search

ansible-lockdown / RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
https://ansible-lockdown.readthedocs.io
MIT License
109 stars 86 forks source link

Address issues in 4.1.1.2 and 4.1.1.3 including idempotent status #188

Closed RoboPickle closed 5 months ago

RoboPickle commented 5 months ago

Overall Review

4.1.1.2 and 4.1.1.3 Do not accurately determine the current state of the Kernel audit and audit backlog limits. As such they always trigger, spoiling idempotency.

Issue Fixes:

Fixes #187: Idempotent and other issues in 4.1.1.2 and 4.1.1.3
Fixes #160

Enhancements:

None other than the fixes identified

How has this been tested?:

Tested against a minimally configured Alma Linux 9 VM.

audit task 4.1.1.2

  1. Ran numerous combinations of 1 and 0 and Off (in various case upper/lower/mixed)
    • Correctly identified when it needed to run and when not
  2. Ran against a single kernel, so a single response from grubby
    • Correctly identified when it needed to run and when not
  3. Ran against multiple kernels, so an array response from grubby
    • Correctly identified when it needed to run and when not
  4. Ran test against none of the kernels having the arg set
    • Correctly identified that it needed to run
  5. Repeated runs do not trigger grubby to update
    • Correctly identified that it did not need to run

      audit backlog limit task 4.1.1.3

  6. Ran numerous combinations of different elements in the array being below the target
    • Correctly identified when it needed to run and when not
  7. Ran against a single kernel, so a single response from grubby
    • Correctly identified when it needed to run and when not
  8. Ran against multiple kernels, so an array response from grubby
    • Correctly identified when it needed to run and when not
  9. Ran test against none of the kernels having the arg set
    • Correctly identified that it needed to run
  10. Repeated runs do not trigger grubby to update
    • Correctly identified that it did not need to run