Improve aide rules for sle16/suse platform - #15123
Draft
teacup-on-rockingchair wants to merge 2 commits into
Draft
teacup-on-rockingchair wants to merge 2 commits into
teacup-on-rockingchair wants to merge 2 commits into
Conversation
…, aide_verify_ext_attributes rule is disabled also
aide.service for checking aide DB aide.timer for triggering aide.service aidecheck-notify.service sending /var/log/aide-report.log to configured mail
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
teacup-on-rockingchair
added
Ansible
Contributor
|
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -1,10 +1,15 @@
# Remediation is applicable only in certain platforms
-if rpm --quiet -q kernel-core; then
+if rpm --quiet -q kernel-core && { rpm --quiet -q aide; }; then
if ! rpm -q --quiet "aide" ; then
yum install -y "aide"
fi
var_aide_scan_notification_email=''
+
+
+
+
+
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification' differs.
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -24,7 +24,9 @@
state: present
with_items:
- aide
- when: '"kernel-core" in ansible_facts.packages'
+ when:
+ - '"kernel-core" in ansible_facts.packages'
+ - '"aide" in ansible_facts.packages'
tags:
- CCE-82891-3
- DISA-STIG-RHEL-08-010360
@@ -46,7 +48,9 @@
user: root
job: /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check"
{{ var_aide_scan_notification_email }}
- when: '"kernel-core" in ansible_facts.packages'
+ when:
+ - '"kernel-core" in ansible_facts.packages'
+ - '"aide" in ansible_facts.packages'
tags:
- CCE-82891-3
- DISA-STIG-RHEL-08-010360
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_aide_scan_notification'
--- xccdf_org.ssgproject.content_rule_aide_scan_notification
+++ xccdf_org.ssgproject.content_rule_aide_scan_notification
@@ -1 +1 @@
-
+oval:ssg-package_aide:def:1 |
teacup-on-rockingchair
marked this pull request as ready for review
September 16, 2026 16:29
teacup-on-rockingchair
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
September 16, 2026 16:29
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@teacup-on-rockingchair: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved correctness and portability issues remain in platform applicability, service handling, and test/OVAL alignment.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This pull request updates AIDE rules for SLE16/SUSE platforms, including systemd services, audit paths, and unsupported attribute handling.
Changes:
- Removes unsupported
xattrshandling for SLE16/SUSE. - Migrates SUSE AIDE checks and notifications to systemd units.
- Updates audit binary paths and expands related test coverage.
File summaries
| File | Summary |
|---|---|
shared/macros/01-general.jinja |
Adjusts generated SLE16 AIDE attributes. |
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml |
Updates SUSE audit binary paths. |
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml |
Updates SUSE audit binary paths. |
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml |
Updates SUSE audit binary paths. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value.fail.sh |
Expands platform coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/wrong_value_inline.fail.sh |
Expands platform coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh |
Expands platform coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value_inline.pass.sh |
Expands platform coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh |
Updates platform metadata. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml |
Adds SUSE systemd notification applicability. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml |
Updates notification service checks. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh |
Configures notification remediation. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml |
Configures notification remediation. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh |
Updates timer test setup. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml |
Updates service and timer validation. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh |
Configures periodic AIDE execution. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml |
Configures periodic AIDE execution. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh |
Extends negative test coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh |
Adds SLE16 attribute coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh |
Adds SLE16 attribute coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh |
Adds SLE16 attribute coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh |
Adds SLE16 attribute coverage. |
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml |
Adds SLE16 attribute validation. |
Review details
Suppressed comments (12)
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml:18
- The OVAL state has the same
product == sle16limitation as the remediation macro. For openSUSE 16 the checker will continue requiringxattrs, so an xattrs-free configuration would be reported noncompliant even after the generated configuration is corrected. Keep this applicability condition synchronized with the openSUSE 16 handling.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
{{% else %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
{{% endif %}}
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml:15
- The SLE16 OVAL state requires
p+i+n+u+g+s+b+acl+selinux+sha512, but the new SLE16 pass scenarios writep+i+n+u+g+s+b+acl+sha512withoutselinux(and theexpect_sbin_pathscenario does the same). Those scenarios will therefore fail evaluation despite being marked pass. Please align the SLE16 test data,aide_string(), and this OVAL state on whetherselinuxis required.
{{% if product in ['sle16'] %}}
<ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh:18
- Adding
multi_platform_slemakes both branches run against SUSE products, but the updated OVAL requiresselinuxfor all SUSE states: sle16 expects...+acl+selinux+sha512, while older SUSE expects...+acl+selinux+xattrs+sha512. The pass scenario omitsselinuxin both branches, so it will fail on every SUSE product; include it in each expected string.
{{% if product in ['sle16'] %}}
echo "$theFile p+i+n+u+g+s+b+acl+sha512" >> {{{ aide_conf_path }}}
{{% else %}}
echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512" >> {{{ aide_conf_path }}}
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml:18
- The quotes are part of the block scalar and will be written literally to
/etc/aide_service.conf. Unlike the Bash remediation, this does not produce the AIDE@@include /etc/aide.confdirective, so the SLE16 service may not parse or use the intended configuration.
"@@include /etc/aide.conf"
linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/tests/aide_timer_weekly.pass.sh:6
- This test scenario is declared for RHEL, OL, SLE, SLMicro, Ubuntu, and other platforms, but the new variables unconditionally select
aide.serviceandaide.timer. Once the shared remediation/checker preserves the existingaidecheck.*units for non-SUSE products, this setup will no longer establish the expected state on those platforms; make the test unit names use the same SUSE-family conditional.
{{% set aide_service = 'aide.service' %}}
{{% set aide_timer = 'aide.timer' %}}
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh:12
lineinfile_presentonly appends the supplied line; its normal caller first removes existing matches (seeshared/macros/10-bash.jinja:1334-1344). Calling it directly here makes repeated Bash remediation runs append duplicatereport_urlentries instead of being idempotent. Use an idempotent line-update path or remove the existing setting before appending.
{{{ lineinfile_present('/etc/aide.conf','report_url=file:/var/log/aide-report.log') }}}
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/oval/shared.xml:17
- The remediation enters the SUSE systemd branch for the
opensuseproduct, but this OVAL criteria is gated only forsle15,sle16, and the SLMicro products. As a result, openSUSE 16 receives the newaide.service/notification setup while the check ignores those units and only evaluates the cron alternatives. Include openSUSE through the same version/applicability mechanism or keep its remediation on the cron path.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml:68
- This newly added sle16 branch still tells administrators to look for
aidecheck.servicein the dependency tree, but the implementation now wiresaide.servicetoaidecheck-notify.service. The verification instructions are therefore wrong for sle16; refer toaide.servicehere.
<pre>$ sudo systemctl status aidecheck-notify|grep loaded</pre>
The output should return that the service is loaded.
Also we should make sure that notification service is started by the check:
<pre>$ sudo systemctl list-dependencies --reverse aidecheck-notify</pre>,
which should display the aidecheck.service in the dependency tree
linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml:54
- The new systemd applicability branch only recognizes
sle15,sle16, and the SLMicro products. Since openSUSE Leap 16 is represented byproduct: opensuse, it will take thepackage[aide]branch and the remediation will remain on the cron path instead of configuringaide.service/aidecheck-notify.service, despite the PR description including openSUSE16.
{{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}}
platform: package[aide] and package[systemd]
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_group_ownership/rule.yml:65
- This SUSE-specific template now checks
audit_binaries, but the SLE16 property list includes/sbin/audisp-syslogand does not include/sbin/rsyslogd(product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspectrsyslogdand omitsaudisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_ownership/rule.yml:65
- This SUSE-specific template now checks
audit_binaries, but the SLE16 property list includes/sbin/audisp-syslogand does not include/sbin/rsyslogd(product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspectrsyslogdand omitsaudisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
linux_os/guide/system/software/integrity/software-integrity/aide/file_audit_tools_permissions/rule.yml:55
- This SUSE-specific template now checks
audit_binaries, but the SLE16 property list includes/sbin/audisp-syslogand does not include/sbin/rsyslogd(product_properties/10-audit-binaries.yml:14-16). The OCIL above still tells administrators to inspectrsyslogdand omitsaudisp-syslog, so manual verification no longer matches the generated check/remediation.
{{% if 'suse' in families %}}
filepath: {{{ audit_binaries }}}
- Files reviewed: 23/23 changed files
- Comments generated: 8
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| for theFile in "${bins[@]}" | ||
| do | ||
| {{% if product in ['sle16'] %}} | ||
| echo "$theFile p+i+n+u+g+s+b+acl+sha512" >> {{{ aide_conf_path }}} |
Comment on lines
+7
to
+8
| {{% set aide_service = 'aide.service' %}} | ||
| {{% set aide_timer = 'aide.timer' %}} |
Comment on lines
+5
to
+6
| {{% set aide_service = 'aide.service' %}} | ||
| {{% set aide_timer = 'aide.timer' %}} |
Comment on lines
+1
to
+2
| {{% set aide_service = 'aide.service' %}} | ||
| {{% set aide_timer = 'aide.timer' %}} |
Comment on lines
+19
to
+25
| - name: "{{{ rule_title }}} - Ensure report_url is set to file:/var/log/aide-report.log in /etc/aide.conf" | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/aide.conf | ||
| line: "report_url=file:/var/log/aide-report.log" | ||
| when: | ||
| - '"packages" in ansible_facts' | ||
| - '"aide" in ansible_facts["packages"]' |
| {{% else %}} | ||
| <ind:filepath>/etc/systemd/system/{{{ aide_service }}}</ind:filepath> | ||
| {{% endif %}} | ||
| <ind:pattern operation="pattern match">^.*ExecStart\=.*/usr/bin/aide[\s]*\-\-check.*$</ind:pattern> |
Comment on lines
+1253
to
+1254
| {{%- if product in ['sle16'] -%}} | ||
| p+i+n+u+g+s+b+acl+selinux+sha512 |
|
|
||
| The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. | ||
| {{% if product in ["sle15", "slmicro5", "slmicro6"] %}} | ||
| {{% if product in ["sle15", "sle16", "slmicro5", "slmicro6"] %}} |
Collaborator
|
@teacup-on-rockingchair change to draft pls if you still plan to work on this. Thanks 🙏 |
teacup-on-rockingchair
marked this pull request as draft
September 17, 2026 13:22
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Rationale:
all SUSE platforms use:
xattrs is removed for sle16/opensuse16 since AIDE does not support it, aide_verify_ext_attributes rule is disabled also