Improve aide rules for sle16/suse platform

Dockerfiles/test_suite-sle15

@@ -14,11 +14,10 @@ RUN true \
         $ADDITIONAL_PACKAGES \
 && true
 RUN pip install ansible && ansible-galaxy collection install ansible.posix
-
+RUN sed -i 's/mlkem768x25519-sha256,//g' /etc/crypto-policies/back-ends/opensshserver.config
 RUN true \
         && for key_type in rsa ecdsa; do ssh-keygen -N '' -t $key_type -f /etc/ssh/ssh_host_${key_type}_key; done \
         && mkdir -p /root/.ssh \
         && printf "%s\n" "$CLIENT_PUBLIC_KEY" >> "$AUTH_KEYS" \
         && chmod og-rw /root/.ssh "$AUTH_KEYS" \
 && true
-

linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/oval/shared.xml

@@ -14,7 +14,7 @@
 
   <!-- OVAL object to collect filename for Aide build database -->
   <ind:textfilecontent54_object id="object_aide_operational_database_filename" version="1">
-    <ind:filepath>/etc/aide.conf</ind:filepath>
+      <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
     {{% if product in ['sle12', 'sle15', 'slmicro5'] %}}
       <ind:pattern operation="pattern match">^database=file:/([/a-z.]+)$</ind:pattern>
     {{% elif product in ['sle16', 'slmicro6'] %}}
@@ -46,7 +46,7 @@
 {{% if 'sle' not in product and 'slmicro' not in product %}}
   <!-- OVAL object to collect directory path for Aide build database directory -->
   <ind:textfilecontent54_object id="object_aide_build_database_dirpath" version="1">
-    <ind:filepath>/etc/aide.conf</ind:filepath>
+    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
     <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
     <ind:instance operation="equals" datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>

linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml

@@ -16,7 +16,7 @@ description: |-
     {{% else %}}
     <tt>/var/lib/aide/aide.db.new.gz</tt>.
     {{% endif %}}
-    Storing the database, the configuration file <tt>/etc/aide.conf</tt>, and the binary
+    Storing the database, the configuration file <tt>{{{ aide_conf_path }}}</tt>, and the binary
     <tt>{{{ aide_bin_path }}}</tt>
     (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
     The newly-generated database can be installed as follows:

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/oval/shared.xml

@@ -11,7 +11,11 @@
 
   <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
     {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and 'fedora' not in product %}}
+    {{% if product in ['sle16'] %}}
+    <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+sha512</ind:subexpression>
+    {{% else %}}
     <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
+    {{% endif %}}
     {{% else %}}
     <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
     {{% endif %}}

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 aide --init
@@ -14,5 +14,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha512" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/expect_sbin_path.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -12,5 +12,9 @@ bins=(
 echo >> {{{ aide_conf_path }}}
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha512"  >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+xattrs+sha512"  >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/extra_suffix.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
 # packages = aide
 
 declare -a bins
@@ -11,5 +11,9 @@ bins=(
 
 for theFile in "${bins[@]}"
 do
+    {{% if product in ['sle16'] %}}
+    echo "$theFile p+i+n+u+g+s+b+acl+selinux+sha5122" >> {{{ aide_conf_path }}}
+    {{% else %}}
     echo "$theFile p+i+n+u+g+s+b+acl+selinux+xattrs+sha5122" >> {{{ aide_conf_path }}}
+    {{% endif %}}
 done

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux
+# platform = multi_platform_almalinux,multi_platform_fedora,multi_platform_sle,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu
 # packages = aide
 
 aide --init

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/ansible/shared.yml

@@ -4,14 +4,37 @@
 # complexity = low
 # disruption = low
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.service
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
+
+{{% if product in ["sle16"] %}}
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is including {{{ aide_conf_path }}}"
+  ansible.builtin.copy:
+      dest: /etc/aide_service.conf
+      owner: root
+      group: root
+      mode: '0600'
+      content: |-
+        @@include {{{ aide_conf_path }}}
+
+- name: "{{{ rule_title }}} - Make sure AIDE Check Service is in enabled state"
+  ansible.builtin.file:
+    src: /usr/lib/systemd/system/{{{ aide_service }}}
+    path: /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+    state: link
+{{% else %}}
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service {{{ aide_service }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_service }}}
       owner: root
       group: root
       mode: '0644'
-      block: |
+      content: |-
         [Unit]
         Description=Aide Check
         [Service]
@@ -20,35 +43,35 @@
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer"
-  ansible.builtin.blockinfile:
-      create: yes
-      dest: /etc/systemd/system/aidecheck.timer
+- name: "{{{ rule_title }}} - Define AIDE Periodic Check Service Timer {{{ aide_timer }}}"
+  ansible.builtin.copy:
+      dest: /etc/systemd/system/{{{ aide_timer }}}
       owner: root
       group: root
       mode: '0644'
-      block: |
+      content: |-
         [Unit]
         Description=Aide check every day at 5AM
         [Timer]
         OnCalendar=*-*-* 05:00:00
-        Unit=aidecheck.service
+        Unit={{{ aide_service }}}
         [Install]
         WantedBy=multi-user.target
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service is Enabled"
+{{% endif %}}
+- name: "{{{ rule_title }}} - Ensure AIDE Service {{{ aide_service }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.service
+    name: {{{ aide_service }}}
     enabled: true
     daemon_reload: true
     masked: false
   when: not ansible_check_mode
 
-- name: "{{{ rule_title }}} - Ensure AIDE Service Timer is Enabled"
+- name: "{{{ rule_title }}} - Ensure AIDE Service Timer {{{ aide_timer }}} is enabled"
   ansible.builtin.systemd:
-    name: aidecheck.timer
-    state: started
+    name: {{{ aide_timer }}}
     enabled: true
     daemon_reload: true
+    state: started
     masked: false
   when: not ansible_check_mode

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/bash/shared.sh

@@ -2,8 +2,22 @@
 
 {{{ bash_package_install("aide") }}}
 
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
+
+{{% if product in ["sle16"] %}}
+cat > /etc/aide_service.conf <<EOF
+@@include {{{ aide_conf_path }}}
+EOF
+ln -s /usr/lib/systemd/system/{{{ aide_service }}} /etc/systemd/system/multi-user.target.wants/{{{ aide_service }}}
+{{% else %}}
 # create unit file for periodic aide database check
-cat > /etc/systemd/system/aidecheck.service <<EOF
+cat > /etc/systemd/system/{{{ aide_service }}} <<EOF
 [Unit]
 Description=Aide Check
 [Service]
@@ -12,28 +26,32 @@ ExecStart={{{ aide_bin_path }}} --check
 [Install]
 WantedBy=multi-user.target
 EOF
-chmod 0644 /etc/systemd/system/aidecheck.service
 
-# create unit file for the aide check timer
-cat > /etc/systemd/system/aidecheck.timer <<EOF
+# create unit file for the aide timer
+cat > /etc/systemd/system/{{{ aide_timer }}} <<EOF
 [Unit]
 Description=Aide check every day at 5AM
 [Timer]
 OnCalendar=*-*-* 05:00:00
-Unit=aidecheck.service
+Unit={{{ aide_service }}}
 [Install]
 WantedBy=multi-user.target
 EOF
 
 #  setup service unit files attributes
-chown root:root /etc/systemd/system/aidecheck.*
-chmod 0644 /etc/systemd/system/aidecheck.*
-
+chown root:root /etc/systemd/system/{{{ aide_timer }}}
+chmod 0644 /etc/systemd/system/{{{ aide_timer }}}
+chown root:root /etc/systemd/system/{{{ aide_service }}}
+chmod 0644 /etc/systemd/system/{{{ aide_service }}}
+{{% endif %}}
 # enable the aide related services
 systemctl daemon-reload
-systemctl enable aidecheck.service
-systemctl enable aidecheck.timer
+
+systemctl unmask {{{ aide_service }}}
+systemctl enable {{{ aide_service }}}
+systemctl unmask {{{ aide_timer }}}
+systemctl enable {{{ aide_timer }}}
 
 if [[ $(systemctl is-system-running) != "offline" ]]; then
-  systemctl start aidecheck.timer
+  systemctl start {{{ aide_timer }}}
 fi

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/oval/shared.xml

@@ -1,29 +1,36 @@
+{{% if 'suse' in families %}}
+{{% set aide_service = 'aide.service' %}}
+{{% set aide_timer = 'aide.timer' %}}
+{{% else %}}
+{{% set aide_service = 'aidecheck.service' %}}
+{{% set aide_timer = 'aidecheck.timer' %}}
+{{% endif %}}
 <def-group>
   <definition class="compliance" id="{{{ rule_id }}}" version="3">
     {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.", rule_title=rule_title) }}}
     <criteria operator="AND">
       <extend_definition comment="Aide is installed" definition_ref="package_aide_installed"/>
       <criteria operator="AND">
         <criterion test_ref="tst_aidecheck-service_enabled"
-          comment="systemd aidecheck.service enabled"/>
+          comment="systemd {{{ aide_service }}} enabled"/>
         <criterion test_ref="tst_aidecheck-timer_enabled"
           comment="systemd aidecheck.timer enabled"/>
         <criterion test_ref="tst_aidecheck-timer_active"
-          comment="systemd aidecheck.timer active"/>
+          comment="systemd {{{ aide_timer }}} active"/>
       </criteria>
     </criteria>
   </definition>
 
   <linux:systemdunitproperty_object id="obj_aidecheck-service_unitfilestate" version="1">
-    <linux:unit>aidecheck.service</linux:unit>
+    <linux:unit>{{{ aide_service }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_unitfilestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>UnitFileState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_object id="obj_aidecheck-timer_activestate" version="1">
-    <linux:unit>aidecheck.timer</linux:unit>
+    <linux:unit>{{{ aide_timer }}}</linux:unit>
     <linux:property>ActiveState</linux:property>
   </linux:systemdunitproperty_object>
   <linux:systemdunitproperty_state id="ste_aide_is_enabled" version="1">
@@ -34,7 +41,7 @@
   </linux:systemdunitproperty_state>
 
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-service_enabled" version="1"
-    comment="systemd aidecheck.service enabled">
+    comment="systemd {{{ aide_service }}} enabled">
     <linux:object object_ref="obj_aidecheck-service_unitfilestate" />
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
@@ -44,7 +51,7 @@
     <linux:state state_ref="ste_aide_is_enabled" />
   </linux:systemdunitproperty_test>
   <linux:systemdunitproperty_test check="all" id="tst_aidecheck-timer_active" version="1"
-    comment="systemd aidecheck.timer active">
+    comment="systemd {{{ aide_timer }}} active">
     <linux:object object_ref="obj_aidecheck-timer_activestate" />
     <linux:state state_ref="ste_aide_is_active" />
   </linux:systemdunitproperty_test>

linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_checking_systemd_timer/rule.yml

@@ -40,7 +40,7 @@ references:
     srg: SRG-OS-000363-GPOS-00150,SRG-OS-000446-GPOS-00200,SRG-OS-000447-GPOS-00201
     stigid@ol7: OL07-00-020030
 
-platform: package[aide] and package[systemd]
+platform: machine and package[aide] and package[systemd]
 
 ocil_clause: 'AIDE is not configured to scan periodically'