Review profile for consistency between similar checks

mitre / redhat-enterprise-linux-9-stig-baseline

RHEL 9.X STIG Automated Compliance Validation Profile works with Chef InSpec to perform automated compliance checks of RHEL9.

Other

5 stars 2 forks source link

Review profile for consistency between similar checks #41

Open wdower opened 4 months ago

wdower commented 4 months ago

It has been quite some time since the entire RHEL codebase has been reviewed to ensure that tests with similar focuses (like all tests for audit rules, or all tests for kernel settings), many of which are written by different authors, are consistent in their approach. We need to take a read-through of each control to ensure that similar controls have similar test code, and ensure that the common approach covers all edge cases.

wdower commented 4 months ago

TODO:

[ ] make profile consistent re: using the word 'permissions' vs 'mode'
[ ] input names -- 'exempt' vs 'exemptions' in input names
[ ] loads of inputs are still commented with the RHEL8 control ID they align to and not the current one
[ ] be consistent about using .reject and .select to filter for failing items
[ ] examine 257926 to see if we can get a performance increase by using find instead of just stat-ing the directory
[ ] make sure any ini resource call that wraps a command or a json can catch the case where the command doesn't exist (see 257949)

kemley76 commented 4 months ago

I created this PR (#47) without making any changes to address either the 4th or last items here. It seems to me that it would be more readable to allow either .reject or .select just for readability's sake rather than requiring an unnecessary negation. Also, there seems to be a lot of instances where both are used. Also, with regards to the last item, I could only find a few instances where the ini resource is used, but they either didn't depend on any commands or just used cat, which I don't think should require an explicit check for if it is installed (even if cat doesn't exist, it seems like the test will fail and not give a false positive).