stay there. VojtaOn Fri, Nov 6, 2020 at 8:54 AM Vojtech Polasek <vpolasek@redhat.com <mailto:vpolasek@redhat.com>> wrote: Hello all, I would like to propose a new Github issue template which should make requesting a new SCAP rule easier. It should guide the issue reporter and answer questions which are important for content authors right away. Here is the list of questions I would like to have in the template. Please feel free to give any feedback, ideally until Monday November 16. ~~~ ##Which products does the rule apply to?
example: fedora, rhel8
##Describe the configuration setting enforced by this rule.
example: The default Grub2 command line for the Linux operating system must contain the audit=1 argument. In case of Fedora, the file /boot/grub2/grubenv contains line in form:
kernelopts=<arguments_separated_by_spaces>
One of present arguments must be audit=1.
##Why is the configuration security relevant?
example: This configuration ensures that all auditable processes are audited already during the boot process even before the Auditd starts. This ensures that potential malicious activity is monitored during boot process.
##How to check the configuration?
example: sudo grep 'kernelopts.*audit=1.*' /boot/grub2/grubenv
###Is it order dependent? (does it need to be at certain place in the file?
example: The audit=1 argument can be at any place within the list of arguments for the Linux kernel. There should be only one line starting with kernelopts=. Only one occurence of audit=1 should occur. There should not be any audit=0 in the list of arguments.
###What is correct and incorrect syntax?
example: kernelopts=arg1 arg2 audit=1 arg3
##How to remediate
example: Ensure that the argument is present in the kernelopts=... line.
###Does any command need to be run?
example: The following command may be used:
sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"
##Are there going to be other rules like (similar configuration) this in the future? (is it worth creating template?)
example: Yes, there will be more checks for Grub2 kernel command line arguments.
##Are there any caveats to be considered when testing?
example: Yes. This configuration works only on systems with Grub2 bootloader. Hardware not supported by Grub2 will be covered by a separate rule.
##Is the configuration loaded directly by the <software> or is it stored in some intermediate database (similar to dconf)? (We want to edit the lowest level possible, if appropriate)
example: The file is loaded by Grub2 directly.
##Is it possible to check / remediate this configuration in offline mode? (scanning containers or offline systems)
example: This option can be checked in offline mode.
## Please provide security policy references if possible e.g. STIG
example: srg: SRG-OS-000254-GPOS-00095
hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(C),164.310(a)(2)(iv),164.310(d)(2)(iii),164.312(b)
~~~ Have a nice weekend, -- Vojtech Polasek Software engineer, security compliance Red Hat <https://www.redhat.com> vpolasek@redhat.com <mailto:vpolasek@redhat.com> <https://www.redhat.com> _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org <mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org <mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org <https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org> _______________________________________________ scap-security-guide mailing list --scap-security-guide@lists.fedorahosted.org <mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email toscap-security-guide-leave@lists.fedorahosted.org <mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives:https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org <https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org>_______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org <mailto:scap-security-guide@lists.fedorahosted.org> To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org <mailto:scap-security-guide-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org <https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedorahosted.org>--
Watson Sato
Software Engineer
Red Hat EMEA https://www.redhat.com
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...