From d77eab2234cc72d8b8a8e6cde10e5517311f467d Mon Sep 17 00:00:00 2001
From: Simarpreet Singh <simar@linux.com>
Date: Fri, 18 Oct 2019 13:23:23 -0700
Subject: [PATCH] master.yaml: Add --audit-policy-file check for 1.1.37. (#440)

* master.yaml: Add --audit-policy-file check for 1.1.37.

Signed-off-by: Simarpreet Singh <simar@linux.com>

* fix-177: fix line endings

Signed-off-by: Simarpreet Singh <simar@linux.com>
---
 cfg/1.11/master.yaml | 19 ++++++++++++++++++-
 cfg/1.13/master.yaml | 19 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/cfg/1.11/master.yaml b/cfg/1.11/master.yaml
index b592295..02ebd47 100644
--- a/cfg/1.11/master.yaml
+++ b/cfg/1.11/master.yaml
@@ -613,7 +613,7 @@ groups:
       --admission-control-config-file=<path/to/configuration/file>
     scored: true
 
-  - id: 1.1.37
+  - id: 1.1.37a
     text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
     tests:
@@ -633,6 +633,23 @@ groups:
       --audit-policy-file=/etc/kubernetes/audit-policy.yaml
     scored: true
 
+  - id: 1.1.37b
+    text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-policy-file"
+        compare:
+          op: eq
+          value: "/etc/kubernetes/audit-policy.yaml"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set the desired audit policy in the
+      /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
+      and set the below parameters.
+      --audit-policy-file=/etc/kubernetes/audit-policy.yaml
+    scored: true
+
   - id: 1.1.38
     text: "Ensure that the --request-timeout argument is set as appropriate (Scored)"
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
diff --git a/cfg/1.13/master.yaml b/cfg/1.13/master.yaml
index 3402aa8..57fc20d 100644
--- a/cfg/1.13/master.yaml
+++ b/cfg/1.13/master.yaml
@@ -618,7 +618,7 @@ groups:
       --admission-control-config-file=<path/to/configuration/file>
     scored: true
 
-  - id: 1.1.37
+  - id: 1.1.37a
     text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
     tests:
@@ -638,6 +638,23 @@ groups:
       --audit-policy-file=/etc/kubernetes/audit-policy.yaml
     scored: true
 
+  - id: 1.1.37b
+    text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-policy-file"
+        compare:
+          op: eq
+          value: "/etc/kubernetes/audit-policy.yaml"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set the desired audit policy in the
+      /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
+      and set the below parameters.
+      --audit-policy-file=/etc/kubernetes/audit-policy.yaml
+    scored: true
+
   - id: 1.1.38
     text: "Ensure that the --request-timeout argument is set as appropriate (Scored)"
     audit: "ps -ef | grep $apiserverbin | grep -v grep"