Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add VM tests for os_hardening #547

Merged
merged 23 commits into from
Jul 11, 2022
Merged

add VM tests for os_hardening #547

merged 23 commits into from
Jul 11, 2022

Conversation

schurzi
Copy link
Contributor

@schurzi schurzi commented Jul 11, 2022

Wen need to use full VMs to test every aspect of our os_hardening role. These are now integrated and check all controls of the supporting baseline.

While implementing there were some minor bugs to fix:

  • check for /boot existence was not correct
  • some sysctls were unsupported on older platforms (an exclude mechanism was introduced)
  • gpg-check for yum config did not account for already correct configuration

schurzi added 22 commits July 9, 2022 00:52
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
@schurzi
Copy link
Contributor Author

schurzi commented Jul 11, 2022

the task for ctrl-alt-del.target seems to not be idempotent, I have excluded it from the tests. Since it is disabled by default, I see no problem here.

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
@rndmh3ro
Copy link
Member

the task for ctrl-alt-del.target seems to not be idempotent, I have excluded it from the tests. Since it is disabled by default, I see no problem here.

#548

@schurzi schurzi merged commit e03e435 into master Jul 11, 2022
@schurzi schurzi deleted the vm_tests branch July 11, 2022 19:57
divialth pushed a commit to divialth/ansible-collection-hardening that referenced this pull request Aug 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants