1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
<def-group>
<definition class="inventory" id="bootc" version="1">
{{{ oval_metadata("Bootable container or bootc system", affected_platforms=["multi_platform_all"], rule_title=rule_title) }}}
<criteria operator="AND">
<criterion comment="kernel is installed" test_ref="bootc_platform_test_kernel_installed" />
<criterion comment="rpm-ostree is installed" test_ref="bootc_platform_test_rpm_ostree_installed" />
<criterion comment="bootc is installed" test_ref="bootc_platform_test_bootc_installed" />
<criteria operator="OR">
<criterion comment="/run/ostree-booted exists, suggesting that we are in a running bootc environment" test_ref="bootc_platform_test_run_ostree_booted_exists" />
<criterion comment="/ostree symlink exists, suggesting that we are in a bootc environment being built and hardened" test_ref="bootc_platform_test_ostree_symlink_exists" />
</criteria>
<criterion comment="openshift-kubelet is not installed" test_ref="bootc_platform_test_openshift_kubelet_removed" />
</criteria>
</definition>
{{% if product == "fedora" or "rhel" in product %}}
{{% set kernel_package = "kernel-core" %}}
{{% else %}}
{{% set kernel_package = "kernel" %}}
{{% endif %}}
{{{ oval_test_package_installed(package=kernel_package, test_id="bootc_platform_test_kernel_installed") }}}
{{{ oval_test_package_installed(package="rpm-ostree", test_id="bootc_platform_test_rpm_ostree_installed") }}}
{{{ oval_test_package_installed(package="bootc", test_id="bootc_platform_test_bootc_installed") }}}
{{{ oval_test_package_removed(package="openshift-kubelet", test_id="bootc_platform_test_openshift_kubelet_removed") }}}
<unix:file_test id="bootc_platform_test_run_ostree_booted_exists" check="all" check_existence="all_exist" comment="The file /run/ostree-booted exists" version="1">
<unix:object object_ref="bootc_platform_obj_run_ostree_booted_exists" />
</unix:file_test>
<unix:file_object id="bootc_platform_obj_run_ostree_booted_exists" comment="The file /run/ostree-booted exists" version="1">
<unix:filepath operation="equals">/run/ostree-booted</unix:filepath>
</unix:file_object>
<unix:file_test id="bootc_platform_test_ostree_symlink_exists" check="all" check_existence="all_exist" comment="The file /ostree is a symlink" version="1">
<unix:object object_ref="bootc_platform_obj_ostree_symlink_exists" />
<unix:state state_ref="bootc_platform_ste_ostree_symlink_exists" />
</unix:file_test>
<unix:file_object id="bootc_platform_obj_ostree_symlink_exists" comment="The file /ostree exists" version="1">
<unix:filepath operation="equals">/ostree</unix:filepath>
</unix:file_object>
<unix:file_state id="bootc_platform_ste_ostree_symlink_exists" comment="The file /ostree is a symlink" version="1">
<unix:filepath operation="equals">/ostree</unix:filepath>
<unix:type operation="equals">symbolic link</unix:type>
</unix:file_state>
</def-group>
|
