Move RHV4 product to be el8 based by yuumasato · Pull Request #5352 · ComplianceAsCode/content

yuumasato · 2020-03-27T11:16:57Z

Description:

Update content Hypervisor CPE product
Update profile with RHEL8 specific rules and their applicabilities
Document that rhv4 product applies to el8 based hosts
~~[ ] Update prodtype in other rules.~~

Rationale:

Content for el7 based hosts is provided in rhel7 product
Content for el8 based hosts is provided by rhv4 product

Related to: https://lists.fedoraproject.org/archives/list/scap-security-guide@lists.fedorahosted.org/thread/CSNMJJWYPAUVBCQFCRIJHJ7PHOBE6SDB/

References

yuumasato · 2020-03-27T17:28:37Z

I'd appreciate feedback on contents of rhv4/README.md. Do you think something else should be there?

I have realized now that the rhel7/profiles/rhelh-stig.profile and rhv4/profiles/rhvh-stig.profile are very identical, and that there exists a rhel8/profiles/rhelh-stig.profile.

Maybe rhv4/profiles/rhvh-stig.profile needs to be updated to be based on rhel8 profile, and the same applies to rhvh-vpp.profile. Thoughts on this?

yuumasato · 2020-03-27T17:34:33Z

For easy of review, I've dropped ee5ed7d, and will propose it separately.

The commit just did bulk labeling, any rule that applied to rhel8 was made applicable rhv4.
And any rule that was only applicable to rhel7 was made sure not to apply to rhv4

yuumasato · 2020-03-30T16:18:41Z

So, I think it makes sense to update the profile to be based on RHEL8 versions.
So in 3845826 I update VPP profile to be aligned with RHEL8 OSPP profile, based on rhel8/profiles/rhelh-vpp.profile
And in 5b2d981 I update STIG profile to be aligned with RHEL8 STIG profile, based on rhel8/profiles/rhelh-stig.profile

Unfortunately this makes 0665267 mandatory, as it now enables a few rules needed by the profile.
Reviewing commit by commit will be easier than checking whole list of changed files.

yuumasato · 2020-03-30T16:43:42Z

So in 3845826 I update VPP profile to be aligned with RHEL8 OSPP profile.
And in 5b2d981 I update STIG profile to be aligned with RHEL8 STIG profile.

@redhatrises, @shawndwells Would appreciate your feedback here

openscap-ci · 2020-03-31T09:21:22Z

Can one of the admins verify this patch?

redhatrises · 2020-03-31T17:28:42Z

A couple of thoughts:

I noticed that any rule for RHEL8 is selected and enabled for rhv. Let's not do this as we are currently in the process with the RHV team to go through the NIST controls to evaluate applicability to RHV. Once controls are identified, we then add and enable them for RHV.
Let's not make the OSPP and STIG rules the same. Keep them as is for now. We can open a draft PR for these changes separately. Reason being is that RHV is going through the NIAP process now and OSPP and VPP and STIG are not the same. And since we are evaluating all of NIST 800-53 and VPP, I am hestitant to make these type of changes to the profiles right now. For example, Gnome shouldn't be installed or configured at all on RHVH or RHVM.

redhatrises · 2020-03-31T17:37:13Z

Also don't create a separate README integrate the comments into the main README or in the docs.

yuumasato · 2020-04-01T12:19:37Z

Ok, dropped commits that migrate profiles and all rules to el8.
Now, the changes in rules are directly connected to migrating selected rules to el8.

Also don't create a separate README integrate the comments into the main README or in the docs.

I don't know where would be a good place for such information to be. I moved it to be in the User Guide.
@redhatrises If that is not a good place, suggest one, please.

Changes selection of FIPS related rules in RHV4 product to the appropriate RHEL8 equivalent. Also migrates rule prodtypes and platforms to rhel8.

And unselect rules made obsolete by them Also migrates rule prodtypes and platforms to rhel8.

Rules that configure audispd plugin are failing due to missing config files.

And migrate their prodtypes and platforms to rhel8.

As the node becomes rhel8 based, the gpg keys become the same as rhel8 keys.

As RHV4 moves to be rhel8 based, this doesn't apply anymore to rhv4.

These packages are not present in rhel8.

Make rhv4 product applicable to version 4.4 and newer.

yuumasato · 2020-04-01T18:33:21Z

Conflicts resolved.

JAORMX · 2020-04-02T10:36:52Z

/test all

ocp4 e2e test flake

JAORMX · 2020-04-02T11:32:37Z

/test all

yuumasato · 2020-04-02T14:40:07Z

I have no idea how to interpret error in ci/prow/e2e-aws-moderate.
release "release-latest" failed: could not create watcher for pod: Get https://172.30.0.1:443/api/v1/namespaces/ci-op-tgyw9i7j/pods?fieldSelector=metadata.name%3Drelease-latest&watch=true: unexpected EOF

Is it a deal breaker?

redhatrises

Looks good to me. As this is draft content, all these changes are fine.

redhatrises · 2020-04-02T17:31:39Z

/retest

openshift-ci-robot · 2020-04-02T18:28:59Z

@yuumasato: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-moderate	`9f4652c`	link	`/test e2e-aws-moderate`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

matejak · 2020-04-03T08:54:08Z

The PR has been approved, and those failing tests don't indicate that there is something wrong with it, so I am merging it.

yuumasato force-pushed the update_rhv4_to_rhel8 branch 2 times, most recently from a45de90 to ee5ed7d Compare March 27, 2020 17:19

openshift-ci-robot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 27, 2020

yuumasato changed the title ~~Move RHV4 content to RHEL8~~ Move RHV4 product to RHEL8 Mar 27, 2020

yuumasato force-pushed the update_rhv4_to_rhel8 branch from ee5ed7d to f4a3de0 Compare March 27, 2020 17:31

yuumasato marked this pull request as ready for review March 27, 2020 17:35

openshift-ci-robot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 27, 2020

yuumasato changed the title ~~Move RHV4 product to RHEL8~~ Move RHV4 product to be el8 based Mar 27, 2020

jan-cerny reviewed Mar 30, 2020

View reviewed changes

Comment thread rhv4/README.md Outdated

yuumasato force-pushed the update_rhv4_to_rhel8 branch from f4a3de0 to c1de382 Compare March 30, 2020 13:12

yuumasato requested review from redhatrises and shawndwells March 31, 2020 10:27

yuumasato added this to the 0.1.50 milestone Mar 31, 2020

yuumasato added the enhancement General enhancements to the project. label Mar 31, 2020

yuumasato force-pushed the update_rhv4_to_rhel8 branch from 9ae8bf9 to d966a7f Compare April 1, 2020 12:11

yuumasato force-pushed the update_rhv4_to_rhel8 branch from d966a7f to 7cd2141 Compare April 1, 2020 17:38

yuumasato added 6 commits April 1, 2020 20:30

Select rhel8 FIPS rules in RHV4 profiles

00408e8

Changes selection of FIPS related rules in RHV4 product to the appropriate RHEL8 equivalent. Also migrates rule prodtypes and platforms to rhel8.

Select crypto-policy rules in RHV4 Profiles

1f49459

And unselect rules made obsolete by them Also migrates rule prodtypes and platforms to rhel8.

Install audisp plugin to be able to configure it

d3bb085

Rules that configure audispd plugin are failing due to missing config files.

Update applicability of audispd rules for RHV4

1541043

Remove rules for packages deprecated in RHEL8

ec1d8b2

And migrate their prodtypes and platforms to rhel8.

Move rhv4 grub2_bootloader_argument rules to rhel8

c5cc54c

yuumasato added 7 commits April 1, 2020 20:31

Move rhv4 ensure_redhat_gpgkey_installed to rhel8

66a286b

As the node becomes rhel8 based, the gpg keys become the same as rhel8 keys.

Remove configure_opensc_nss_db from rhv4

324fd16

As RHV4 moves to be rhel8 based, this doesn't apply anymore to rhv4.

Remove not applicable rules from rhv4

c0b7594

These packages are not present in rhel8.

Update CPE hypervisor version

0ef0793

Make rhv4 product applicable to versions 4.4+

34a4c17

Make rhv4 product applicable to version 4.4 and newer.

Allow RHEL8 as a Host

217639e

Document RHV el7 and el8 support

9f4652c

yuumasato force-pushed the update_rhv4_to_rhel8 branch from 7cd2141 to 9f4652c Compare April 1, 2020 18:32

redhatrises approved these changes Apr 2, 2020

View reviewed changes

matejak merged commit 030a4a5 into ComplianceAsCode:master Apr 3, 2020

yuumasato deleted the update_rhv4_to_rhel8 branch April 3, 2020 11:36

Conversation

yuumasato commented Mar 27, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

References

Uh oh!

yuumasato commented Mar 27, 2020

Uh oh!

yuumasato commented Mar 27, 2020

Uh oh!

Uh oh!

yuumasato commented Mar 30, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yuumasato commented Mar 30, 2020

Uh oh!

openscap-ci commented Mar 31, 2020

Uh oh!

redhatrises commented Mar 31, 2020

Uh oh!

redhatrises commented Mar 31, 2020

Uh oh!

yuumasato commented Apr 1, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yuumasato commented Apr 1, 2020

Uh oh!

JAORMX commented Apr 2, 2020

Uh oh!

JAORMX commented Apr 2, 2020

Uh oh!

yuumasato commented Apr 2, 2020

Uh oh!

redhatrises left a comment

Choose a reason for hiding this comment

Uh oh!

redhatrises commented Apr 2, 2020

Uh oh!

openshift-ci-robot commented Apr 2, 2020

Uh oh!

matejak commented Apr 3, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

yuumasato commented Mar 27, 2020 •

edited

Loading

yuumasato commented Mar 30, 2020 •

edited

Loading

yuumasato commented Apr 1, 2020 •

edited

Loading