Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disables OSSEC email for fwupd #5882

Merged
merged 2 commits into from
Apr 7, 2021
Merged

Disables OSSEC email for fwupd #5882

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d289c1a
Fixes #5835 disables ossec mails for fwupd
kushaldas Mar 29, 2021
19ade45
Adds ossec-logtest testinfra test for fwupd rules
emkll Apr 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions install_files/securedrop-ossec-server/var/ossec/etc/local_decoder.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,10 @@
<decoder name="dhclient">
<program_name>dhclient</program_name>
</decoder>

<!--
The default fwupd tries to auto-update and generates error.
-->
<decoder name="fwupd">
<program_name>fwupd</program_name>
</decoder>
19 changes: 19 additions & 0 deletions install_files/securedrop-ossec-server/var/ossec/rules/local_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,25 @@
</rule>
</group>

<!--
fwupd auto-updates realted rules.
-->

<group name="fwupd">
<rule id="100111" level="0">
<decoded_as>fwupd</decoded_as>
<match>Error opening directory</match>
<description>fwupd error</description>
<options>no_email_alert</options>
</rule>
<rule id="100112" level="0">
<decoded_as>fwupd</decoded_as>
<match>Failed to load SMBIOS</match>
<description>fwupd error for auto updates</description>
<options>no_email_alert</options>
</rule>
</group>

<!--
Do not alert on stagging VM dhcp client errors. These events should not occur
in production environments
Expand Down
14 changes: 14 additions & 0 deletions molecule/testinfra/vars/staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,20 @@ log_events_without_ossec_alerts:
jp&B1qSJM431TmEg,YJ][ge;6-dJI69?-TB?!BI4?Uza63V3vMY3ake6a
hj-%A-m_5lgab!OVR,!pR+;L]eLgilU

# Override and suppress fwupd-specific errors under Ubuntu Focal
- name: test_ossec_fwupd_fuplugin_uefi_does_not_produce_alert
alert: >
Mar 1 13:22:53 app fwupd[133921]: 13:22:53:0883 FuPluginUefi
Error opening directory “/sys/firmware/efi/esrt/entries�: No such file or directory
level: "0"
rule_id: "100111"

- name: test_ossec_fwupd_fuengine_does_not_produce_alert
alert: >
Mar 1 13:22:53 mon fwupd[133921]: 13:22:53:0576 FuEngine
Failed to load SMBIOS: invalid DMI data size, got 2527 bytes, expected 2745
level: "0"
rule_id: "100112"

# Log events we expect an OSSEC alert to occur for
log_events_with_ossec_alerts:
Expand Down