Add new rule ensure_apparmor_enforce_or_complain

[dodys]

Description:

• This is a new rule to satisfy CIS items:
  • 1.6.1.3 Ensure all AppArmor Profiles are in enforce or complain mode
  • 1.6.1.4 Ensure all AppArmor Profiles are enforcing
• For that a new variable was created var_set_apparmor_mode, so we could re-use the same rule for both items.
• @teacup-on-rockingchair I think this is also needed for SLE15.

Rationale:

• Security configuration requirements vary from site to site. Some sites may mandate a
  policy that is stricter than the default policy, which is perfectly acceptable. This item is
  intended to ensure that any policies that exist on the system are activated.

Review Hints:

Run the following command and verify that profiles are loaded, and are in either enforce
or complain mode:
# apparmor_status | grep profiles

Review output and ensure that profiles are loaded, and in either enforce or complain mode:

37 profiles are loaded.
35 profiles are in enforce mode.
2 profiles are in complain mode.
4 processes have profiles defined.

Run the following command and verify no processes are unconfined
# apparmor_status | grep processes

Review the output and ensure no processes are unconfined:

4 processes have profiles defined.
4 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

ubuntu2004 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit d139432 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.8% (0.0% change).

View more on Code Climate.

[Mab879]

Thanks for the PR. I a couple of questions on this PR.

[Mab879]

I wanted to double-check that you wanted this rule to allow for both, even on level 2.

[dodys]

hmm good catch, for level 2 I want it to be in enforce and to fail if in complain mode.
is there a good way to do this without creating two different rules?

[Mab879]

You should be able to check if the state matches a variable like in selinux_state rule.

[Mab879]

I think there is something wrong here. The final built content looks like
<oval-def:description>Ensure all AppArmor Profiles are in var_set_apparmor_mode</oval-def:description>.

[dodys]

nice catch, I will fix it

[dodys]

I'm dropping this PR in favor of PRs #10064 and #10057 as the optimization I wanted to do with variables won't work and will require more work.