From cbede36c7a4e35cb882c35892cff72f9f190cbf9 Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Mon, 8 Feb 2021 15:57:43 +0100 Subject: [PATCH 1/5] Add nodev,nosuid,noexec options to /boot in ANSSI kickstart --- rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg | 2 +- rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg | 2 +- rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg | 2 +- rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg | 2 +- rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg | 2 +- rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg index 1d35bedb91..c381512476 100644 --- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg +++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_enhanced-ks.cfg @@ -99,7 +99,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg index 73225c2fab..a672b38b83 100644 --- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg +++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_high-ks.cfg @@ -103,7 +103,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) diff --git a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg index 20c4c59a78..88a7cee8ab 100644 --- a/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg +++ b/rhel7/kickstart/ssg-rhel7-anssi_nt28_intermediary-ks.cfg @@ -99,7 +99,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg index 728946ecb7..6f66a3774b 100644 --- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg +++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_enhanced-ks.cfg @@ -90,7 +90,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg index cd0eff2625..b5c09253a5 100644 --- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg +++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg @@ -94,7 +94,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg index 3a241b06f4..fb785e0c11 100644 --- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg +++ b/rhel8/kickstart/ssg-rhel8-anssi_bp28_intermediary-ks.cfg @@ -90,7 +90,7 @@ zerombr clearpart --linux --initlabel # Create primary system partitions (required for installs) -part /boot --fstype=xfs --size=512 +part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" part pv.01 --grow --size=1 # Create a Logical Volume Management (LVM) group (optional) From 15be64cc2d6c21b0351bb8d3d1b55b1924be99ca Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Tue, 9 Feb 2021 12:45:34 +0100 Subject: [PATCH 2/5] Add mount_option_nodev_nonroot_local_partitions bash remediation --- .../bash/shared.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh new file mode 100644 index 0000000000..7e2b3bd76b --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/bash/shared.sh @@ -0,0 +1,18 @@ +# platform = multi_platform_all +. /usr/share/scap-security-guide/remediation_functions + +include_mount_options_functions + +MOUNT_OPTION="nodev" +# Create array of local non-root partitions +readarray -t partitions_records < <(findmnt --mtab --raw --evaluate | grep "^/\w" | grep "\s/dev/\w") + +for partition_record in "${partitions_records[@]}"; do + # Get all important information for fstab + mount_point="$(echo ${partition_record} | cut -d " " -f1)" + device="$(echo ${partition_record} | cut -d " " -f2)" + device_type="$(echo ${partition_record} | cut -d " " -f3)" + # device and device_type will be used only in case when the device doesn't have fstab record + ensure_mount_option_in_fstab "$mount_point" "$MOUNT_OPTION" "$device" "$device_type" + ensure_partition_is_mounted "$mount_point" +done From 36958b72896a69cb580f00a986673c8ae99cb011 Mon Sep 17 00:00:00 2001 From: Milan Lysonek Date: Tue, 9 Feb 2021 12:45:54 +0100 Subject: [PATCH 3/5] Add mount_option_nodev_nonroot_local_partitions test scenarios --- .../tests/correct.pass.sh | 23 +++++++++++++++++ .../local_mounted_during_runtime.fail.sh | 19 ++++++++++++++ .../tests/missing_multiple_nodev.fail.sh | 23 +++++++++++++++++ .../tests/missing_one_nodev.fail.sh | 23 +++++++++++++++++ .../tests/remote_without_nodev.pass.sh | 25 +++++++++++++++++++ 5 files changed, 113 insertions(+) create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh new file mode 100644 index 0000000000..8bfac4b80f --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/correct.pass.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +. $SHARED/partition.sh + +# Add nodev option to all records in fstab to ensure that test will +# run on environment where everything is set correctly for rule check. +cp /etc/fstab /etc/fstab.backup +sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup +awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab +# Remount all partitions. (--all option can't be used because it doesn't +# mount e.g. /boot partition +declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") ) +for partition in ${partitions[@]}; do + mount -o remount "$partition" +done + +PARTITION="/dev/new_partition1"; create_partition +make_fstab_given_partition_line "/tmp/partition1" ext2 nodev +mount_partition "/tmp/partition1" + +PARTITION="/dev/new_partition2"; create_partition +make_fstab_given_partition_line "/tmp/partition2" ext2 nodev +mount_partition "/tmp/partition2" diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh new file mode 100644 index 0000000000..84cadd6f73 --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/local_mounted_during_runtime.fail.sh @@ -0,0 +1,19 @@ +#!/bin/bash + +. $SHARED/partition.sh + +# Add nodev option to all records in fstab to ensure that test will +# run on environment where everything is set correctly for rule check. +cp /etc/fstab /etc/fstab.backup +sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup +awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab +# Remount all partitions. (--all option can't be used because it doesn't +# mount e.g. /boot partition +declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") ) +for partition in ${partitions[@]}; do + mount -o remount "$partition" +done + +PARTITION="/dev/new_partition1"; create_partition +mkdir /tmp/test_dir +mount $PARTITION /tmp/test_dir diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh new file mode 100644 index 0000000000..7a09093f46 --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_multiple_nodev.fail.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +. $SHARED/partition.sh + +# Add nodev option to all records in fstab to ensure that test will +# run on environment where everything is set correctly for rule check. +cp /etc/fstab /etc/fstab.backup +sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup +awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab +# Remount all partitions. (--all option can't be used because it doesn't +# mount e.g. /boot partition +declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") ) +for partition in ${partitions[@]}; do + mount -o remount "$partition" +done + +PARTITION="/dev/new_partition1"; create_partition +make_fstab_given_partition_line "/tmp/partition1" ext2 +mount_partition "/tmp/partition1" + +PARTITION="/dev/new_partition2"; create_partition +make_fstab_given_partition_line "/tmp/partition2" ext2 +mount_partition "/tmp/partition2" diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh new file mode 100644 index 0000000000..c20a98bdcc --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/missing_one_nodev.fail.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +. $SHARED/partition.sh + +# Add nodev option to all records in fstab to ensure that test will +# run on environment where everything is set correctly for rule check. +cp /etc/fstab /etc/fstab.backup +sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup +awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab +# Remount all partitions. (--all option can't be used because it doesn't +# mount e.g. /boot partition +declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") ) +for partition in ${partitions[@]}; do + mount -o remount "$partition" +done + +PARTITION="/dev/new_partition1"; create_partition +make_fstab_given_partition_line "/tmp/partition1" ext2 nodev +mount_partition "/tmp/partition1" + +PARTITION="/dev/new_partition2"; create_partition +make_fstab_given_partition_line "/tmp/partition2" ext2 +mount_partition "/tmp/partition2" diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh new file mode 100644 index 0000000000..a95410526f --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/tests/remote_without_nodev.pass.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# packages = nfs-utils + +. $SHARED/partition.sh + +# Add nodev option to all records in fstab to ensure that test will +# run on environment where everything is set correctly for rule check. +cp /etc/fstab /etc/fstab.backup +sed -e 's/\bnodev\b/,/g' -e 's/,,//g' -e 's/\s,\s/defaults/g' /etc/fstab.backup +awk '{$4 = $4",nodev"; print}' /etc/fstab.backup > /etc/fstab +# Remount all partitions. (--all option can't be used because it doesn't +# mount e.g. /boot partition +declare -a partitions=( $(awk '{print $2}' /etc/fstab | grep "^/\w") ) +for partition in ${partitions[@]}; do + mount -o remount "$partition" +done + +mkdir /tmp/testdir +mkdir /tmp/testmount +chown 2 /tmp/testdir +chmod 777 /tmp/testdir + +echo '/tmp/testdir localhost(rw)' > /etc/exports +systemctl restart nfs-server +mount.nfs localhost:/tmp/testdir /tmp/testmount From b7bec83d7a3ad186413777f70fe2b5d20e01e56b Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 10 Feb 2021 18:32:26 +0100 Subject: [PATCH 4/5] Add Ansible for mount_option_nodev_nonroot_local_partitions The remediation metadata were inspired by the template mount_options --- .../ansible/shared.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml new file mode 100644 index 0000000000..8530604308 --- /dev/null +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml @@ -0,0 +1,18 @@ +# platform = multi_platform_all +# reboot = false +# strategy = configure +# complexity = low +# disruption = high + +- name: Ensure non-root local partitions are mounted with nodev option + mount: + path: "{{ item.mount }}" + src: "{{ item.device}}" + opts: "{{ item.options }},nodev" + state: "mounted" + fstype: "{{ item.fstype }}" + when: + - "item.mount is match('/\\w')" + - "item.options is not search('nodev')" + with_items: + - "{{ ansible_facts.mounts }}" From dab22894ca0798dde27c77704a7fd34d62d77f8f Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Wed, 10 Feb 2021 20:29:32 +0100 Subject: [PATCH 5/5] Add space before and after variable --- .../ansible/shared.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml index 8530604308..2aa9a53e4d 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/ansible/shared.yml @@ -7,7 +7,7 @@ - name: Ensure non-root local partitions are mounted with nodev option mount: path: "{{ item.mount }}" - src: "{{ item.device}}" + src: "{{ item.device }}" opts: "{{ item.options }},nodev" state: "mounted" fstype: "{{ item.fstype }}"