Understanding the Compliance Operator

The Compliance Operator lets OKD administrators describe the required compliance state of a cluster and provides them with an overview of gaps and ways to remediate them. The Compliance Operator assesses compliance of both the Kubernetes API resources of OKD, as well as the nodes running the cluster. The Compliance Operator uses OpenSCAP, a NIST-certified tool, to scan and enforce security policies provided by the content.

The Compliance Operator is available for Fedora CoreOS (FCOS) deployments only.

Compliance Operator profiles

There are several profiles available as part of the Compliance Operator installation. You can use the oc get command to view available profiles, profile details, and specific rules.

  • View the available profiles:

    1. $ oc get -n <namespace> profiles.compliance

    This example displays the profiles in the default openshift-compliance namespace:

    1. $ oc get -n openshift-compliance profiles.compliance

    Example output

    1. NAME                 AGE
    2. ocp4-cis             32m
    3. ocp4-cis-node        32m
    4. ocp4-e8              32m
    5. ocp4-moderate        32m
    6. ocp4-moderate-node   32m
    7. ocp4-nerc-cip        32m
    8. ocp4-nerc-cip-node   32m
    9. ocp4-pci-dss         32m
    10. ocp4-pci-dss-node    32m
    11. rhcos4-e8            32m
    12. rhcos4-moderate      32m
    13. rhcos4-nerc-cip      32m

    These profiles represent different compliance benchmarks. Each profile has the product name that it applies to added as a prefix to the profile’s name. ocp4-e8 applies the Essential 8 benchmark to the OKD product, while rhcos4-e8 applies the Essential 8 benchmark to the Fedora CoreOS (FCOS) product.

  • View the details of a profile:

    1. $ oc get -n <namespace> -oyaml profiles.compliance <profile name>

    This example displays the details of the rhcos4-e8 profile:

    1. $ oc get -n openshift-compliance -oyaml profiles.compliance rhcos4-e8

    Example output

    1. apiVersion: compliance.openshift.io/v1alpha1
    2. description: |-
    3.   This profile contains configuration checks for Red Hat
    4.   Enterprise Linux CoreOS that align to the Australian
    5.   Cyber Security Centre (ACSC) Essential Eight.
    6.   A copy of the Essential Eight in Linux Environments guide can
    7.   be found at the ACSC website: ...
    8.   id: xccdf_org.ssgproject.content_profile_e8
    9.   kind: Profile
    10.   metadata:
    11.     annotations:
    12.       compliance.openshift.io/image-digest: pb-rhcos426smj
    13.       compliance.openshift.io/product: redhat_enterprise_linux_coreos_4
    14.       compliance.openshift.io/product-type: Node
    15.     labels:
    16.       compliance.openshift.io/profile-bundle: rhcos4
    17.     name: rhcos4-e8
    18.     namespace: openshift-compliance
    19.     ownerReferences:
    20.     - apiVersion: compliance.openshift.io/v1alpha1
    21.       blockOwnerDeletion: true
    22.       controller: true
    23.       kind: ProfileBundle
    24.       name: rhcos4
    25.   rules:
    26.   - rhcos4-accounts-no-uid-except-zero
    27.   - rhcos4-audit-rules-dac-modification-chmod
    28.   - rhcos4-audit-rules-dac-modification-chown
    29.   - rhcos4-audit-rules-execution-chcon
    30.   - rhcos4-audit-rules-execution-restorecon
    31.   - rhcos4-audit-rules-execution-semanage
    32.   - rhcos4-audit-rules-execution-setfiles
    33.   - rhcos4-audit-rules-execution-setsebool
    34.   - rhcos4-audit-rules-execution-seunshare
    35.   - rhcos4-audit-rules-kernel-module-loading-delete
    36.   - rhcos4-audit-rules-kernel-module-loading-finit
    37.   - rhcos4-audit-rules-kernel-module-loading-init
    38.   - rhcos4-audit-rules-login-events
    39.   - rhcos4-audit-rules-login-events-faillock
    40.   - rhcos4-audit-rules-login-events-lastlog
    41.   - rhcos4-audit-rules-login-events-tallylog
    42.   - rhcos4-audit-rules-networkconfig-modification
    43.   - rhcos4-audit-rules-sysadmin-actions
    44.   - rhcos4-audit-rules-time-adjtimex
    45.   - rhcos4-audit-rules-time-clock-settime
    46.   - rhcos4-audit-rules-time-settimeofday
    47.   - rhcos4-audit-rules-time-stime
    48.   - rhcos4-audit-rules-time-watch-localtime
    49.   - rhcos4-audit-rules-usergroup-modification
    50.   - rhcos4-auditd-data-retention-flush
    51.   - rhcos4-auditd-freq
    52.   - rhcos4-auditd-local-events
    53.   - rhcos4-auditd-log-format
    54.   - rhcos4-auditd-name-format
    55.   - rhcos4-auditd-write-logs
    56.   - rhcos4-configure-crypto-policy
    57.   - rhcos4-configure-ssh-crypto-policy
    58.   - rhcos4-no-empty-passwords
    59.   - rhcos4-selinux-policytype
    60.   - rhcos4-selinux-state
    61.   - rhcos4-service-auditd-enabled
    62.   - rhcos4-sshd-disable-empty-passwords
    63.   - rhcos4-sshd-disable-gssapi-auth
    64.   - rhcos4-sshd-disable-rhosts
    65.   - rhcos4-sshd-disable-root-login
    66.   - rhcos4-sshd-disable-user-known-hosts
    67.   - rhcos4-sshd-do-not-permit-user-env
    68.   - rhcos4-sshd-enable-strictmodes
    69.   - rhcos4-sshd-print-last-log
    70.   - rhcos4-sshd-set-loglevel-info
    71.   - rhcos4-sysctl-kernel-dmesg-restrict
    72.   - rhcos4-sysctl-kernel-kptr-restrict
    73.   - rhcos4-sysctl-kernel-randomize-va-space
    74.   - rhcos4-sysctl-kernel-unprivileged-bpf-disabled
    75.   - rhcos4-sysctl-kernel-yama-ptrace-scope
    76.   - rhcos4-sysctl-net-core-bpf-jit-harden
    77.   title: Australian Cyber Security Centre (ACSC) Essential Eight

  • View the rules within a desired profile:

    1. $ oc get -n <namespace> -oyaml rules.compliance <rule_name>

    This example displays the rhcos4-audit-rules-login-events rule in the rhcos4 profile:

    1. $ oc get -n openshift-compliance -oyaml rules.compliance rhcos4-audit-rules-login-events

    Example output

    1.   apiVersion: compliance.openshift.io/v1alpha1
    2.   checkType: Node
    3.   description: |-
    4.     The audit system already collects login information for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix.rules in the directory /etc/audit/rules.d in order to watch for attempted manual edits of files involved in storing logon events:
    6.     -w /var/log/tallylog -p wa -k logins
    7.     -w /var/run/faillock -p wa -k logins
    8.     -w /var/log/lastlog -p wa -k logins
    10.     If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file in order to watch for unattempted manual edits of files involved in storing logon events:
    12.     -w /var/log/tallylog -p wa -k logins
    13.     -w /var/run/faillock -p wa -k logins
    14.     -w /var/log/lastlog -p wa -k logins
    15.   id: xccdf_org.ssgproject.content_rule_audit_rules_login_events
    16.   kind: Rule
    17.   metadata:
    18.     annotations:
    19.       compliance.openshift.io/image-digest: pb-rhcos426smj
    20.       compliance.openshift.io/rule: audit-rules-login-events
    21.       control.compliance.openshift.io/NIST-800-53: AU-2(d);AU-12(c);AC-6(9);CM-6(a)
    22.       control.compliance.openshift.io/PCI-DSS: Req-10.2.3
    23.       policies.open-cluster-management.io/controls: AU-2(d),AU-12(c),AC-6(9),CM-6(a),Req-10.2.3
    24.       policies.open-cluster-management.io/standards: NIST-800-53,PCI-DSS
    25.     labels:
    26.       compliance.openshift.io/profile-bundle: rhcos4
    27.     name: rhcos4-audit-rules-login-events
    28.     namespace: openshift-compliance
    29.     ownerReferences:
    30.     - apiVersion: compliance.openshift.io/v1alpha1
    31.       blockOwnerDeletion: true
    32.       controller: true
    33.       kind: ProfileBundle
    34.       name: rhcos4
    35.   rationale: Manual editing of these files may indicate nefarious activity, such as
    36.     an attacker attempting to remove evidence of an intrusion.
    37.   severity: medium
    38.   title: Record Attempts to Alter Logon and Logout Events
    39.   warning: Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion.