add a check for secure boot enabled #13094

shaneboulden · 2025-02-21T05:42:29Z

Description:

Adds a check for Secure Boot on Linux systems.

Rationale:

The Australian Information Security Manual (ISM) contains controls for Secure Boot enabled (ISM-1745). This change introduces a control that can be included in the ISM profile, and others that require Secure Boot to be configured.

Review Hints:

Currently OVAL is not included. This rule only contains guidance on using mokutil to verify that Secure Boot is enabled, and does not perform automated checks.

Verified that products build successfully:

./build_product rhel8
./build_product rhel9
./build_product rhel10

openshift-ci · 2025-02-21T05:42:39Z

Hi @shaneboulden. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Mab879

Thanks for the PR, I have a couple of comments.

Mab879 · 2025-02-24T23:06:20Z

components/secureboot.yml

+packages:
+- mokutil
+rules:
+- secure_boot_enabled


Needs new line at the end of the file.

I've pushed a fix for this.

Mab879 · 2025-02-24T23:10:37Z

linux_os/guide/system/secureboot/secure_boot_enabled/rule.yml

@@ -0,0 +1,38 @@
+documentation_complete: true


This should be added to controls/ism_o.yml. Also if you want this rule in RHEL 9 or RHEL 8 you will need to to the ism_o.profile in the respective product folders.

Thanks for the feedback. I've included this control in the controls/ism_o.yml file.

Mab879 · 2025-02-25T20:09:22Z

linux_os/guide/system/secureboot/secure_boot_enabled/rule.yml

+
+severity: medium
+
+references:


This file needs identifiers section with a cce@rhel10 key. Pick a random value from shared/references/cce-redhat-avail.txt and remove it from the file and add here.

I've added the CCE identifiers for this check

Mab879 · 2025-02-25T20:12:27Z

controls/ism_o.yml

+        levels:
+            - base
+        rules:
+            - secure_boot_enabled


The profile stability tests need to be updated. Check the output of ctest --output-on-failure for more information.

ctest --output-on-failure runs to completion:

$ ctest --output-on-failure Test project /home/user/Code/content/build Start 1: sanity-ssg-tables-table-rhel10-cces.html 1/36 Test #1: sanity-ssg-tables-table-rhel10-cces.html .......... Passed 0.01 sec Start 2: sanity-ssg-tables-table-rhel10-srgmap.html 2/36 Test #2: sanity-ssg-tables-table-rhel10-srgmap.html ........ Passed 0.02 sec Start 3: sanity-ssg-tables-table-rhel10-srgmap-flat.html 3/36 Test #3: sanity-ssg-tables-table-rhel10-srgmap-flat.html ... Passed 0.06 sec Start 4: unique-cces 4/36 Test #4: unique-cces ....................................... Passed 0.25 sec Start 5: max-path-len 5/36 Test #5: max-path-len ...................................... Passed 0.35 sec Start 6: test-rule-dir-json 6/36 Test #6: test-rule-dir-json ................................ Passed 14.16 sec Start 7: stable-profile-ids 7/36 Test #7: stable-profile-ids ................................ Passed 0.32 sec Start 8: shorthand-to-oval 8/36 Test #8: shorthand-to-oval ................................. Passed 0.61 sec Start 9: stable-profiles 9/36 Test #9: stable-profiles ................................... Passed 0.08 sec Start 10: stable-products 10/36 Test #10: stable-products ................................... Passed 0.15 sec Start 11: machine-only-rules 11/36 Test #11: machine-only-rules ................................ Passed 0.58 sec Start 12: macros-oval 12/36 Test #12: macros-oval ....................................... Passed 4.33 sec Start 13: fix_rules 13/36 Test #13: fix_rules ......................................... Passed 11.22 sec Start 14: test-compare_ds 14/36 Test #14: test-compare_ds ................................... Passed 0.15 sec Start 15: test-generate_contributors 15/36 Test #15: test-generate_contributors ........................ Passed 0.26 sec Start 16: test-controleval-directory 16/36 Test #16: test-controleval-directory ........................ Passed 0.14 sec Start 17: test-controleval-onefile 17/36 Test #17: test-controleval-onefile .......................... Passed 0.15 sec Start 18: test-controleval-json 18/36 Test #18: test-controleval-json ............................. Passed 0.14 sec Start 19: test-check-eof 19/36 Test #19: test-check-eof .................................... Passed 3.73 sec Start 20: install-vm 20/36 Test #20: install-vm ........................................ Passed 0.04 sec Start 21: automatus-sanity 21/36 Test #21: automatus-sanity .................................. Passed 0.18 sec Start 22: cce_avail_check-redhat-all 22/36 Test #22: cce_avail_check-redhat-all ........................ Passed 0.07 sec Start 23: cce_avail_check-sle12 23/36 Test #23: cce_avail_check-sle12 ............................. Passed 0.06 sec Start 24: cce_avail_check-sle15 24/36 Test #24: cce_avail_check-sle15 ............................. Passed 0.05 sec Start 25: utils-import_disa_stig_sanity 25/36 Test #25: utils-import_disa_stig_sanity ..................... Passed 0.17 sec Start 26: utils-build_control_from_reference_sanity 26/36 Test #26: utils-build_control_from_reference_sanity ......... Passed 17.74 sec Start 27: validate_automatus_metadata 27/36 Test #27: validate_automatus_metadata ....................... Passed 0.20 sec Start 28: ansible-playbook-syntax-check-rhel10 28/36 Test #28: ansible-playbook-syntax-check-rhel10 .............. Passed 17.51 sec Start 29: validate-ssg-rhel10-cpe-dictionary.xml 29/36 Test #29: validate-ssg-rhel10-cpe-dictionary.xml ............ Passed 0.01 sec Start 30: validate-ssg-rhel10-cpe-oval.xml 30/36 Test #30: validate-ssg-rhel10-cpe-oval.xml .................. Passed 0.06 sec Start 31: xccdf-values-rhel10 31/36 Test #31: xccdf-values-rhel10 ............................... Passed 0.05 sec Start 32: reference-titles-in-benchmark-rhel10 32/36 Test #32: reference-titles-in-benchmark-rhel10 .............. Passed 0.27 sec Start 33: missing-cces-rhel10 33/36 Test #33: missing-cces-rhel10 ............................... Passed 0.66 sec Start 34: validate-ssg-rhel10-ds.xml 34/36 Test #34: validate-ssg-rhel10-ds.xml ........................ Passed 0.47 sec Start 35: verify-references-ssg-rhel10-ds.xml 35/36 Test #35: verify-references-ssg-rhel10-ds.xml ............... Passed 0.38 sec Start 36: validate-ssg-rhel10-oval.xml 36/36 Test #36: validate-ssg-rhel10-oval.xml ...................... Passed 0.21 sec 100% tests passed, 0 tests failed out of 36

That is odd. Here is the output from CI.

65/270 Test #65: stable-profiles ..................................................***Failed 0.18 sec Following selections were added to the rhel10's ism_o_secret profile: - secure_boot_enabled Following selections were added to the rhel10's ism_o_top_secret profile: - secure_boot_enabled Following selections were added to the rhel10's ism_o profile: - secure_boot_enabled If changes to mentioned profiles are intentional, copy those compiled files, so they become the new reference: cp '/__w/content/content/build/rhel10/profiles/ism_o_secret.profile' '/__w/content/content/tests/data/profile_stability/rhel10/ism_o_secret.profile' cp '/__w/content/content/build/rhel10/profiles/ism_o_top_secret.profile' '/__w/content/content/tests/data/profile_stability/rhel10/ism_o_top_secret.profile' cp '/__w/content/content/build/rhel10/profiles/ism_o.profile' '/__w/content/content/tests/data/profile_stability/rhel10/ism_o.profile' Please remember that if you change a profile that is extended by other profiles, changes propagate to derived profiles. If those changes are unwanted, you have to supress them using explicit selections or !unselections in derived profiles.

Strange. I've updated the rhel10 stability tests for the ISM profile now though.

codeclimate · 2025-02-28T05:58:26Z

Code Climate has analyzed commit 9a3e322 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 62.0% (0.0% change).

View more on Code Climate.

Mab879

Waving automatus tests as the new rule doesn't have automation.

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Feb 21, 2025

Mab879 self-assigned this Feb 24, 2025

Mab879 requested changes Feb 24, 2025

View reviewed changes

Mab879 requested changes Feb 25, 2025

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Feb 28, 2025

shaneboulden added 5 commits February 28, 2025 15:53

add a check for secure boot enabled

e08f41f

Fix whitespace

f4ecf9e

Add secureboot check to ISM profile

9d523cb

Add cce identifiers for secureboot

c7c54e8

Add secureboot check to profile stability tests

9a3e322

shaneboulden force-pushed the secure-boot-check branch from 0cb1456 to 9a3e322 Compare February 28, 2025 05:28

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Feb 28, 2025

Mab879 approved these changes Feb 28, 2025

View reviewed changes

Mab879 added this to the 0.1.77 milestone Feb 28, 2025

Mab879 added the New Rule Issues or pull requests related to new Rules. label Feb 28, 2025

Mab879 merged commit 6d67ad5 into ComplianceAsCode:master Feb 28, 2025
95 of 102 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

add a check for secure boot enabled #13094

add a check for secure boot enabled #13094

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!


		severity: medium

		references:

add a check for secure boot enabled #13094

add a check for secure boot enabled #13094

Uh oh!

Conversation

Description:

Rationale:

Review Hints:

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!