RAN Hardening (m5-audit-modules): compliance remediation for OCP 4.22

Author: sebrandon1

telco-ran/configuration/kube-compare-reference/informational/hardening/75-audit-kernel-modules-master.yaml

@@ -0,0 +1,23 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+metadata:
+  name: 75-audit-kernel-modules-master
+  labels:
+    machineconfiguration.openshift.io/role: master
+spec:
+  config:
+    ignition:
+      version: 3.5.0
+    storage:
+      files:
+      - path: /etc/audit/rules.d/75-kernel-modules.rules
+        mode: 420
+        overwrite: true
+        contents:
+          # # Module loading
+          # -a always,exit -F arch=b64 -S init_module -S finit_module -k module_load
+          # -a always,exit -F arch=b32 -S init_module -S finit_module -k module_load
+          # # Module unloading
+          # -a always,exit -F arch=b64 -S delete_module -k module_unload
+          # -a always,exit -F arch=b32 -S delete_module -k module_unload
+          source: data:text/plain,%23%20M5%3A%20Audit%20Kernel%20Module%20Loading%20%28E8%20Compliance%29%0A%23%20Documentation%3A%20https%3A%2F%2Fsebrandon1.github.io%2Fcompliance-scripts%2Fversions%2F4.21%2Fgroups%2FM5.html%0A%0A%23%20Module%20loading%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-S%20finit_module%20-k%20module_load%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-S%20finit_module%20-k%20module_load%0A%0A%23%20Module%20unloading%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module_unload%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module_unload%0A

telco-ran/configuration/kube-compare-reference/informational/hardening/75-audit-kernel-modules-worker.yaml

@@ -0,0 +1,23 @@
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+metadata:
+  name: 75-audit-kernel-modules-worker
+  labels:
+    machineconfiguration.openshift.io/role: worker
+spec:
+  config:
+    ignition:
+      version: 3.5.0
+    storage:
+      files:
+      - path: /etc/audit/rules.d/75-kernel-modules.rules
+        mode: 420
+        overwrite: true
+        contents:
+          # # Module loading
+          # -a always,exit -F arch=b64 -S init_module -S finit_module -k module_load
+          # -a always,exit -F arch=b32 -S init_module -S finit_module -k module_load
+          # # Module unloading
+          # -a always,exit -F arch=b64 -S delete_module -k module_unload
+          # -a always,exit -F arch=b32 -S delete_module -k module_unload
+          source: data:text/plain,%23%20M5%3A%20Audit%20Kernel%20Module%20Loading%20%28E8%20Compliance%29%0A%23%20Documentation%3A%20https%3A%2F%2Fsebrandon1.github.io%2Fcompliance-scripts%2Fversions%2F4.21%2Fgroups%2FM5.html%0A%0A%23%20Module%20loading%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-S%20finit_module%20-k%20module_load%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-S%20finit_module%20-k%20module_load%0A%0A%23%20Module%20unloading%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module_unload%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module_unload%0A