Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added rule partition_for_dev_shm #9984

Merged
merged 1 commit into from
Feb 6, 2023
Merged

Added rule partition_for_dev_shm #9984

merged 1 commit into from
Feb 6, 2023

Conversation

rumch-se
Copy link
Contributor

Description:

  • A new rule as a part of CIS profile for SLE 12/15

Rationale:

  • The rule covers CIS requirement 1.1.6 Ensure /dev/shm is configured (Automated)

@rumch-se rumch-se requested a review from a team as a code owner December 16, 2022 12:37
@openshift-ci
Copy link

openshift-ci bot commented Dec 16, 2022

Hi @rumch-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Dec 16, 2022
@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@dodys
Copy link
Contributor

dodys commented Dec 16, 2022

I think this item for Ubuntu and RHEL fell out of the CIS benchmark a few months ago as this is handled by systemd tmpfs automatically, if I remember correctly.
@ggbecker @yuumasato maybe you remember more about it.
Maybe this could be reported to CIS to be removed from SUSE's benchmark?

@anivan-suse anivan-suse added the needs-rebase Used by openshift-ci bot. label Dec 21, 2022
@yuumasato
Copy link
Member

I think this item for Ubuntu and RHEL fell out of the CIS benchmark a few months ago as this is handled by systemd tmpfs automatically, if I remember correctly. @ggbecker @yuumasato maybe you remember more about it.

I don't remember. But I don't know if systemd in SLE behaves the same.

Maybe this could be reported to CIS to be removed from SUSE's benchmark?

This could reported back to CIS, but depends on how it is in SLE12.
Regardless, the CIS for SLE12 has an specific item for /dev/shm in /etc/fstab.

@rumch-se rumch-se force-pushed the partition_for_dev_shm branch from 266cea9 to 57e4a7f Compare January 11, 2023 09:49
@openshift-merge-robot openshift-merge-robot added needs-rebase Used by openshift-ci bot. and removed needs-rebase Used by openshift-ci bot. labels Jan 11, 2023
@rumch-se rumch-se force-pushed the partition_for_dev_shm branch from 57e4a7f to 7570038 Compare January 17, 2023 07:55
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jan 17, 2023
@openshift-merge-robot openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jan 27, 2023
marcusburghardt
marcusburghardt reviewed Jan 31, 2023
View reviewed changes
linux_os/guide/system/software/disk_partitioning/partition_for_dev_shm/rule.yml Outdated
@@ -0,0 +1,41 @@
documentation_complete: true

title: 'Ensure /dev/tmp is configured'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems this title is not correct.

@marcusburghardt
Copy link
Member

I think this item for Ubuntu and RHEL fell out of the CIS benchmark a few months ago as this is handled by systemd tmpfs automatically, if I remember correctly. @ggbecker @yuumasato maybe you remember more about it.

I don't remember. But I don't know if systemd in SLE behaves the same.

Maybe this could be reported to CIS to be removed from SUSE's benchmark?

This could reported back to CIS, but depends on how it is in SLE12. Regardless, the CIS for SLE12 has an specific item for /dev/shm in /etc/fstab.

@rumch-se could you also include the prodtype parameter in rule.yml and restrict this rule to sle products, please?

@marcusburghardt marcusburghardt self-assigned this Jan 31, 2023
@marcusburghardt marcusburghardt added SLES SUSE Linux Enterprise Server product related. New Rule Issues or pull requests related to new Rules. CIS CIS Benchmark related. labels Jan 31, 2023
@marcusburghardt marcusburghardt added this to the 0.1.67 milestone Jan 31, 2023
@rumch-se rumch-se force-pushed the partition_for_dev_shm branch from 7570038 to 4e1bb28 Compare February 6, 2023 07:43
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Feb 6, 2023
@rumch-se
Copy link
Contributor Author

rumch-se commented Feb 6, 2023

Hello @marcusburghardt
I have done expected corrections
Have a nice day
Rumen

@codeclimate
Copy link

codeclimate bot commented Feb 6, 2023

Code Climate has analyzed commit 4e1bb28 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.5% (0.0% change).

View more on Code Climate.

marcusburghardt
marcusburghardt approved these changes Feb 6, 2023
View reviewed changes
Copy link
Member

@marcusburghardt marcusburghardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @rumch-se

@marcusburghardt
Copy link
Member

Overriding the CODEOWNERS protection since there is no SUSE contributor with write permission at the moment.

@marcusburghardt marcusburghardt merged commit a42c7d0 into ComplianceAsCode:master Feb 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marcusburghardt marcusburghardt marcusburghardt approved these changes

Assignees

@marcusburghardt marcusburghardt

Labels
CIS CIS Benchmark related. needs-ok-to-test Used by openshift-ci bot. New Rule Issues or pull requests related to new Rules. SLES SUSE Linux Enterprise Server product related.
Projects
None yet
Milestone
0.1.67
Development

Successfully merging this pull request may close these issues.
6 participants
@rumch-se @dodys @yuumasato @marcusburghardt @openshift-merge-robot @anivan-suse