nist_800_53: fix sync script variable lookup and complete CIS→NIST mappings#14785
nist_800_53: fix sync script variable lookup and complete CIS→NIST mappings#14785ggbecker wants to merge 1 commit into
Conversation
| - var_auditd_disk_full_action=cis_rhel10 | ||
| - var_auditd_disk_error_action=cis_rhel10 |
| rules: | ||
| - auditd_data_retention_max_log_file | ||
| - auditd_data_retention_max_log_file_action | ||
| - var_auditd_max_log_file=8 |
| - var_auditd_admin_space_left_action=cis_rhel8 | ||
| - var_auditd_admin_space_left_action=cis_rhel8 |
There was a problem hiding this comment.
some items are added twice
| - var_auditd_max_log_file=8 | ||
| - var_auditd_max_log_file=8 |
There was a problem hiding this comment.
it seems that there will be more problems with duplication
…ppings Fix two bugs in sync_nist_split.py that caused mapped variables to land in other.yml instead of their NIST family files, and add 42 missing CIS→NIST rule/variable mappings so all reference files are fully populated with no other.yml remaining.
ggbecker
force-pushed
the
investigate-nist-sync-issue
branch
from
4f4c0bd to
fab8d57
Compare
|
@jan-cerny Hopefully there are no more duplicates in the variables space, even though you might still see rules that are selected across different NIST controls, but I think that is intentional since a rule can implement different controls at the same time. I think for the future, moving the variables out from the inline controls selection might help in isolating the variables to make it easier for users to modify the values. Then mention where a variable might affect a control, whenever that control selects a rule that can be customized by a variable. |
|
@ggbecker: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Description:
Rationale:
Prevents PRs such as 🔄 NIST 800-53 CIS Reference Update (2026-05-31) #14748 and 🔄 NIST 800-53 CIS Reference Update (2026-06-07) #14784 from spawning without actual changes to the CIS profiles.
There shouldn't be any substantial change to the profiles itself, it's only a matter of updating the reference files.