Implement automation and checks for configured_firewalld_default_deny - #14995
Conversation
This adds the missing OVAL, Bash, Ansible, and testing scenarios for the configured_firewalld_default_deny rule to ensure the DefaultZone is configured to a deny-all policy (drop) per STIG requirements.
|
Hi @pradeepkch6-ai. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
Please take a look the CI failures, they seem valid.
| @@ -0,0 +1,44 @@ | |||
| <def-group> | |||
| <definition class="compliance" id="configured_firewalld_default_deny" version="1"> | |||
There was a problem hiding this comment.
| <definition class="compliance" id="configured_firewalld_default_deny" version="1"> | |
| <definition class="compliance" id="{{{ rule_id }}" version="1"> |
|
@Mab879 Thank you for catching that! I've just updated the |
| </local_variable> | ||
|
|
||
| <ind:xmlfilecontent_test id="test_firewalld_default_zone_target_drop" version="1" check="all" check_existence="at_least_one_exists" comment="Ensure default zone has target DROP"> | ||
| <ind:object object_ref="object_firewalld_default_zone_target_drop_etc" /> |
There was a problem hiding this comment.
This is invalid OVAL. You need split this into test two tests.
2 participants
Summary
This PR implements the missing automation (OVAL, Bash, Ansible, and test scenarios) for the
configured_firewalld_default_denyrule.Motivation
The
configured_firewalld_default_denyrule maps to critical DISA STIG and NIST compliance requirements (e.g. SRG-OS-000297-GPOS-00115, AC-17) regarding the enforcement of a default-deny, allow-by-exception firewall policy. The rule was previously missing all remediation scripts and automated validation mechanisms.Technical Implementation
DefaultZonedynamically from/etc/firewalld/firewalld.confusingtextfilecontent54_object, concatenates it into the corresponding zone XML filename, and ensures the active default zone contains<zone target="DROP">in either/etc/firewalld/zones/or/usr/lib/firewalld/zones/.DefaultZone=dropinsidefirewalld.conf.Limitations
The OVAL check successfully validates that the
DefaultZoneenforces aDROPtarget, mitigating globally unset interfaces. It does not actively loop through arbitrary custom zones that interfaces may be mapped to if they override the default zone logic. Validating the default zone's XML target represents the most robust OVAL-compatible check.