ComplianceAsCode / ComplianceAsCode/content

test_aide_periodic_cron_checking is too restrictive

Open
#6,739 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

##### Arguments #####

The first issue is that either `--check` or `-C` are valid arguments to AIDE and different scanners tend to want different arguments so either should be valid.

##### Scheduling Method #####

The second issue is that there are multiple methods for scheduling this service:

1. `systemd` because the 90's called and want your crontab back
2. The `root` crontab
3. `/etc/cron.*`

Any and/or all of these locations should be valid (`systemd` should be preferred at this point I would think).

##### Operational Impact #####

The third issue is that `aide` is a very CPU intensive process and users will probably want to `nice` the application down so that it does not interfere with production systems.

The application should be allowed to be run under `nice` restrictions so that the system is not impacted.

It looks like there is no real reason to check the actual scheduling in the regex since the valid presence in any of the locations above indicates that it has been scheduled (and therefore meets the requirement).

#### SCAP Security Guide Version:

https://github.com/ComplianceAsCode/content/blob/c1aa29c927b976389abbfe94000b72c01f5aff08/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/oval/shared.xml

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.