Add new product for Ubuntu 26.04 and a default profile #14721
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,171 @@ | ||
| name: Automatus Ubuntu 26.04 | ||
| on: | ||
| pull_request: | ||
| branches: [ master, 'stabilization*' ] | ||
|
Check failure on line 4 in .github/workflows/automatus-ubuntu2604.yml
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.number || github.run_id }} | ||
| cancel-in-progress: true | ||
| env: | ||
| DATASTREAM: ssg-ubuntu2604-ds.xml | ||
| jobs: | ||
| build-content: | ||
| name: Build Content | ||
| runs-on: ubuntu-26.04 | ||
| steps: | ||
| - name: Install build deps | ||
| run: sudo apt-get update && sudo apt-get install -y cmake ninja-build xsltproc libxml2-utils python3-yaml python3-jinja2 openscap-utils | ||
| - name: Install workflow deps | ||
| run: sudo apt install -y git python3-deepdiff python3-requests jq python3-pip | ||
| - name: Install deps python | ||
| run: pip3 install gitpython xmldiff | ||
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Checkout (CTF) | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 | ||
| with: | ||
| repository: ComplianceAsCode/content-test-filtering | ||
| path: ctf | ||
| # https://github.com/actions/checkout/issues/766 | ||
| - name: Set git safe directory | ||
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | ||
| - name: Find forking point | ||
| env: | ||
| BASE_BRANCH: ${{ github.base_ref }} | ||
| run: echo "FORK_POINT=$(git merge-base origin/$BASE_BRANCH ${{ github.event.pull_request.head.sha }})" >> $GITHUB_OUTPUT | ||
| id: fork_point | ||
| - name: Detect content changes in the PR | ||
| run: python3 ./ctf/content_test_filtering.py pr --base ${{ steps.fork_point.outputs.FORK_POINT }} --remote_repo ${{ github.server_url }}/${{ github.repository }} --verbose --rule --output json ${{ github.event.pull_request.number }} > output.json | ||
| - name: Test if there are no content changes | ||
| run: echo "CTF_OUTPUT_SIZE=$(stat --printf="%s" output.json)" >> $GITHUB_OUTPUT | ||
| id: ctf | ||
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| with: | ||
| name: output.json | ||
| path: output.json | ||
| - name: Print changes to content detected if any | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: cat output.json | ||
| - name: Get product attribute | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| id: product | ||
| uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0 | ||
| with: | ||
| path: 'output.json' | ||
| prop_path: 'product' | ||
| - name: Build product | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: ./build_product ubuntu2604 --datastream-only | ||
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| with: | ||
| name: ${{ env.DATASTREAM }} | ||
| path: build/${{ env.DATASTREAM }} | ||
| validate-ubuntu: | ||
| name: Run Tests | ||
| needs: build-content | ||
| runs-on: ubuntu-26.04 | ||
| steps: | ||
| - name: Install test deps | ||
| run: sudo apt-get update && sudo apt-get install -y cmake ninja-build xsltproc libxml2-utils python3-yaml python3-jinja2 openscap-utils podman | ||
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 | ||
| - name: Get cached CTF output | ||
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4 | ||
| id: get_ctf_output | ||
| with: | ||
| name: output.json | ||
| # continue even if the file is unavailable that | ||
| # means there are no changes detected by CTF in the previous job | ||
| continue-on-error: true | ||
| - name: Test if there are no content changes | ||
| if: ${{ steps.get_ctf_output.outcome == 'success' }} | ||
| run: echo "CTF_OUTPUT_SIZE=$(stat --printf="%s" output.json)" >> $GITHUB_OUTPUT | ||
| id: ctf | ||
| - name: Print changes to content detected if any | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: cat output.json | ||
| - name: Generate id_rsa key | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: ssh-keygen -N '' -t rsa -f ~/.ssh/id_rsa | ||
| - name: Build test suite container | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: podman build --build-arg "CLIENT_PUBLIC_KEY=$(cat ~/.ssh/id_rsa.pub)" -t ssg_test_suite -f test_suite-ubuntu2604 | ||
| working-directory: ./Dockerfiles | ||
| - name: Get rule ids to be tested | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| id: rules | ||
| uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0 | ||
| with: | ||
| path: 'output.json' | ||
| prop_path: 'rules' | ||
| - name: Get product attribute | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| id: product | ||
| uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0 | ||
| with: | ||
| path: 'output.json' | ||
| prop_path: 'product' | ||
| - name: Get bash attribute | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| id: bash | ||
| uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0 | ||
| with: | ||
| path: 'output.json' | ||
| prop_path: 'bash' | ||
| - name: Get ansible attribute | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| id: ansible | ||
| uses: notiz-dev/github-action-json-property@a5a9c668b16513c737c3e1f8956772c99c73f6e8 # v0.2.0 | ||
| with: | ||
| path: 'output.json' | ||
| prop_path: 'ansible' | ||
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4 | ||
| if: ${{ steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| with: | ||
| name: ${{ env.DATASTREAM }} | ||
| - name: Run tests in a container - Bash | ||
| if: ${{steps.bash.outputs.prop == 'True' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: tests/test_rule_in_container.sh --no-make-applicable-in-containers --dontclean --logdir logs_bash --remediate-using bash --name ssg_test_suite --datastream ${{ env.DATASTREAM }} ${{join(fromJSON(steps.rules.outputs.prop))}} | ||
| env: | ||
| ADDITIONAL_TEST_OPTIONS: "--duplicate-templates --remove-fips-certified" | ||
| - name: Check for ERROR in logs | ||
| if: ${{steps.bash.outputs.prop == 'True' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: grep -q "^ERROR" logs_bash/test_suite.log | ||
| id: check_results_bash | ||
| # when grep returns 1 means it didn't find the ^ERROR string in the test_suite.log file | ||
| # and this means tests finished successfully without errors. So the job needs to keep going. | ||
| # By using continue-on-error: true the "conclusion" parameter is set to true so it's not possible to use | ||
| # it to determine whether the task has failed or succeed. The "outcome" parameter has to be used instead. | ||
| # See the step below | ||
| continue-on-error: true | ||
| - name: Upload logs in case of failure | ||
| if: ${{steps.bash.outputs.prop == 'True' && steps.check_results_bash.outcome == 'success' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 | ||
| with: | ||
| name: logs_bash | ||
| path: logs_bash/ | ||
| - name: Run tests in a container - Ansible | ||
| if: ${{ steps.ansible.outputs.prop == 'True' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: tests/test_rule_in_container.sh --no-make-applicable-in-containers --dontclean --logdir logs_ansible --remediate-using ansible --name ssg_test_suite --datastream ${{ env.DATASTREAM }} ${{join(fromJSON(steps.rules.outputs.prop))}} | ||
| env: | ||
| ADDITIONAL_TEST_OPTIONS: "--duplicate-templates --remove-fips-certified" | ||
| - name: Check for ERROR in logs | ||
| if: ${{steps.ansible.outputs.prop == 'True' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: grep -q "^ERROR" logs_ansible/test_suite.log | ||
| id: check_results_ansible | ||
| continue-on-error: true | ||
| - name: Upload logs in case of failure | ||
| if: ${{ steps.ansible.outputs.prop == 'True' && steps.check_results_ansible.outcome == 'success' && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 | ||
| with: | ||
| name: logs_ansible | ||
| path: logs_ansible/ | ||
| - name: Fail in case of ERROR present in logs_bash/test_suite.log or logs_ansible/test_suite.log | ||
| if: ${{ (steps.check_results_bash.outcome == 'success' || steps.check_results_ansible.outcome == 'success') && steps.ctf.outputs.CTF_OUTPUT_SIZE != '0' }} | ||
| run: | | ||
| [[ -f logs_bash/test_suite.log ]] && echo "---------Bash Remediation Logs---------" && cat logs_bash/test_suite.log | grep -v "DEBUG - " | ||
| [[ -f logs_ansible/test_suite.log ]] && echo "---------Ansible Remediation Logs---------" && cat logs_ansible/test_suite.log | grep -v "DEBUG - " | ||
| exit 1 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| srg_requirement: |- | ||
| {{{ full_name }}} must be a vendor-supported release. | ||
|
|
||
| vuldiscussion: |- | ||
| An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. | ||
|
|
||
| checktext: |- | ||
| Verify that the version or {{{ full_name }}} is vendor supported with the following command: | ||
|
|
||
| $ grep DISTRIB_DESCRIPTION /etc/lsb-release | ||
|
|
||
| DISTRIB_DESCRIPTION="Ubuntu 26.04.1 LTS" | ||
|
|
||
| If the installed version of {{{ full_name }}} is not supported, this is a finding. | ||
|
|
||
| fixtext: |- | ||
| Upgrade to a supported version of {{{ full_name }}}. | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| # Sometimes our users will try to do: "cd ubuntu26; cmake ." That needs to error in a nice way. | ||
| if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") | ||
| message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") | ||
| endif() | ||
|
|
||
| ssg_build_product("ubuntu2604") |
Empty file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| product: ubuntu2604 | ||
| full_name: "Ubuntu 26.04" | ||
| type: platform | ||
|
|
||
| families: | ||
| - debian-like | ||
| - ubuntu | ||
|
|
||
| major_version_ordinal: 2604 | ||
|
|
||
| benchmark_id: UBUNTU_26-04 | ||
| benchmark_root: "../../linux_os/guide" | ||
| components_root: "../../components" | ||
|
|
||
| profiles_root: "./profiles" | ||
|
|
||
| pkg_manager: "apt_get" | ||
| pkg_manager_config_file: "/etc/apt/apt.conf" | ||
|
|
||
| init_system: "systemd" | ||
| oval_feed_url: "https://security-metadata.canonical.com/oval/com.ubuntu.resolute.usn.oval.xml.bz2" | ||
|
|
||
| sshd_distributed_config: "true" | ||
|
|
||
| aide_bin_path: "/usr/bin/aide" | ||
| aide_conf_path: "/etc/aide/aide.conf" | ||
| aide_default_path: "/etc/default/aide" | ||
| audisp_conf_path: "/etc/audit" | ||
| chrony_conf_path: "/etc/chrony/chrony.conf" | ||
| chrony_d_path: "/etc/chrony/conf.d/" | ||
| journald_conf_dir_path: "/etc/systemd/journald.conf.d" | ||
|
|
||
| cpes_root: "../../shared/applicability" | ||
| cpes: | ||
| - ubuntu2604: | ||
| name: "cpe:/o:canonical:ubuntu_linux:26.04::~~lts~~~" | ||
| title: "Ubuntu release 26.04 (Resolute Raccoon)" | ||
| check_id: installed_OS_is_ubuntu2604 | ||
|
|
||
| platform_package_overrides: | ||
| audit: auditd | ||
| avahi: avahi-daemon | ||
| bind: bind9 | ||
| crontabs: cron | ||
| dconf: dconf-editor | ||
| gdm: gdm3 | ||
| grub2: grub2-common | ||
| net-snmp: snmp | ||
| NetworkManager: network-manager | ||
| nss-pam-ldapd: libpam-ldap | ||
| pam: libpam-runtime | ||
| shadow: login | ||
| sssd: sssd-common | ||
| openssl-pkcs11: libpam-pkcs11 | ||
|
|
||
| reference_uris: | ||
| cis: 'https://www.cisecurity.org/benchmark/ubuntu_linux/' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| documentation_complete: true | ||
|
|
||
| hidden: true | ||
|
|
||
| title: Default Profile for Ubuntu 26.04 | ||
|
|
||
| description: |- | ||
| Minimal default profile for Ubuntu 26.04 to ensure benchmark generation. | ||
|
|
||
| selections: | ||
| - installed_OS_is_vendor_supported |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| <def-group> | ||
| <definition class="inventory" id="installed_OS_is_ubuntu2604" version="1"> | ||
| <metadata> | ||
| <title>Ubuntu 26.04 LTS</title> | ||
| <affected family="unix"> | ||
| <platform>multi_platform_all</platform> | ||
| </affected> | ||
| <reference ref_id="cpe:/o:canonical:ubuntu_linux:26.04" source="CPE" /> | ||
| <description>The operating system installed on the system is Ubuntu 26.04 LTS</description> | ||
| </metadata> | ||
| <criteria comment="current Ubuntu version is Resolute" operator="AND"> | ||
| <extend_definition comment="Ubuntu is installed" definition_ref="installed_OS_is_ubuntu" /> | ||
| <criterion comment="Resolute is installed" test_ref="test_ubuntu_resolute" /> | ||
| </criteria> | ||
| </definition> | ||
|
|
||
| <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="test_ubuntu_resolute" version="1"> | ||
| <ind:object object_ref="obj_ubuntu_resolute" /> | ||
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="obj_ubuntu_resolute" version="1" comment="Check Ubuntu version"> | ||
| <ind:filepath>/etc/lsb-release</ind:filepath> | ||
| <ind:pattern operation="pattern match">^DISTRIB_CODENAME=resolute$</ind:pattern> | ||
| <ind:instance datatype="int">1</ind:instance> | ||
| </ind:textfilecontent54_object> | ||
|
|
||
| </def-group> |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
test_suite-ubuntu2604Dockerfile doesn't exist.