Wupeka/aoc kmod and logfile fixes - #1296
Open
Witold Krecicki (wupeka) wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates ComplianceEngine procedures to (1) treat daemon/service-owned log files as acceptable under the default logfile rule (ownership not enforced when the owner is a daemon account) and (2) require kernel-module “masking” only when the module is available in the running kernel (deny-listing alone otherwise), aligning checks with CIS guidance.
Changes:
- Logfile permissions: add daemon/service-account detection (via
/etc/shells+/etc/passwd) and relax default ownership checks for daemon-owned files during audit. - Kernel modules: determine whether a module exists in
/lib/modules/$(uname -r)/kerneland conditionally require theinstall <module> /bin/(true|false)mask line. - Tests: expand unit tests to cover daemon-owned logfile behavior and non-running-kernel module behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/modules/complianceengine/tests/procedures/LogFilePermissionsTest.cpp | Adds test users and new audit test cases for daemon-owned vs interactive-user-owned log files. |
| src/modules/complianceengine/tests/procedures/KernelModuleTest.cpp | Extends the fake modules tree helper to model the running kernel and adds a test for “module only in non-running kernel”. |
| src/modules/complianceengine/src/lib/procedures/LogFilePermissions.cpp | Implements daemon UID detection and relaxes default logfile ownership checks for daemon-owned files. |
| src/modules/complianceengine/src/lib/procedures/KernelModule.cpp | Uses running-kernel availability to decide whether masking must be required. |
| src/modules/complianceengine/src/lib/KernelModuleTools.h | Adds the running-kernel availability API and changes the IsKernelModuleBlocked signature. |
| src/modules/complianceengine/src/lib/KernelModuleTools.cpp | Implements running-kernel module availability scanning and conditional masking enforcement. |
Comment on lines
14
to
18
| Result<bool> SearchFilesystemForModuleName(std::string& moduleName, ContextInterface& context); | ||
| Result<bool> IsKernelModuleLoaded(std::string moduleName, ContextInterface& context); | ||
| Result<Status> IsKernelModuleBlocked(std::string moduleName, IndicatorsTree& indicators, ContextInterface& context); | ||
| Result<bool> IsModuleAvailableInRunningKernel(const std::string& moduleName, ContextInterface& context); | ||
| Result<Status> IsKernelModuleBlocked(std::string moduleName, bool requireMask, IndicatorsTree& indicators, ContextInterface& context); | ||
|
|
Comment on lines
+179
to
+186
| char* paths[] = {const_cast<char*>(kernelDirPath.c_str()), nullptr}; | ||
| FTS* fts = fts_open(paths, FTS_PHYSICAL, nullptr); | ||
| if (!fts) | ||
| { | ||
| OsConfigLogError(context.GetLogHandle(), "Failed to open %s - errno %d", kernelDirPath.c_str(), errno); | ||
| OSConfigTelemetryStatusTrace("fts_open", errno); | ||
| return false; | ||
| } |
Comment on lines
+210
to
213
| } | ||
|
|
||
| Result<Status> IsKernelModuleBlocked(std::string moduleName, bool requireMask, IndicatorsTree& indicators, ContextInterface& context) | ||
| { |
Comment on lines
+62
to
+68
| auto validShells = ListValidShells(context); | ||
| if (!validShells.HasValue()) | ||
| { | ||
| OsConfigLogError(context.GetLogHandle(), "Failed to list valid shells: %s", validShells.Error().message.c_str()); | ||
| OSConfigTelemetryStatusTrace("ListValidShells", validShells.Error().code); | ||
| return validShells.Error(); | ||
| } |
Witold Krecicki (wupeka)
force-pushed
the
wupeka/aoc-kmod-and-logfile-fixes
branch
from
July 31, 2026 14:43
1fc5fe5 to
4558751
Compare
(cherry picked from commit b603647ddc2fca9cf9a3777be8cda26620cdd2a1)
(cherry picked from commit d1c76b8f9058957675544c05819378b5fd170c8a)
Witold Krecicki (wupeka)
force-pushed
the
wupeka/aoc-kmod-and-logfile-fixes
branch
from
August 3, 2026 08:48
4558751 to
00d8f57
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Allow daemon-owned logfiles
Require blocklist only for kernel modules that exist in running kernel
Checklist
devbranch prior to this PR submission.devbranch.