mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
61 lines
3.2 KiB
Plaintext
61 lines
3.2 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/compliance_operator/co-scans/compliance-operator-remediation.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="compliance-review_{context}"]
|
|
= Reviewing a remediation
|
|
|
|
Review both the `ComplianceRemediation` object and the `ComplianceCheckResult` object that owns the remediation. The `ComplianceCheckResult` object contains human-readable descriptions of what the check does and the hardening trying to prevent, as well as other `metadata` like the severity and the associated security controls. The `ComplianceRemediation` object represents a way to fix the problem described in the `ComplianceCheckResult`. After first scan, check for remediations with the state `MissingDependencies`.
|
|
|
|
Below is an example of a check and a remediation called `sysctl-net-ipv4-conf-all-accept-redirects`. This example is redacted to only show `spec` and `status` and omits `metadata`:
|
|
|
|
[source,yaml]
|
|
----
|
|
spec:
|
|
apply: false
|
|
current:
|
|
object:
|
|
apiVersion: machineconfiguration.openshift.io/v1
|
|
kind: MachineConfig
|
|
spec:
|
|
config:
|
|
ignition:
|
|
version: 3.2.0
|
|
storage:
|
|
files:
|
|
- path: /etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_redirects.conf
|
|
mode: 0644
|
|
contents:
|
|
source: data:,net.ipv4.conf.all.accept_redirects%3D0
|
|
outdated: {}
|
|
status:
|
|
applicationState: NotApplied
|
|
----
|
|
|
|
The remediation payload is stored in the `spec.current` attribute. The payload can be any Kubernetes object, but because this remediation was produced by a node scan, the remediation payload in the above example is a `MachineConfig` object. For Platform scans, the remediation payload is often a different kind of an object (for example, a `ConfigMap` or `Secret` object), but typically applying that remediation is up to the administrator, because otherwise the Compliance Operator would have required a very broad set of permissions to manipulate any generic Kubernetes object. An example of remediating a Platform check is provided later in the text.
|
|
|
|
To see exactly what the remediation does when applied, the `MachineConfig` object contents use the Ignition objects for the configuration. See the link:https://coreos.github.io/ignition/specs/[Ignition specification] for further information about the format. In our example, `the spec.config.storage.files[0].path` attribute specifies the file that is being create by this remediation (`/etc/sysctl.d/75-sysctl_net_ipv4_conf_all_accept_redirects.conf`) and the `spec.config.storage.files[0].contents.source` attribute specifies the contents of that file.
|
|
|
|
[NOTE]
|
|
====
|
|
The contents of the files are URL-encoded.
|
|
====
|
|
|
|
Use the following Python script to view the contents:
|
|
|
|
[source,terminal]
|
|
----
|
|
$ echo "net.ipv4.conf.all.accept_redirects%3D0" | python3 -c "import sys, urllib.parse; print(urllib.parse.unquote(''.join(sys.stdin.readlines())))"
|
|
----
|
|
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
net.ipv4.conf.all.accept_redirects=0
|
|
----
|
|
|
|
[IMPORTANT]
|
|
====
|
|
The Compliance Operator does not automatically resolve dependency issues that can occur between remediations. Users should perform a rescan after remediations are applied to ensure accurate results.
|
|
==== |