diff --git a/Changelog.md b/Changelog.md index ec8f5520..1d14c1c1 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,8 +1,22 @@ # Changes to rhel8CIS +## 1.3.1 +- CIS 1.0.1 updates +- Added Issue and PR templates +- Added better reboot logic +- Added options to ensure idempotence +- Enhanced flush handlers +- Typo fixes +- mount check improvements +- Linting fixes +- Added systemd tmp mount +- Added systemd tmpfs block +- #110 tmp.mount support + - thanks to @erpadmin + + ## 1.3 -- CIS 1.0.1 - extentions to LE audit capability - more lint and layout changes - sugroup assertion added 5.7 diff --git a/tasks/section_1/cis_1.1.x.yml b/tasks/section_1/cis_1.1.x.yml index a05bb9f1..17608579 100644 --- a/tasks/section_1/cis_1.1.x.yml +++ b/tasks/section_1/cis_1.1.x.yml @@ -1,77 +1,64 @@ --- -- name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured" - block: - - name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured | Absent" - debug: - msg: "WARNING: {{ required_mount }} doesn't exist. This is a manual task" - register: tmp_mount_absent - changed_when: tmp_mount_absent.skipped is undefined - when: - - required_mount not in mount_names - - - name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured | Present" - debug: - msg: "Congratulations: {{ required_mount }} exists." - register: tmp_mount_present - when: - - required_mount in mount_names - vars: - required_mount: '/tmp' +- name: | + "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured" + "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition" + "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition" + "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition" + "via fstab" + mount: + name: /tmp + src: "{{ item.device }}" + fstype: "{{ item.fstype }}" + state: present + opts: defaults,{% if rhel8cis_rule_1_1_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_4 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_5 %}nosuid{% endif %} + notify: remount tmp + loop: "{{ ansible_mounts }}" + when: + - item.mount == "/tmp" + - not rhel8cis_tmp_svc + - rhel8cis_rule_1_1_2 or + rhel8cis_rule_1_1_3 or + rhel8cis_rule_1_1_4 or + rhel8cis_rule_1_1_5 tags: - level1-server - level1-workstation - scored - - audit + - patch - mounts - - rule_1.1.2 + - rule_1.1.3 + - rule_1.1.4 + - rule_1.1.5 - name: | - "1.1.3 | L1 | PATCH | Ensure nodev option set on /tmp partition | skips if not present" - "1.1.4 | L1 | PATCH | Ensure nosuid option set on /tmp partition | skips if not present" - "1.1.5 | L1 | PATCH | Ensure noexec option set on /tmp partition| skips if not present" - block: - - name: | - "1.1.3 | L1 | PATCH | Ensure nodev option set on /tmp partition | fstab config | skips if mount absent" - "1.1.4 | L1 | PATCH | Ensure nosuid option set on /tmp partition | fstab_config | skips if mount absent" - "1.1.5 | L1 | PATCH | Ensure noexec option set on /tmp partition| fstab_config | skips if mount absent" - mount: - name: /tmp - src: "{{ item.device }}" - fstype: "{{ item.fstype }}" - state: present - opts: defaults,{% if rhel8cis_rule_1_1_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_4 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_5 %}nosuid{% endif %} - notify: remount tmp - loop: "{{ ansible_mounts }}" - when: - - not rhel8cis_tmp_svc - - item.mount == "/tmp" - - - name: | - "1.1.3 | L1 | PATCH | Ensure noexec option set on /tmp partition | systemd | skips if mount absent" - "1.1.4 | L1 | PATCH | Ensure nodev option set on /tmp partition | systemd | skips if mount absent" - "1.1.5 | L1 | PATCH | Ensure nosuid option set on /tmp partition | systemd | skips if mount absent" - template: - src: etc/tmp_mount.j2 - dest: /etc/systemd/system/tmp.mount - owner: root - group: root - mode: 0644 - notify: systemd restart tmp.mount - when: - - rhel8cis_tmp_svc + "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured" + "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition" + "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition" + "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition" + "via systemd" + template: + src: etc/systemd/system/tmp.mount.j2 + dest: /etc/systemd/system/tmp.mount + owner: root + group: root + mode: 0644 + notify: systemd restart tmp.mount when: - - tmp_mount_present is defined - - rhel8cis_rule_1_1_2 # This is required so the check takes place - - rhel8cis_rule_1_1_3 - - rhel8cis_rule_1_1_4 - - rhel8cis_rule_1_1_5 + - rhel8cis_tmp_svc + - rhel8cis_rule_1_1_2 or + rhel8cis_rule_1_1_3 or + rhel8cis_rule_1_1_4 or + rhel8cis_rule_1_1_5 tags: - - level1 - - patch - - rule_1.1.3 - - rule_1.1.4 - - rule_1.1.5 + - level1-server + - level1-workstation + - scored + - patch + - mounts + - rule_1.1.3 + - rule_1.1.4 + - rule_1.1.5 - name: "1.1.6 | L2 | AUDIT | Ensure separate partition exists for /var" block: diff --git a/tasks/section_4/cis_4.2.3.yml b/tasks/section_4/cis_4.2.3.yml index a895b64a..c5105030 100644 --- a/tasks/section_4/cis_4.2.3.yml +++ b/tasks/section_4/cis_4.2.3.yml @@ -1,7 +1,7 @@ --- - name: "4.2.3 | L1 | PATCH | Ensure permissions on all logfiles are configured" - command: find /var/log -type f -exec chmod g-wx,o-rwx {} + -o -type d -exec chmod g-w,o-rwx "{}" + + command: find /var/log/ -type f -perm /g+wx,o+rwx -exec chmod g-wx,o-rwx "{}" + changed_when: false failed_when: false when: diff --git a/templates/etc/systemd/system/tmp.mount.j2 b/templates/etc/systemd/system/tmp.mount.j2 new file mode 100644 index 00000000..e62d186d --- /dev/null +++ b/templates/etc/systemd/system/tmp.mount.j2 @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Temporary Directory (/tmp) +Documentation=man:hier(7) +Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems +ConditionPathIsSymbolicLink=!/tmp +DefaultDependencies=no +Conflicts=umount.target +Before=local-fs.target umount.target +After=swap.target + +[Mount] +What=tmpfs +Where=/tmp +Type=tmpfs +Options=mode=1777,strictatime,{% if rhel8cis_rule_1_1_3 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_4 %}nosuid,{% endif %}{% if rhel8cis_rule_1_1_5 %}noexec{% endif %} + +# Make 'systemctl enable tmp.mount' work: +[Install] +WantedBy=local-fs.target \ No newline at end of file