Add initial Ubuntu 20.04 CIS Profiles #7181
Conversation
cipherboy
added
Ubuntu
|
@cipherboy: GitHub didn't allow me to request PR reviews from the following users: richardmaciel-canonical, dodys. Note that only ComplianceAsCode members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
cipherboy
force-pushed
the
initial-cis-profiles
branch
from
59d15f4 to
dfb3b3b
Compare
cipherboy
force-pushed
the
initial-cis-profiles
branch
from
dfb3b3b to
6d5ca5f
Compare
| - partition_for_tmp | ||
|
|
||
| ### 1.1.3 Ensure nodev option set on /tmp partition (Automated) | ||
| # Needs rule |
There was a problem hiding this comment.
Just as an FYI, these and others in this subsection are ones I was talking about w.r.t. _optional form; we can introduce them upstream in a future PR.
There was a problem hiding this comment.
Changes look good to me, but I haven't checked the Ubuntu CIS references.
@cipherboy I trust that somebody else has reviewed them for you.
This takes inspiration from ComplianceAsCode#6416 and Canonical's present internal branch; rules which don't yet exist in upstream were dropped from these profiles. Over time more rules will be added and these will align better with our internal profiles. Co-Authored-By: Brian Turek <[email protected]> Co-Authored-By: Gabriel Becker <[email protected]> Co-Authored-By: Richard Maciel Costa <[email protected]> Signed-off-by: Alexander Scheel <[email protected]>
This is an automated commit. To regenerate, run:
./utils/rule_dir_json.py
./utils/autoprodtyper.py ubuntu2004 cis_level1_server
Signed-off-by: Alexander Scheel <[email protected]>
This is an automated commit. To regenerate, run:
./utils/rule_dir_json.py
./utils/autoprodtyper.py ubuntu2004 cis_level2_server
Signed-off-by: Alexander Scheel <[email protected]>
This is an automated commit. To regenerate, run:
./utils/rule_dir_json.py
./utils/autorefer.py ubuntu2004 cis_level1_server cis
Signed-off-by: Alexander Scheel <[email protected]>
This is an automated commit. To regenerate, run:
./utils/rule_dir_json.py
./utils/autorefer.py ubuntu2004 cis_level2_server cis
Signed-off-by: Alexander Scheel <[email protected]>
Co-Authored-By: Brian Turek <[email protected]> Co-Authored-By: Gabriel Becker <[email protected]> Co-Authored-By: Richard Maciel Costa <[email protected]> Signed-off-by: Alexander Scheel <[email protected]>
cipherboy
force-pushed
the
initial-cis-profiles
branch
from
6d5ca5f to
6058606
Compare
|
Rebased to fix merge conflicts. |
|
Thanks for the merge, @yuumasato :-) |
2 participants
Description:
This pull request adds initial Ubuntu 20.04 CIS profiles (at all four combinations of applicability) based on the existing profile mechanism. We use profile inheritance to minimize the size of profiles after CIS Level 1 server. This is based on work originally on pull request #6416 and supersedes it. Included are completed profiles minus rules not yet in upstream from our internal fork; those may be added at later time.
Additionally, this pull request adds missing CIS references and Ubuntu prodtypes to rules used in these profiles so they could build. This is done using automated tooling previously upstreamed (or attempted to be, see the failed autorefer pull request in #6908). Note that sorting of references was not done, as that PR isn't yet merged (#6882) either.
Once this change set is merged, in the immediate future, other changes to existing rules will be upstreamed. Additionally, depending on how this goes, @dodys is working on a STIG profile, which we might want to upstream as well.
Note: At this point in time, the profiles themselves are completed, but testing of all rules &c for Ubuntu applicability/functionality is not yet done and obviously not all rule changes have yet been upstreamed (though, numerous changes have been made internally). If you'd like us to mark it
documentation_complete: falseas a result, let us know.Rationale:
Maintaining prodtypes and references downstream, even with utilities to help, has resulted in significant merge conflicts. Contributing the profiles to the community and upstreaming the prodtypes/reference changes alone will help with that effort significantly.
/cc @richardmaciel-canonical @dodys