Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update chronyd rules for bootable containers #12582

Merged
merged 1 commit into from
Nov 7, 2024
Merged

Update chronyd rules for bootable containers #12582

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions components/chrony.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,3 +13,7 @@ rules:
- package_chrony_installed
- service_chronyd_enabled
- chrony_set_nts
- chronyd_client_only
- chronyd_no_chronyc_network
- chronyd_or_ntpd_specify_multiple_servers
- chronyd_sync_clock
3 changes: 1 addition & 2 deletions linux_os/guide/services/ntp/chronyd_client_only/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@
<definition class="compliance" id="chronyd_client_only" version="1">
{{{ oval_metadata("Configure the port setting in " ~ chrony_conf_path ~ " to disable
server operation.") }}}
<criteria operator="AND">
<extend_definition definition_ref="service_chronyd_enabled" comment="service chronyd enabled" />
<criteria>
<criterion test_ref="test_chronyd_client_only" comment="check if port is 0 in {{{ chrony_conf_path }}}" />
</criteria>
</definition>
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/services/ntp/chronyd_client_only/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ rationale: |-

severity: low

platform: package[chrony]

identifiers:
cce@rhcos4: CCE-82465-6
Expand Down
3 changes: 1 addition & 2 deletions linux_os/guide/services/ntp/chronyd_no_chronyc_network/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@
<definition class="compliance" id="chronyd_no_chronyc_network" version="1">
{{{ oval_metadata("Configure the cmdport setting in " ~ chrony_conf_path ~ " to disable
chronyc management connections over network.") }}}
<criteria operator="AND">
<extend_definition definition_ref="service_chronyd_enabled" comment="service chronyd enabled" />
<criteria>
<criterion test_ref="test_chronyd_no_chronyc_network" comment="check if cmdport is 0 in {{{ chrony_conf_path }}}" />
</criteria>
</definition>
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/services/ntp/chronyd_no_chronyc_network/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ rationale: |-

severity: low

platform: package[chrony]

identifiers:
cce@rhcos4: CCE-82466-4
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle
# platform = multi_platform_rhel,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle

{{{ bash_instantiate_variables("var_multiple_time_servers") }}}

Expand Down
10 changes: 2 additions & 8 deletions linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,8 @@
{{{ oval_metadata("Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)") }}}

<criteria operator="OR">
<criteria comment="chronyd enabled and multiple remote servers specified" operator="AND">
<extend_definition comment="service chronyd enabled" definition_ref="service_chronyd_enabled" />
<extend_definition comment="multiple chronyd remote servers specified" definition_ref="chronyd_specify_multiple_servers" />
</criteria>
<criteria comment="ntpd enabled and multile remote servers specified" operator="AND">
<extend_definition comment="service ntpd enabled" definition_ref="service_ntpd_enabled" />
<extend_definition comment="multiple ntpd remote servers specified" definition_ref="ntpd_specify_multiple_servers" />
</criteria>
<extend_definition comment="multiple chronyd remote servers specified" definition_ref="chronyd_specify_multiple_servers" />
<extend_definition comment="multiple ntpd remote servers specified" definition_ref="ntpd_specify_multiple_servers" />
</criteria>

</definition>
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ rationale: |-

severity: medium

platform: package[chrony] or package[ntp]

identifiers:
cce@rhcos4: CCE-82685-9
Expand Down
10 changes: 2 additions & 8 deletions linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,8 @@
{{{ oval_metadata("A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)") }}}

<criteria operator="OR">
<criteria comment="chronyd enabled and remote server specified" operator="AND">
<extend_definition comment="service chronyd enabled" definition_ref="service_chronyd_enabled" />
<extend_definition comment="chronyd remote server specified" definition_ref="chronyd_specify_remote_server" />
</criteria>
<criteria comment="ntpd enabled and remote server specified" operator="AND">
<extend_definition comment="service ntpd enabled" definition_ref="service_ntpd_enabled" />
<extend_definition comment="ntpd remote server specified" definition_ref="ntpd_specify_remote_server" />
</criteria>
<extend_definition comment="chronyd remote server specified" definition_ref="chronyd_specify_remote_server" />
<extend_definition comment="ntpd remote server specified" definition_ref="ntpd_specify_remote_server" />
</criteria>

</definition>
Expand Down
2 changes: 2 additions & 0 deletions linux_os/guide/services/ntp/chronyd_sync_clock/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ rationale: |-

severity: medium

platform: package[chrony]

references:
disa: CCI-002046,CCI-004926
srg: SRG-OS-000356-GPOS-00144
Expand Down
Loading