From 8cbec60a51b54df386bad72cdd82b83fbf9482fa Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 25 Jun 2020 18:29:31 +0200

Subject: [PATCH 01/14] Add rule to check for zIPL conformance to BLS

Instead of having each zIPL argument rule check for BLS compliance,

let's split into its own rule.

---

 .../zipl_audit_argument/rule.yml              |  6 -----

 .../rule.yml                                  |  6 -----

 .../zipl_bls_entries_only/rule.yml            | 24 +++++++++++++++++++

 .../zipl_enable_selinux/rule.yml              |  6 -----

 .../zipl_page_poison_argument/rule.yml        |  6 -----

 .../zipl_pti_argument/rule.yml                |  6 -----

 .../zipl_slub_debug_argument/rule.yml         |  6 -----

 .../zipl_vsyscall_argument/rule.yml           |  6 -----

 8 files changed, 24 insertions(+), 42 deletions(-)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

index 2d31ef8ee7..1211a53295 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To ensure all processes can be audited, even those which start prior to the audit daemon,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>audit=1</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to enable audit,

@@ -30,10 +28,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable audit.

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

index 40db232257..7d88e38686 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>audit_backlog_limit=8192</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to extend the audit log events queue,

@@ -31,10 +29,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that does not extend the log events queue.

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

new file mode 100644

index 0000000000..b6ccbb5343

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

@@ -0,0 +1,24 @@

+documentation_complete: true

+

+prodtype: rhel8

+

+title: 'Ensure all zIPL boot entries are BLS compliant'

+

+description: |-

+    Ensure that zIPL boot entries fully adheres to Boot Loader Specification (BLS)

+    by checking that <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt>.

+

+rationale: |-

+    {{{ full_name }}} adheres to Boot Loader Specification (BLS) and is the prefered method of

+    configuration.

+

+severity: medium

+

+ocil_clause: 'a non BLS boot entry is configured'

+

+ocil: |-

+  Check that no boot image file is specified in <tt>/etc/zipl.conf</tt>:

+  
grep -R "^image\s*=" /etc/zipl.conf

+  No line should be returned, if a line is returned non BLS compliant boot entries are configured for zIPL.

+

+platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

index 8d28d5495f..1c3bfeb246 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To ensure SELinux is not disabled at boot time,

     check that no boot entry in <tt>/boot/loader/entries/*.conf</tt> has <tt>selinux=0</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

 rationale: |-

@@ -27,10 +25,6 @@ ocil: |-

     
sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf

     No line should be returned, each line returned is a boot entry that disables SELinux.

-    Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-    
grep -R "^image\s*=" /etc/zipl.conf

-    No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

     And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

     and <tt>/etc/zipl.conf</tt>:

     
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

index 0a8e9a41e2..6dbfd501b7 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable poisoning of free pages,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>page_poison=1</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to enable page poisoning,

@@ -31,10 +29,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable page poisoning.

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

index 20c1448cc8..555fdf2b66 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable Kernel page-table isolation,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>pti=on</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to enable page-table isolation,

@@ -30,10 +28,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

index 54ac688ea0..dd7865bf81 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable poisoning of SLUB/SLAB objects,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>slub_debug=P</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to extend the audit log events queue,

@@ -31,10 +29,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that does not enable poisoning.

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

index c5979a2016..18b7ade460 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To disable use of virtual syscalls,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>vsyscall=none</tt>

     included in its options.

-    Make sure <tt>/etc/zipl.conf</tt> doesn't contain <tt>image = </tt> setting,

-    as {{{ full_name }}} adheres to Boot Loader Specification (BLS).

     And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to disable virtual syscalls,

@@ -28,10 +26,6 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls.

-  Check that no image file is specified in <tt>/etc/zipl.conf</tt>:

-  
grep -R "^image\s*=" /etc/zipl.conf

-  No line should be returned, if a line is returned zipl may load a different kernel than intended.

-

   And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

   and <tt>/etc/zipl.conf</tt>:

   
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

From 5e3b19077d781d0441595019429c653efafede8e Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 2 Jul 2020 09:52:39 +0200

Subject: [PATCH 02/14] zipl_bls_entries_only: Add OVAL and tests

---

 .../zipl_bls_entries_only/oval/shared.xml     | 27 +++++++++++++++++++

 .../tests/image_configured.fail.sh            |  6 +++++

 .../tests/no_image.pass.sh                    |  7 +++++

 3 files changed, 40 insertions(+)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml

new file mode 100644

index 0000000000..41e9773814

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/oval/shared.xml

@@ -0,0 +1,27 @@

+<def-group>

+  <definition class="compliance" id="zipl_bls_entries_only" version="1">

+    <metadata>

+      <title>Ensure zIPL entries are BLS compliant</title>

+      {{{- oval_affected(products) }}}

+      <description>Check if /etc/zipl.conf configures any boot entry</description>

+    </metadata>

+    <criteria operator="AND">

+      

+      comment="Test presence of image configuration in /etc/zipl.conf" />

+    </criteria>

+  </definition>

+

+  

+  comment="Test presence of image configuration in /etc/zipl.conf"

+  check="all" check_existence="none_exist" version="1">

+    <ind:object object_ref="object_zipl_bls_entries_only" />

+  </ind:textfilecontent54_test>

+

+  

+  version="1">

+    <ind:filepath operation="pattern match">^/etc/zipl.conf$</ind:filepath>

+    <ind:pattern operation="pattern match">^image\s*=.*$</ind:pattern>

+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

+  </ind:textfilecontent54_object>

+

+</def-group>

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh

new file mode 100644

index 0000000000..e3adb99638

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/image_configured.fail.sh

@@ -0,0 +1,6 @@

+#!/bin/bash

+# platform = Red Hat Enterprise Linux 8

+# remediation = none

+

+# Make sure no image configured in zipl config file

+echo 'image = /boot/image' >> /etc/zipl.conf

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh

new file mode 100644

index 0000000000..47626442f6

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/tests/no_image.pass.sh

@@ -0,0 +1,7 @@

+#!/bin/bash

+# platform = Red Hat Enterprise Linux 8

+# remediation = none

+

+# Make sure no image configured in zipl config file

+sed -Ei '/^image\s*=/d' /etc/zipl.conf

+true

From 05e5b05b41080b7fbfaf42469cbb366eeffe35ec Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 2 Jul 2020 11:09:08 +0200

Subject: [PATCH 03/14] zipl_bls_entries_only: Add no-remediation warning

Automated remediation to remove non-BLS boot entries from /etc/zipl.conf

is tricky and can lead to broken entries or removal of all of them.

---

 .../system/bootloader-zipl/zipl_bls_entries_only/rule.yml    | 5 +++++

 1 file changed, 5 insertions(+)

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

index b6ccbb5343..f792c5257f 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml

@@ -22,3 +22,8 @@ ocil: |-

   No line should be returned, if a line is returned non BLS compliant boot entries are configured for zIPL.

 platform: machine

+

+warnings:

+  - general: |-

+      To prevent breakage or removal of all boot entries oconfigured in /etc/zipl.conf

+      automated remediation for this rule is not available.

From 53d811ed09cd63d4472a2133f3d9dc465dbd2962 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 25 Jun 2020 18:51:04 +0200

Subject: [PATCH 04/14] Add rule to check hotness of zIPL bootmap

Instead of having each zIPL argument rule check if zIPL bootmap is up to

date, let's split it into its own rule.

---

 .../zipl_audit_argument/rule.yml              |  6 -----

 .../rule.yml                                  |  7 -----

 .../zipl_bootmap_is_up_to_date/rule.yml       | 27 +++++++++++++++++++

 .../zipl_enable_selinux/rule.yml              |  6 -----

 .../zipl_page_poison_argument/rule.yml        |  7 -----

 .../zipl_pti_argument/rule.yml                |  7 -----

 .../zipl_slub_debug_argument/rule.yml         |  7 -----

 .../zipl_vsyscall_argument/rule.yml           |  7 -----

 8 files changed, 27 insertions(+), 47 deletions(-)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

index 1211a53295..624b4e7041 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml

@@ -8,7 +8,6 @@ description: |-

     To ensure all processes can be audited, even those which start prior to the audit daemon,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>audit=1</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

     To ensure that new kernels and boot entries continue to enable audit,

     add <tt>audit=1</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -28,9 +27,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\baudit=1\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable audit.

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

index 7d88e38686..faf114591a 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To improve the kernel capacity to queue all log events, even those which start prior to the audit daemon,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>audit_backlog_limit=8192</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

-

     To ensure that new kernels and boot entries continue to extend the audit log events queue,

     add <tt>audit_backlog_limit=8192</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -29,9 +27,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\baudit_backlog_limit=0\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that does not extend the log events queue.

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml

new file mode 100644

index 0000000000..082562d11e

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml

@@ -0,0 +1,27 @@

+documentation_complete: true

+

+prodtype: rhel8

+

+title: 'Ensure zIPL bootmap is up to date'

+

+description: |-

+    Make sure that <tt>/boot/bootmap</tt> is up to date.

+    Every time a boot entry or zIPL configuration is changed <tt>/boot/bootmap</tt> needs to

+    be updated to reflect the changes.

+    Run <tt>zipl</tt> command to generate an updated <tt>/boot/bootmap</tt>.

+

+rationale: |-

+    The file <tt>/boot/bootmap</tt> contains all boot data, keeping it up to date is crucial to

+    boot correct kernel and options.

+

+severity: medium

+

+ocil_clause: 'the bootmap is outdated'

+

+ocil: |-

+  Make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

+  and <tt>/etc/zipl.conf</tt>:

+  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

+  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> is outdated and needs to be regenerated.

+

+platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

index 1c3bfeb246..b0bc0fc374 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml

@@ -8,7 +8,6 @@ description: |-

     To ensure SELinux is not disabled at boot time,

     check that no boot entry in <tt>/boot/loader/entries/*.conf</tt> has <tt>selinux=0</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

 rationale: |-

     Disabling a major host protection feature, such as SELinux, at boot time prevents

@@ -25,9 +24,4 @@ ocil: |-

     
sudo grep -L "^options\s+.*\bselinux=0\b" /boot/loader/entries/*.conf

     No line should be returned, each line returned is a boot entry that disables SELinux.

-    And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-    and <tt>/etc/zipl.conf</tt>:

-    
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-    No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

index 6dbfd501b7..866664c01b 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable poisoning of free pages,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>page_poison=1</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

-

     To ensure that new kernels and boot entries continue to enable page poisoning,

     add <tt>page_poison=1</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -29,9 +27,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bpage_poison=1\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable page poisoning.

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

index 555fdf2b66..2f02d9668c 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_pti_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable Kernel page-table isolation,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>pti=on</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

-

     To ensure that new kernels and boot entries continue to enable page-table isolation,

     add <tt>pti=on</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -28,9 +26,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bpti=on\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't enable page-table isolation .

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

index dd7865bf81..0cb10d3cd8 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To enable poisoning of SLUB/SLAB objects,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>slub_debug=P</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

-

     To ensure that new kernels and boot entries continue to extend the audit log events queue,

     add <tt>slub_debug=P</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -29,9 +27,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bslub_debug=P\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that does not enable poisoning.

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

index 18b7ade460..f79adeb083 100644

--- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

+++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml

@@ -8,8 +8,6 @@ description: |-

     To disable use of virtual syscalls,

     check that all boot entries in <tt>/boot/loader/entries/*.conf</tt> have <tt>vsyscall=none</tt>

     included in its options.

-    And run <tt>zipl</tt> command so that <tt>/boot/bootmap</tt> is updated.

-

     To ensure that new kernels and boot entries continue to disable virtual syscalls,

     add <tt>vsyscall=none</tt> to <tt>/etc/kernel/cmdline</tt>.

@@ -26,9 +24,4 @@ ocil: |-

   
sudo grep -L "^options\s+.*\bvsyscall=none\b" /boot/loader/entries/*.conf

   No line should be returned, each line returned is a boot entry that doesn't disable virtual syscalls.

-  And make sure that <tt>/boot/bootmap</tt> is newer than <tt>/boot/loader/entries/*.conf</tt>

-  and <tt>/etc/zipl.conf</tt>:

-  
find /boot/loader/entries/*.conf /etc/zipl.conf -newer /boot/bootmap

-  No line should be returned, if a line is returned <tt>/boot/bootmap</tt> needs to be regenerated.

-

 platform: machine

From b9f27383a09afbc6cef61bbbaad0f18f9ebec075 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 2 Jul 2020 15:59:31 +0200

Subject: [PATCH 05/14] zipl_bootmap_is_up_to_date: Add OVAL check

---

 .../oval/shared.xml                           | 46 +++++++++++++++++++

 1 file changed, 46 insertions(+)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml

new file mode 100644

index 0000000000..6c446cbe59

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/oval/shared.xml

@@ -0,0 +1,46 @@

+<def-group>

+  <definition class="compliance" id="zipl_bootmap_is_up_to_date" version="1">

+    <metadata>

+      <title>Ensure zIPL bootmap is up to date</title>

+      {{{- oval_affected(products) }}}

+      <description>Check if /boot/bootmap is up to date</description>

+    </metadata>

+    <criteria operator="AND">

+      

+      comment="Compare mtime of /boot/bootmap against /etc/zipl.conf and /boot/loader/entries/*.conf" />

+    </criteria>

+  </definition>

+

+  <unix:file_test check="all" check_existence="all_exist" id="test_zipl_bootmap_is_up_to_date" version="1" comment="Check /boot/bootmap timestamps">

+    <unix:object object_ref="object_zipl_boot_bootmap_file" />

+    <unix:state state_ref="state_zipl_bootmap_is_newer_than_zipl_conf" />

+    <unix:state state_ref="state_zipl_bootmap_is_newer_than_boot_entries" />

+  </unix:file_test>

+

+  <unix:file_object id="object_zipl_boot_bootmap_file" comment="current bootmap state" version="1">

+    <unix:filepath>/boot/bootmap</unix:filepath>

+  </unix:file_object>

+

+  

+  <unix:file_state id="state_zipl_bootmap_is_newer_than_zipl_conf" version="1">

+    

+    var_ref="variable_zipl_conf_file_age" />

+  </unix:file_state>

+  <local_variable id="variable_zipl_conf_file_age" version="1" comment="Age of /etc/zipl.conf" datatype="int">

+    <object_component object_ref="zipl_conf_file" item_field="m_time"/>

+  </local_variable>

+  <unix:file_object id="zipl_conf_file" comment="/etc/zipl.conf state" version="1">

+    <unix:filepath datatype="string">/etc/zipl.conf</unix:filepath>

+  </unix:file_object>

+

+  <unix:file_state id="state_zipl_bootmap_is_newer_than_boot_entries" version="1">

+    

+    var_ref="variable_boot_entry_files_age" />

+  </unix:file_state>

+  <local_variable id="variable_boot_entry_files_age" version="1" comment="Age of /boot/loader/entries/*.conf files" datatype="int">

+    <object_component object_ref="boot_entry_files" item_field="m_time"/>

+  </local_variable>

+  <unix:file_object id="boot_entry_files" comment="/boot/loader/entries/*.conf states" version="1">

+    <unix:filepath datatype="string" operation="pattern match">^/boot/loader/entries/.*\.conf$</unix:filepath>

+  </unix:file_object>

+</def-group>

From 97aff87a403f9b319e87967561c43dc99e8a672e Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Thu, 2 Jul 2020 16:15:35 +0200

Subject: [PATCH 06/14] zipl_bootmap_is_up_to_date: Add mock tests

These tests mock existence of zIPL files.

---

 .../tests/newer_boot_entry.fail.sh                     | 10 ++++++++++

 .../tests/newer_zipl_conf.fail.sh                      | 10 ++++++++++

 .../tests/up_to_date.pass.sh                           |  9 +++++++++

 3 files changed, 29 insertions(+)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh

new file mode 100644

index 0000000000..728c6b7bdb

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_boot_entry.fail.sh

@@ -0,0 +1,10 @@

+#!/bin/bash

+# platform = Red Hat Enterprise Linux 8

+# remediation = none

+

+touch /etc/zipl.conf

+touch /boot/loader/entries/*.conf # Update current existing entries

+touch /boot/loader/entries/zipl-entry-1.conf

+touch /boot/bootmap

+sleep 2

+touch /boot/loader/entries/zipl-entry-2.conf

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh

new file mode 100644

index 0000000000..1ae4d631ee

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/newer_zipl_conf.fail.sh

@@ -0,0 +1,10 @@

+#!/bin/bash

+# platform = Red Hat Enterprise Linux 8

+# remediation = none

+

+touch /boot/loader/entries/*.conf # Update current existing entries

+touch /boot/loader/entries/zipl-entry-1.conf

+touch /boot/loader/entries/zipl-entry-2.conf

+touch /boot/bootmap

+sleep 2

+touch /etc/zipl.conf

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh

new file mode 100644

index 0000000000..7981ba8c5c

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/tests/up_to_date.pass.sh

@@ -0,0 +1,9 @@

+#!/bin/bash

+# platform = Red Hat Enterprise Linux 8

+# remediation = none

+

+touch /etc/zipl.conf

+touch /boot/loader/entries/*.conf # Update current existing entries

+touch /boot/loader/entries/zipl-entry-1.conf

+touch /boot/loader/entries/zipl-entry-2.conf

+touch /boot/bootmap

From 180e57bd23154c1ed8dc2575fbf9660c2f83a803 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Fri, 3 Jul 2020 18:35:06 +0200

Subject: [PATCH 07/14] zipl_bootmap_is_up_to_date: Add remediations

---

 .../ansible/shared.yml                        | 24 +++++++++++++++++++

 .../zipl_bootmap_is_up_to_date/bash/shared.sh |  3 +++

 2 files changed, 27 insertions(+)

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml

 create mode 100644 linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml

new file mode 100644

index 0000000000..e545eacc13

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/ansible/shared.yml

@@ -0,0 +1,24 @@

+# platform = Red Hat Enterprise Linux 8

+# reboot = false

+# strategy = configure

+# complexity = low

+# disruption = low

+

+- name: "Ensure zIPL bootmap is up to date"

+  block:

+    - name: "Obtain stats of /boot/bootmap"

+      stat:

+        path: /boot/bootmap

+      register: boot_bootmap

+

+    - name: "Obtain stats of /etc/zipl.conf"

+      stat:

+        path: /etc/zipl.conf

+      register: zipl_conf

+

+    # TODO: handle /boot/loader/entries/*.conf

+

+    - name: "Update zIPL bootmap"

+      command: /usr/sbin/zipl

+      changed_when: True

+      when: boot_bootmap.stat.mtime < zipl_conf.stat.mtime

diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh

new file mode 100644

index 0000000000..2cf7e388f0

--- /dev/null

+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh

@@ -0,0 +1,3 @@

+# platform = Red Hat Enterprise Linux 8

+

+/usr/bin/zipl

From 93703727b12a34edb26de25410bf23ff72fead2a Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Wed, 1 Jul 2020 17:16:41 +0200

Subject: [PATCH 08/14] Select zIPL specific rules in OSPP profile

---