Add rules for custom crypto policy sub modules #14050
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jan-cerny
added
bugfix
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
Adds a new rule crypto_sub_policy_sshd_ciphers that configure a custom crypto sub policy module for SSHD. The new rule is very similar to fips_custom_stig_sub_policy. It configures a new module for system wide crypto policies that reduces the set of usable ciphers in sshd. This change aligns the RHEL 8 CIS profiles with the CIS RHEL 8 Benchmark v 4.0.0 requirement 5.1.8. Resolves: https://issues.redhat.com/browse/RHEL-111896
We prevent future code duplication by extracting the common rule description and OCIL text to new Jinja macros describe_crypto_sub_policy and ocil_crypto_sub_policy. These macros can be used in rules that use the crypto_sub_policy template.
The rule crypto_sub_policy_sshd_macs implements the approach for configuring strong MACs as requested in CIS Benchmark for RHEL 8 version 4.0.0.
The rule crypto_sub_policy_sshd_cbc implements the approach for disabling CBC ciphers using a custom crypto policy sub module as requested in requirement 1.6.4 in CIS Benchmark for RHEL 8 version 4.0.0.
The rule crypto_sub_policy_weak_macs implements the approach for disabling MACs using a custom crypto policy sub module as requested in requirement 1.6.3 in CIS Benchmark for RHEL 8 version 4.0.0.
jan-cerny
force-pushed
the
RHEL-111896
branch
from
23a6f93 to
e776b55
Compare
jan-cerny
added a commit
to jan-cerny/scap-security-guide
that referenced
this pull request
Oct 30, 2025
Add a new rule `crypto_sub_policies_cis_rhel8` that configures multiple custom crypto sub policy modules for RHEL 8 CIS. The new rule is very similar to `fips_custom_stig_sub_policy`. It configures new modules for system wide crypto policies that reduces the set of usable ciphers in sshd, MACs, and others. The rule is templated by a new template `crypto_sub_policies` that is also introduced in this commit so that the code can be reused in other similar rules. This change aligns the RHEL 8 CIS profiles in CaC with the CIS RHEL 8 Benchmark v4.0.0 requirements. All crypto requirements of this profile are now covered by this single rule. The reason for merging all of the sub module configuration is to prevent overriding crypto policy settings. If there would be multiple rules, each of them would call the `update-crypto-policies` commands with a different sub policy, overriding each other. This supersedes ComplianceAsCode#14050 Resolves: https://issues.redhat.com/browse/RHEL-111896
|
This PR has been superseded by #14066 |
jan-cerny
added a commit
to jan-cerny/scap-security-guide
that referenced
this pull request
Oct 31, 2025
Add a new rule `crypto_sub_policies_cis_rhel8` that configures multiple custom crypto sub policy modules for RHEL 8 CIS. The new rule is very similar to `fips_custom_stig_sub_policy`. It configures new modules for system wide crypto policies that reduces the set of usable ciphers in sshd, MACs, and others. The rule is templated by a new template `crypto_sub_policies` that is also introduced in this commit so that the code can be reused in other similar rules. This change aligns the RHEL 8 CIS profiles in CaC with the CIS RHEL 8 Benchmark v4.0.0 requirements. All crypto requirements of this profile are now covered by this single rule. The reason for merging all of the sub module configuration is to prevent overriding crypto policy settings. If there would be multiple rules, each of them would call the `update-crypto-policies` commands with a different sub policy, overriding each other. This supersedes ComplianceAsCode#14050 Resolves: https://issues.redhat.com/browse/RHEL-111896
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This PR adds new rules to RHEL 8 CIS profiles:
These rules are templated by a template that is also introduced in this PR.
All rules configure or check a new sub module for system wide crypto policy.
Rationale:
Resolves: https://issues.redhat.com/browse/RHEL-111896
Fixes TODOs and aligns the rules with RHEL 8 CIS Benchmark version 4.0.0.
Review Hints: