kernel_parameter logic

[aclarkee]

Hey - thanks for all your work on this module. Been very helpful getting us across the line for CIS hardening.
Wondering if you're interested in a pull request & discussion around how your module handles kernel parameters.

Currently, some assumptions are made on whether kernel parameters should live in GRUB_CMDLINE_LINUX or GRUB_CMDLINE_LINUX_DEFAULT & no checks are done on whether each parameter is already set in an alternative boot mode.

This leads to a couple of potential complications

1. Duplicate kernel parameters if already set in an alternate bootmode (potentially with conflicting values)
2. No ability to override which bootmode a kernel parameter is set for

I propose changing the logic to

1. Check if a parameter exists in alternative bootmodes, do not add in if it does.
2. Change bootmode to a variable, with the current values configured as default, allowing you to override.

Happy to supply a pull request, or discuss further- if you're interested in changing this logic.

[bjvrielink]

This Puppet module uses herculesteam's augeasproviders_grub module for the kernel_parameter resource to do the heavy lifting. Complication 1 should/could be fixed in that module, so that this module can also benefit from it.

Complication 2 is beyond the scope of the secure_linux_cis module, as the CIS benchmarks it implements already specify which of the 2 GRUB variables should be used for which settings. Adding the parameter to the other GRUB CMDLINE variable would make no sense if complying to the CIS benchmark is your goal.

[aclarkee]

Thanks for your reply @bjvrielink

In that case, there's some inconsistencies in the RHEL 7 & 8 CIS benchmarks & bootmodes this module enforces. For example

This module adds ipv6.disable=1 & audit_backlog_limit=8192 to GRUB_CMDLINE_LINUX_DEFAULT while the CIS controls for both RHEL 7 & 8 specify GRUB_CMDLINE_LINUX to be used for these variables. There may be other inconsistencies, I can take a look over the weekend.

How would you like to proceed?

[bjvrielink]

I agree with you that these 2 (and maybe others, I did not check all cases where kernel_parameter is used) do use the wrong GRUB_CMDLINE_*, as all Linux CIS benchmarks specify GRUB_CMDLINE_LINUX, not just RHEL 7 & 8 for these specific parameters.

I think a pull request that uses the correct kernel_parameter bootmode (either 'all' (or absent) for GRUB_CMDLINE_LINUX or 'normal' for GRUB_CMDLINE_LINUX_DEFAULT) is the way to go.
Of course, this would lead to duplicate entries for systems that already use this Puppet module, unless complication 1 is fixed by the Herculesteam.