Project

General

Profile

Actions
Copy link

action #114445

closed

action #93886: [sle][security][backlog]automate testing of scap-security-guide

[security] add stig and stig_remediated_selinux tests to 15-SP4 security maintenance job group

Added by pstivanin almost 2 years ago. Updated about 1 year ago.

Status:
Resolved
Priority:
Normal
Assignee:
pstivanin
Category:
New test
Target version:
-
Start date:
2022-07-21
Due date:
% Done:

100%

Estimated time:
Difficulty:
Tags:
featureQA
Actions
Copy link
 #2

Updated by pstivanin almost 2 years ago

  • Status changed from New to In Progress
  • Estimated time set to 16.00 h
Actions
Copy link
 #3

Updated by maritawerner almost 2 years ago

  • Subject changed from add stig and stig_remediated_selinux tests to 15-SP4 security maintenance job group to [security] add stig and stig_remediated_selinux tests to 15-SP4 security maintenance job group
Actions
Copy link
 #4

Updated by pstivanin almost 2 years ago

The test currently fails because it requires a huge amount of RAM. I've done some testing (and updated https://bugzilla.suse.com/show_bug.cgi?id=1194724), and I found out that we need 16 GB to successfully execute the 'stig' test.

Actions
Copy link
 #5

Updated by pstivanin almost 2 years ago

We are currently shipping oscap v1.3.5 on 15-SP4, and with release 1.3.6 there seems to be a memory limit option: https://github.com/OpenSCAP/openscap/blob/maint-1.3/NEWS#L5=
The alternative would be to use a highmem worker in openqa.

Actions
Copy link
 #6

Updated by pstivanin almost 2 years ago

With a 16 GB worker, the eval test passes successfully. Now we are blocked due to https://bugzilla.opensuse.org/show_bug.cgi?id=1194676 .

Actions
Copy link
 #7

Updated by pstivanin almost 2 years ago

  • Status changed from In Progress to Blocked
Actions
Copy link
 #8

Updated by okurz almost 2 years ago

  • Category set to New test
Actions
Copy link
 #9

Updated by pstivanin almost 2 years ago

Due to https://bugzilla.opensuse.org/show_bug.cgi?id=1194676 , we need to wait until scap-security-guide 1.63 is released on 15-SP4. This should happen some time in August.

Actions
Copy link
 #10

Updated by pstivanin over 1 year ago

  • Assignee set to pstivanin

We need version 1.64, because some fixes were not part of the 1.63 release. This means that we've gotta wait until end of Sep.

Actions
Copy link
 #11

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/9564570#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 96 days if nothing changes in this ticket.

Actions
Copy link
 #12

Updated by pstivanin over 1 year ago

0.1.64 is out. Now we need to wait until it reaches 15-SP{4,5}

Actions
Copy link
 #13

Updated by pstivanin over 1 year ago

Actions
Copy link
 #14

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/9758790#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #15

Updated by pstivanin over 1 year ago

MR still in staging.

Actions
Copy link
 #16

Updated by pstivanin over 1 year ago

S:M:26335:283327 is now in the testing queue.

Actions
Copy link
 #17

Updated by pstivanin over 1 year ago

  • Status changed from Blocked to In Progress
  • % Done changed from 0 to 20
  • Estimated time deleted (16.00 h)
Actions
Copy link
 #18

Updated by pstivanin over 1 year ago

  • Status changed from In Progress to Blocked
  • % Done changed from 20 to 40

some remediation are now passing, but a few are still failing:

Failing/erroring remediations:
Title   Verify '/proc/sys/crypto/fips_enabled' exists
Rule    xccdf_org.ssgproject.content_rule_is_fips_mode_enabled
Ident   CCE-85763-1
Result  fail

Title   Ensure /var/log/audit Located On Separate Partition
Rule    xccdf_org.ssgproject.content_rule_partition_for_var_log_audit
Ident   CCE-85618-7
Result  fail

Title   Install Smart Card Packages For Multifactor Authentication
Rule    xccdf_org.ssgproject.content_rule_install_smartcard_packages
Ident   CCE-83292-3
E: oscap:     RPM: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found

error: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found
E: oscap:     RPM: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found

error: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found
E: oscap:     RPM: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found

error: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found
E: oscap:     RPM: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found

error: db4 error(-30986) from dbcursor->c_get: DB_PAGE_NOTFOUND: Requested page not found
Result  error

Title   Configure Smart Card Certificate Authority Validation
Rule    xccdf_org.ssgproject.content_rule_smartcard_configure_ca
Ident   CCE-83272-5
Result  error

Title   Configure Smart Card Certificate Status Checking
Rule    xccdf_org.ssgproject.content_rule_smartcard_configure_cert_checking
Ident   CCE-83293-1
Result  error

Title   Ensure the default plugins for the audit dispatcher are Installed
Rule    xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
Ident   CCE-85613-8
Result  error

Title   Install the pam_apparmor Package
Rule    xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Ident   CCE-85765-6
Result  error

Title   Set Boot Loader Password in grub2
Rule    xccdf_org.ssgproject.content_rule_grub2_password
Ident   CCE-83274-1
Result  fail

I've reopened https://bugzilla.opensuse.org/show_bug.cgi?id=1194676 .
Also, while on 15-SP4 we are using the most recent version, on 15-SP5-beta1 we are still using the older 0.1.63-150000.1.45.1.

Actions
Copy link
 #19

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/9969414#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #20

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/10019850#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 56 days if nothing changes in this ticket.

Actions
Copy link
 #24

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/10219437#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #25

Updated by tjyrinki_suse over 1 year ago

Viktor has independently started working on a fix on the bug that is blocking this ticket, PR brewing at https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/16234

Actions
Copy link
 #26

Updated by pstivanin about 1 year ago

this requires apparmor to be enabled on mru job

Actions
Copy link
 #27

Updated by pstivanin about 1 year ago

  • % Done changed from 40 to 60

done with: https://gitlab.suse.de/qa-maintenance/qam-openqa-yml/-/merge_requests/452

now the test is green on all archs: https://openqa.suse.de/tests/overview?distri=sle&version=15-SP4&build=20230125-1&groupid=431

I'll let it run there for the weekend, and then merge the PR on Monday if everything will stay green and stable during these days.

Actions
Copy link
 #29

Updated by openqa_review about 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/10435912#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #30

Updated by openqa_review about 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/10528785#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #31

Updated by pstivanin about 1 year ago

  • Status changed from Blocked to In Progress
Actions
Copy link
 #32

Updated by pstivanin about 1 year ago

  • Status changed from In Progress to Resolved
Actions
Copy link
 #33

Updated by pstivanin about 1 year ago

  • % Done changed from 60 to 100
Actions
Copy link
 #34

Updated by openqa_review about 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: stig
https://openqa.suse.de/tests/10599073#step/oscap_xccdf_remediate/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link

Also available in: Atom PDF