ComplianceAsCode / ComplianceAsCode/content

False positive in api_server_admission_control_plugin for OpenShift

Open
#4,355 3 comments 0 reactions 0 assignees View on GitHub
OpenShift OVAL
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Test rule is written in the way which requires configuration: items ordered, unfortunately remediation done by Ansible openshift-master/config.yml with the following line in Inventory

`openshift_master_admission_plugin_config={"AlwaysPullImages":{"configuration":{"kind":"DefaultAdmissionConfig","apiVersion":"v1","disable":"false"}}
`
produce correct configuration in different order of configuration: items.

Test rule should be rewritten to use regex forward-lookup for configuration: items

#### SCAP Security Guide Version:

0.1.44

```
oscap -V
OpenSCAP command line tool (oscap) 1.2.17
Copyright 2009--2017 Red Hat Inc., Durham, North Carolina.

==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.11.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1
CVRF Version: 1.1

```
#### Operating System Version:

```
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)

```
#### Steps to Reproduce:

1. Reconfigure OpenShift Admission Plugin via Ansible

Inventory line
`openshift_master_admission_plugin_config={"AlwaysPullImages":{"configuration":{"kind":"DefaultAdmissionConfig","apiVersion":"v1","disable":"false"}}
`

2. Run reconfig playbook playbooks/openshift-master/config.yml

3. Run oscap with openshift-master profile

#### Actual Results:

```
I: oscap: Test 'oval:ssg-test_api_server_admission_control_plugin_AlwaysPullImages:tst:1' requires that every object defined by 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' exists on the system. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:882:_oval_result_test_evaluate_items]
I: oscap: 0 objects defined by 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' exist on the system. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:900:_oval_result_test_evaluate_items]
I: oscap: No item matching object 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' was found on the system. (flag=does not exist) [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:936:_oval_result_test_evaluate_items]
I: oscap: Test 'oval:ssg-test_api_server_admission_control_plugin_AlwaysPullImages:tst:1' evaluated as false. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:1142:oval_result_test_eval]

```

#### Expected Results:

Test pass wit the following config in /etc/origin/master/master-config.yml too:
```
admissionConfig:
pluginConfig:
AlwaysPullImages:
configuration:
apiVersion: v1
disable: false
kind: DefaultAdmissionConfig
```

#### Addition Information/Debugging Steps:

There is a problem with regex, it should use positive look-ahead instead of relying on order of params.

Also remediation miss one level of indentation under configuration: items

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.