ComplianceAsCode / ComplianceAsCode/content
False positive in api_server_admission_control_plugin for OpenShift
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Test rule is written in the way which requires configuration: items ordered, unfortunately remediation done by Ansible openshift-master/config.yml with the following line in Inventory
`openshift_master_admission_plugin_config={"AlwaysPullImages":{"configuration":{"kind":"DefaultAdmissionConfig","apiVersion":"v1","disable":"false"}}
`
produce correct configuration in different order of configuration: items.
Test rule should be rewritten to use regex forward-lookup for configuration: items
#### SCAP Security Guide Version:
0.1.44
```
oscap -V
OpenSCAP command line tool (oscap) 1.2.17
Copyright 2009--2017 Red Hat Inc., Durham, North Carolina.
==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.11.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1
CVRF Version: 1.1
```
#### Operating System Version:
```
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)
```
#### Steps to Reproduce:
1. Reconfigure OpenShift Admission Plugin via Ansible
Inventory line
`openshift_master_admission_plugin_config={"AlwaysPullImages":{"configuration":{"kind":"DefaultAdmissionConfig","apiVersion":"v1","disable":"false"}}
`
2. Run reconfig playbook playbooks/openshift-master/config.yml
3. Run oscap with openshift-master profile
#### Actual Results:
```
I: oscap: Test 'oval:ssg-test_api_server_admission_control_plugin_AlwaysPullImages:tst:1' requires that every object defined by 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' exists on the system. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:882:_oval_result_test_evaluate_items]
I: oscap: 0 objects defined by 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' exist on the system. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:900:_oval_result_test_evaluate_items]
I: oscap: No item matching object 'oval:ssg-object_api_server_admission_control_plugin_AlwaysPullImages:obj:1' was found on the system. (flag=does not exist) [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:936:_oval_result_test_evaluate_items]
I: oscap: Test 'oval:ssg-test_api_server_admission_control_plugin_AlwaysPullImages:tst:1' evaluated as false. [oscap(56934):unknown(7f71caa68880):oval_resultTest.c:1142:oval_result_test_eval]
```
#### Expected Results:
Test pass wit the following config in /etc/origin/master/master-config.yml too:
```
admissionConfig:
pluginConfig:
AlwaysPullImages:
configuration:
apiVersion: v1
disable: false
kind: DefaultAdmissionConfig
```
#### Addition Information/Debugging Steps:
There is a problem with regex, it should use positive look-ahead instead of relying on order of params.
Also remediation miss one level of indentation under configuration: items
Contributor guide
Assessment
This issue has not been assessed yet.