Add sysctl persistence rules for Debian#14768
Conversation
Two new rules that address Debian-specific sysctl persistence issues: - sysctl_conf_symlink_etc_sysctl_d: ensure /etc/sysctl.d/99-sysctl.conf is a symlink pointing to /etc/sysctl.conf. Debian's systemd-sysctl processes /etc/sysctl.d/ at boot but does not read /etc/sysctl.conf directly unless this symlink exists. - sysctl_reapply_after_network: install a systemd oneshot service that re-applies sysctl settings after network interfaces come up. The Linux kernel resets certain network sysctl values (e.g. net.ipv4.conf.*.accept_redirects) when a NIC is brought up, which causes compliant values written at boot to be overwritten. The OVAL for sysctl_conf_symlink_etc_sysctl_d uses unix:file_test with type="symbolic link" rather than unix:symlink_test, which errors when the symlink is absent or dangling. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Hi @israel-villar. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| <definition class="compliance" id="{{{ rule_id }}}" version="1"> | ||
| {{{ oval_metadata("/etc/sysctl.d/99-sysctl.conf must be a symlink to /etc/sysctl.conf so that systemd-sysctl loads it at boot.", rule_title=rule_title) }}} | ||
| <criteria> | ||
| <criterion comment="/etc/sysctl.d/99-sysctl.conf is a symbolic link" |
There was a problem hiding this comment.
This OVAL only verifies that the file exists and is a symlink; but, it doesn't verify the target of the symlink. This isn't aligned with the rule description. We need to extend the OVAL so that it will also check if the target of the symlink is /etc/sysctl.conf.
| @@ -0,0 +1,40 @@ | |||
| documentation_complete: true | |||
|
|
|||
There was a problem hiding this comment.
FTBFS because the new added rules aren't part of any component. Each rule needs to be listed in at least 1 file in components directory.
| @@ -0,0 +1,40 @@ | |||
| documentation_complete: true | |||
|
|
|||
| title: 'Ensure /etc/sysctl.d/99-sysctl.conf Is a Symlink to /etc/sysctl.conf' | |||
There was a problem hiding this comment.
Please add test scenarios for the rules.
2 participants
Two new rules that address Debian-specific sysctl persistence issues:
sysctl_conf_symlink_etc_sysctl_d: ensure /etc/sysctl.d/99-sysctl.conf is a symlink pointing to /etc/sysctl.conf. Debian's systemd-sysctl processes /etc/sysctl.d/ at boot but does not read /etc/sysctl.conf directly unless this symlink exists.
sysctl_reapply_after_network: install a systemd oneshot service that re-applies sysctl settings after network interfaces come up. The Linux kernel resets certain network sysctl values (e.g. net.ipv4.conf.*.accept_redirects) when a NIC is brought up, which causes compliant values written at boot to be overwritten.
The OVAL for sysctl_conf_symlink_etc_sysctl_d uses unix:file_test with type="symbolic link" rather than unix:symlink_test, which errors when the symlink is absent or dangling.
Description:
sysctl_conf_symlink_etc_sysctl_d: ensure/etc/sysctl.d/99-sysctl.confis a symlink pointing to/etc/sysctl.conf. The bash remediation creates the symlink if absent.The OVAL check uses
unix:file_testwithtype="symbolic link".sysctl_reapply_after_network: install a systemd oneshot service thatre-applies
sysctl --systemafter network interfaces come up (vianetwork-online.target). The bash remediation writes the unit file andenables it. The OVAL check verifies the unit file exists and is enabled.
Rationale:
systemd-sysctlprocesses/etc/sysctl.d/at boot but doesnot read
/etc/sysctl.confdirectly unless the symlink/etc/sysctl.d/99-sysctl.conf -> /etc/sysctl.confexists.net.ipv4.conf.*.accept_redirects) when a NIC is brought up, whichcauses compliant values written at boot to be overwritten on Debian.
Review Hints:
sysctl_conf_symlink_etc_sysctl_dusesunix:file_testwith
type="symbolic link"rather thanunix:symlink_test.unix:symlink_testerrors when the symlink is absent or dangling;unix:file_testhandles non-existence gracefully../build_product debian13 --datastream-only