Bug 2209660

Summary: More complete CIS network remediation
Product: Red Hat Enterprise Linux 9 Reporter: Marko Myllynen <myllynen>
Component: scap-security-guideAssignee: Watson Yuuma Sato <wsato>
Status: CLOSED MIGRATED QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 9.2CC: ggasparb, juschind, matyc, mhaicman, mlysonek, openscap-maint, vpolasek
Target Milestone: rcKeywords: MigratedToJIRA, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-08-09 10:31:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marko Myllynen 2023-05-24 12:06:22 UTC 
Description of problem:
CIS RHEL 9 Benchmark 1.0.0 PDF states that network related changes should be monitored and then lists /etc/issue, /etc/issue.net, /etc/hosts, /etc/sysconfig/network, and /etc/sysconfig/network-scripts.

scap-security-guide-0.1.66-1.el9_1 only creates the following:

# cat /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
-a always,exit -F arch=b32 -S sethostname -S setdomainname -F key=audit_rules_networkconfig_modification
-a always,exit -F arch=b64 -S sethostname -S setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

This is missing /etc/sysconfig/network-scripts and it also does not cover typical network configuration changes on RHEL 9 which are in /etc/NetworkManager. Adding /etc/hostname might also be considered being a related configuration.

It looks like at least for CIS oscap should add at least /etc/sysconfig/network-scripts and /etc/NetworkManager for monitoring, perhaps also /etc/hostname. Thanks.
Comment 2 Vojtech Polasek 2023-05-25 08:21:14 UTC 
Hello Marko,
thank you for the suggestion. We can add the rule auditing access to /etc/sysconfig/network-scripts.
Other paths you suggest definitely make sense, but we should probably talk to CIS community and suggest those new rules first before we include them in our CIS profiles.
Comment 3 Matěj Týč 2023-08-09 09:41:27 UTC 
This BZ will be migrated to the RHEL project in Red Hat Jira [1].
This means that this very BZ will be closed, and any further progress will be discussed in the new issue seamlessly. The link of the migrated issue should appear here later.
Contact matyc in case of any problems associated with the migration.

References:
  [1]: https://issues.redhat.com/browse/RHEL