search

splunk / ansible-role-for-splunk

Splunk@Splunk's Ansible role for installing Splunk, upgrading Splunk, and installing apps/addons on Splunk deployments (VM/bare metal)
Apache License 2.0
148 stars 104 forks source link

Enhancement: Add a new task for configuring fapolicyd rules #132

Open merillr opened 2 years ago

merillr commented 2 years ago

Since the installation only supports tgz, systems running fapolicyd (such as DISA STIG-compliant RHEL8+ servers) block splunk from executing. Below is a snippet of the rules preventing execution after running fapolicyd --debug-deny:

rule=11 dec=deny_audit perm=open auid=-1 pid=29811 exe=/opt/splunk/bin/python3.7m : path=/opt/splunk/lib/python3.7/encodings/__pycache__/__init__.cpython-37.pyc ftype=application/x-bytecode.python trust=0
rule=8 dec=deny_audit perm=open auid=-1 pid=29812 exe=/opt/splunk/bin/python3.7m : path=/opt/splunk/lib/libdlwrapper.so.1.0.0 ftype=application/x-sharedlib trust=0
rule=13 dec=deny_audit perm=execute auid=-1 pid=29813 exe=/usr/bin/bash : path=/opt/splunk/bin/python3.7m ftype=application/x-executable trust=0

Some options are:

  1. Add a task to create the fapolicyd rules.d files and update the fapolicyd database.
  2. Add a task to create the fapolicd trusted.d files to whitelist specific directories (only works if directories don't change because of SHA-256 hashing).
  3. Support RPM-based installation (#7), since applications registered in the system RPM database are automatically trusted.

References: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_blocking-and-allowing-applications-using-fapolicyd_security-hardening https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2020-11-25/finding/V-230523

dtwersky commented 2 years ago

@merillr I don't see an issue with this being implemented, and as you said, this can be done by adding an option to install the package or adding a custom rule. I would rather have it install the package, and not have to create rules, because we will have to update the SHA for every executable it will be executing, and I'm not sure how many we will need to add to that rule, and if additional executables are added in the future, we will need to edit the playbook every time.

You are welcome to open a PR to add the RPM functionality, or wait till I have some time to work on this, since this will require quite a bit of work for it to be future proof and easily configurable.

arcsector commented 1 year ago

Would this be something that would need to be done for both UFs and Full installs, or just Full? Last I heard from Splunk support, they don't have OOTB support for STIG-compliant systems, which is fairly disheartening from a company that works with the government a lot.