Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-28797

The instructions for rule rhcos4-banner-etc-issue is not helpful

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Normal
    • None
    • 4.15.0
    • Compliance Operator
    • None

    Description

      Description of problem:

       

      The instructions for rule rhcos4-banner-etc-issue is not helpful
      
      $ oc get rule rhcos4-banner-etc-issue -o=jsonpath={.instructions}
      To check if the system login banner is compliant,
      run the following command:
      $ cat /etc/issue
       
      $ oc debug node/ip-10-0-3-55.us-east-2.compute.internal
      Temporary namespace openshift-debug-ph4hg is created for debugging node...
      Starting pod/ip-10-0-3-55us-east-2computeinternal-debug ...
      To use host binaries, run `chroot /host`
      Pod IP: 10.0.3.55
      If you don't see a command prompt, try pressing enter.
      sh-4.4# chroot /host
      sh-5.1# cat /etc/issue
      \S \S{VERSION_ID}
      sh-5.1# cat /etc/issue.d/legal-notice
      You are accessing a U.S. Government (USG) Information System (IS) that is 
      provided for USG-authorized use only. By using this IS (which includes any 
      device attached to this IS), you consent to the following conditions:
       
      -The USG routinely intercepts and monitors communications on this IS for 
      purposes including, but not limited to, penetration testing, COMSEC monitoring, 
      network operations and defense, personnel misconduct (PM), law enforcement 
      (LE), and counterintelligence (CI) investigations.
       
      -At any time, the USG may inspect and seize data stored on this IS.
       
      -Communications using, or data stored on, this IS are not private, are subject 
      to routine monitoring, interception, and search, and may be disclosed or used 
      for any USG-authorized purpose.
       
      -This IS includes security measures (e.g., authentication and access controls) 
      to protect USG interests--not for your personal benefit or privacy.
       
      -Notwithstanding the above, using this IS does not constitute consent to PM, LE 
      or CI investigative searching or monitoring of the content of privileged 
      communications, or work product, related to personal representation or services 
      by attorneys, psychotherapists, or clergy, and their assistants. Such 
      communications and work product are private and confidential. See User 
      Agreement for details    
      

      Version-Release number of selected component (if applicable):

       Compliance Operator v1.4.0   

      How reproducible:

       Always   

      Steps to Reproduce:

          1. $ oc get rule rhcos4-banner-etc-issue -o=jsonpath={.instructions} 
          

      Actual results:

      The instructions for rule rhcos4-banner-etc-issue is not helpful    

      Expected results:

      The instructions for rule rhcos4-banner-etc-issue should be helpful    

      Additional info:
      from the rule description, /etc/issue.d/legal-notice should be the file to check.

       

      $ oc describe rule rhcos4-banner-etc-issue
      Name:         rhcos4-banner-etc-issue
      Namespace:    openshift-compliance
      Labels:       compliance.openshift.io/profile-bundle=rhcos4
      Annotations:  compliance.openshift.io/image-digest: pb-rhcos4xz7xq
                    compliance.openshift.io/profiles: rhcos4-high-rev-4,rhcos4-high,rhcos4-moderate-rev-4,rhcos4-moderate,rhcos4-nerc-cip
                    compliance.openshift.io/rule: banner-etc-issue
                    control.compliance.openshift.io/NIST-800-53: AC-8(a);AC-8(c)
                    policies.open-cluster-management.io/controls: AC-8(a),AC-8(c)
                    policies.open-cluster-management.io/standards: NIST-800-53
      API Version:  compliance.openshift.io/v1alpha1
      Check Type:   Node
      Description:  To configure the system login banner create a file under /etc/issue.d The DoD required text is either:
       
      You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions:
       
      -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
       
      -At any time, the USG may inspect and seize data stored on this IS.
       
      -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
       
      -This IS includes security measures (e.g., authentication and access controls) to protect USG interests -- not for your personal benefit or privacy.
       
      -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
       
      OR:
       
      I've read & consent to terms in IS user agreem't.
       
      To address this, please create a Machineconfig object with the appropriate text in a drop-in file in /etc/issue.d/. Do not try to edit /etc/issue directly as this is a symlink provided by the Operating System.
       
      For example, if you're using the DoD required text, the manifest would look as follows:
       
      ---
      apiVersion: machineconfiguration.openshift.io/v1
      kind: MachineConfig
      metadata:
       labels:
         machineconfiguration.openshift.io/role: master
       name: 75-master-etc-issue
      spec:
       config:
         ignition:
           version: 3.1.0
         storage:
           files:
           - contents:
               source: data:,You%20are%20accessing%20a%20U.S.%20Government%20%28USG%29%20Information%20System%20%28IS%29%20that%20is%20%0Aprovided%20for%20USG-authorized%20use%20only.%20By%20using%20this%20IS%20%28which%20includes%20any%20%0Adevice%20attached%20to%20this%20IS%29%2C%20you%20consent%20to%20the%20following%20conditions%3A%0A%0A-The%20USG%20routinely%20intercepts%20and%20monitors%20communications%20on%20this%20IS%20for%20%0Apurposes%20including%2C%20but%20not%20limited%20to%2C%20penetration%20testing%2C%20COMSEC%20monitoring%2C%20%0Anetwork%20operations%20and%20defense%2C%20personnel%20misconduct%20%28PM%29%2C%20law%20enforcement%20%0A%28LE%29%2C%20and%20counterintelligence%20%28CI%29%20investigations.%0A%0A-At%20any%20time%2C%20the%20USG%20may%20inspect%20and%20seize%20data%20stored%20on%20this%20IS.%0A%0A-Communications%20using%2C%20or%20data%20stored%20on%2C%20this%20IS%20are%20not%20private%2C%20are%20subject%20%0Ato%20routine%20monitoring%2C%20interception%2C%20and%20search%2C%20and%20may%20be%20disclosed%20or%20used%20%0Afor%20any%20USG-authorized%20purpose.%0A%0A-This%20IS%20includes%20security%20measures%20%28e.g.%2C%20authentication%20and%20access%20controls%29%20%0Ato%20protect%20USG%20interests--not%20for%20your%20personal%20benefit%20or%20privacy.%0A%0A-Notwithstanding%20the%20above%2C%20using%20this%20IS%20does%20not%20constitute%20consent%20to%20PM%2C%20LE%20%0Aor%20CI%20investigative%20searching%20or%20monitoring%20of%20the%20content%20of%20privileged%20%0Acommunications%2C%20or%20work%20product%2C%20related%20to%20personal%20representation%20or%20services%20%0Aby%20attorneys%2C%20psychotherapists%2C%20or%20clergy%2C%20and%20their%20assistants.%20Such%20%0Acommunications%20and%20work%20product%20are%20private%20and%20confidential.%20See%20User%20%0AAgreement%20for%20details.
             mode: 0644
             path: /etc/issue.d/legal-notice
             overwrite: true
       
      Note that this needs to be done for each MachineConfigPool
       
      For more information on how to configure nodes with the Machine Config Operator see the relevant documentation ( https://docs.openshift.com/container-platform/4.6/post_installation_configuration/machine-configuration-tasks.html ).
      Id:            xccdf_org.ssgproject.content_rule_banner_etc_issue
      Instructions:  To check if the system login banner is compliant,
      run the following command:
      $ cat /etc/issue
      Kind:  Rule
      Metadata:
        Creation Timestamp:  2024-02-01T02:54:35Z
        Generation:          1
        Managed Fields:
          API Version:  compliance.openshift.io/v1alpha1
          Fields Type:  FieldsV1
          fieldsV1:
            f:checkType:
            f:description:
            f:id:
            f:instructions:
            f:metadata:
              f:annotations:
                .:
                f:compliance.openshift.io/image-digest:
                f:compliance.openshift.io/profiles:
                f:compliance.openshift.io/rule:
                f:control.compliance.openshift.io/NIST-800-53:
                f:policies.open-cluster-management.io/controls:
                f:policies.open-cluster-management.io/standards:
              f:labels:
                .:
                f:compliance.openshift.io/profile-bundle:
              f:ownerReferences:
                .:
                k:{"uid":"d0c9f915-9d72-4cb2-95b0-b4d973d5c1cf"}:
            f:rationale:
            f:severity:
            f:title:
          Manager:    compliance-operator
          Operation:  Update
          Time:       2024-02-01T08:24:38Z
        Owner References:
          API Version:           compliance.openshift.io/v1alpha1
          Block Owner Deletion:  true
          Controller:            true
          Kind:                  ProfileBundle
          Name:                  rhcos4
          UID:                   d0c9f915-9d72-4cb2-95b0-b4d973d5c1cf
        Resource Version:        200093
        UID:                     1a55a9ba-40a7-4f82-a599-f3904455fee0
      Rationale:                 Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
       
      System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist.
      Severity:  medium
      Title:     Modify the System Login Banner
      Events:    <none>    
      

      Attachments

        Issue Links

          Activity

            People

              lbragsta@redhat.com Lance Bragstad
              xiyuan@redhat.com Xiaojie Yuan
              Bhargavi Gudi Bhargavi Gudi
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated: