Failure to deploy oVirt node with security profile (PCI-DSS)

[gpavinteractiv]

As reported on ovirt users mailing list:

I tried with el8 & el9 oVirt Node 4.5.4 isos,
But in both cases, the installation failed when selecting the PCI-DSS security profile. Please see screenshots attached

According to 4.5.0 release note this is a supported feature :

BZ 2030226 [RFE] oVirt hypervisors should support running on hosts with the PCI-DSS security profile applied
The oVirt Hypervisor is now capable of running on machine with PCI-DSS security profile.

https://bugzilla.redhat.com/show_bug.cgi?id=2030226

As the RFE says that deployment works, I guess this is a regression somewhere between 4.5.0 & 4.5.4

On the mailing list, @sandrobonazzola answered :

In the screenshot I see ssg-onn4-ds being selected, I would have expected it to be ssg-onn45-ds.xml as that's the one being created in https://github.com/oVirt/ovirt-node-ng-image.
This one should be an easy fix, just changing the name of the file to match what's expected by anaconda.

[michalskrivanek]

"BZ 2030226 [RFE] oVirt hypervisors should ..." is probably just an automatic translation, you can see in the bug it was a RHV feature. We do not test this upstream in oVirt really, mostly because it's hard to keep up with the profile changes. It may work, I don't mind merging a patch if you post one and confirm it works.

[gpavinteractiv]

I don't have the know how to build an image with theses changes in order to test them.
Could the build be done on oVirt infra, if such thing is possible, and I'll happily test and report ?

[michalskrivanek]

unfortunately not. for this project the automation is too tied with actual release. But it shouldnt' be that difficult to run locally, just prepare host as https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L40 and run priviledged container from https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L57 with the script and few variables like https://github.com/oVirt/ovirt-node-ng-image/blob/master/.github/workflows/build.yml#L66

[gpavinteractiv]

@michalskrivanek
I'm totally unsure of the individual steps to build the iso.

On a clean centos stream 9, could you provide the exact command flow that will result in creating the container with the proper variables you mentioned and then run build.sh?

[michalskrivanek]

i dont' have it at hand, but really just copying from the workflow code it should be
mkdir -p /host/modules
mount --bind /lib/modules/$(uname -r) /host/modules
podman run -it --privileged -v /host/modules:/host/modules quay.io/ovirt/buildcontainer:el9stream
and then inside just check out the repo with your PR and run
export SUPERMIN_MODULES=/host/modules
export SUPERMIN_KERNEL=/host/modules/vmlinuz
build.sh

[gpavinteractiv]

Thank!
We have build the centos 9 iso with the aforementioned patch :

Change the name of the file to match what's expected by anaconda. From :
ln -sf/usr/share/xml/scap/ssg/content/{ssg-rhel9,ssg-onn45}-ds.xml
To :
ln -sf /usr/share/xml/scap/ssg/content/{ssg-rhel9,ssg-onn4}-ds.xml

Please note that we kept linking from ssg-rhel9-ds.xml, as originally.
However, there is also a ssg-cs9-ds.xml in the same folder.

• Do you know if applying the rhel9 rules to a centos is valid ?

• We got an error when starting the installtaion :
  

The host has been provisioned and joined to the oVirt Cluster. It seems to be working properly.

• Do you know how can we check that the PCI-DSS profile has been correctly applied?

[sandrobonazzola]

Please use the cs9 one as the OVAL tuple isn't matching between cs9 and rhel9.

Once deployed, you can check it with:

sudo oscap xccdf eval --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_pci-dss --report /tmp/report.html /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml and look at the report.

[sandrobonazzola]

Should be fixed by #115

[gpavinteractiv]

Sorry for coming back to you late.

I see that you have merged my initial patch linking to ssg-rhel9-ds.xml

In the meantime, I had followed your advice and retried builing an iso while linking to ssg-cs9-ds.xml

Two notes :

• I still got the same exact error complaining about ssg-rhel9-ds.xml not being valid, even thoud we are linking to ssg-cs9-ds.xml :
  

• after installation I tried the oscap eval command but many tests are in failed state. Therefore I am unsure if the profile was applied or not. Please find the oscap eval --verbose DEVEL & html reports attached.
  oscap-eval-verbose-2023-05-17.log
  report-oscap-eval-2023-05-17.html.zip