Skip to content

ROX-25981: use VEX for RPMs#12452

Merged
RTann merged 11 commits intomasterfrom
scanner-vex-init
Oct 5, 2024
Merged

ROX-25981: use VEX for RPMs#12452
RTann merged 11 commits intomasterfrom
scanner-vex-init

Conversation

@RTann
Copy link
Contributor

@RTann RTann commented Aug 19, 2024

Description

Claircore has replaced Red Hat OVAL data with VEX. This change ports that over and makes whatever related changes are required.

User-facing documentation

  • CHANGELOG is updated
  • documentation PR is not needed

Testing and quality

  • the change is production ready: the change is GA or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • modified existing tests

How I validated my change

For each installation, I used Helm for the fresh installs, and for any updates, I did oc edit on the affected deployments/config maps. Steps for installing StackRox is left as an exercise for the reader.

These tests were conducted Tuesday, September 17, 2024. This is important to note because Prod Sec made an update to VEX files on September 11 (https://access.redhat.com/articles/5554431). This took some time to propagate, and it was found that most, if not all, VEX files were changed due to this. So, the number of changes to the files after the compressed vulnerability file was created is rather massive. This is clear due to the fact it took around 40+ minutes to generate the vulnerability bundle.

CI

Some tests added/modified. Also, we can see we were able to build the new vulnerability data due to the pr-update-scanner-vulns label.

Fresh Install

Differences:

  • CVE-2024-33602 is rated Important on the catalog page, but it's actually Low, which is what Scanner V4 finds. The catalog says Important because the associated RHSA is Important
  • Same idea for CVE-2024-33600, but that's Moderate CVE, Important RHSA
  • Same idea for CVE-2024-0450
  • Same idea for CVE-2024-33601
  • Same idea for CVE-2022-48624
  • Same idea for CVE-2023-28322
  • Same idea for CVE-2023-38546
  • Scanner V4 found 49 fixable vulnerabilities while the container catalog found 38
    • Scanner V4 doesn't find CVE-2024-4317 nor CVE-2024-7348, which is not right...
    • Scanner V4 finds 12 fixable vulnerabilities associated with the image, itself, advanced-cluster-security/rhacs-scanner-v4-db-rhel8
    • The catalog doesn't find CVE-2023-47038, which Scanner V4 claims affects 37 perl-* components

So, the results match for the most part. Aside from the 3 vulnerability discrepancies (the ones affecting advanced-cluster-security/rhacs-scanner-v4-db-rhel8 look ok to me), the results look fine to me. If there is an issue, then it's due to how ClairCore handles the VEX/RHEL data, so I think it's ok to proceed (messaging interested parties offline, though).

Upgrade from 4.5.2

From inside Scanner V4 DB, you can see there are no more RHSAs (aside from the ones from the container-first updater):

# SELECT COUNT(DISTINCT name) FROM vuln WHERE name LIKE 'RH%A-%' AND updater != 'rhel-container-updater';
 count 
-------
     0
(1 row)

I didn't comb through every single vulnerability, but I scanned registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel8:4.4.0, and I found the same number of vulns (fixable and unfixable) and the same number of vulns with each severity, so I'm going to say they match

I also tested what happens when I defer an RHSA and a mark an RHSA as a false positive and then upgrade. It seems like nothing crashes, but now there are no referenced vulns anymore on the exception management page.

@RTann RTann added the pr-update-scanner-vulns Update Scanner's vulnerability data for this PR label Aug 19, 2024
@openshift-ci
Copy link

openshift-ci bot commented Aug 19, 2024

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@rhacs-bot
Copy link
Contributor

rhacs-bot commented Aug 19, 2024

Images are ready for the commit at 61310af.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.6.x-665-g61310afbfd.

@RTann RTann force-pushed the scanner-vex-init branch 4 times, most recently from 2f92d1b to 8376959 Compare August 19, 2024 23:30
@codecov
Copy link

codecov bot commented Aug 20, 2024

Codecov Report

Attention: Patch coverage is 14.28571% with 24 lines in your changes missing coverage. Please review.

Project coverage is 48.21%. Comparing base (248bb34) to head (61310af).
Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
scanner/datastore/postgres/distributions.go 0.00% 24 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #12452      +/-   ##
==========================================
- Coverage   48.23%   48.21%   -0.03%     
==========================================
  Files        2441     2441              
  Lines      175609   175659      +50     
==========================================
- Hits        84709    84693      -16     
- Misses      84077    84146      +69     
+ Partials     6823     6820       -3     
Flag Coverage Δ
go-unit-tests 48.21% <14.28%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@RTann RTann force-pushed the scanner-vex-init branch from 79fd823 to f8f8308 Compare August 21, 2024 17:55
@RTann RTann force-pushed the scanner-vex-init branch 2 times, most recently from 0da9b59 to f87eaa0 Compare August 22, 2024 17:26
@RTann RTann force-pushed the scanner-vex-init branch 3 times, most recently from 102c0c9 to aba8105 Compare August 27, 2024 21:38
@RTann RTann changed the title use VEX data for RHEL ROX-25981: use VEX for RPMs Aug 27, 2024
@RTann RTann force-pushed the scanner-vex-init branch 8 times, most recently from 57a4a25 to f6f54c7 Compare August 29, 2024 19:38
@RTann RTann force-pushed the scanner-vex-init branch 3 times, most recently from 898b93e to 1551f3f Compare September 6, 2024 17:52
Copy link
Contributor

@jvdm jvdm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is your plan regarding the vulnerability bundle version?

This will break 4.[45] now that we use v1 for everything from what I understand.

@RTann
Copy link
Contributor Author

RTann commented Sep 27, 2024

As far as I remember we won't need the container-name-repos-map.json and repository-to-cpe.json after vex updater is onboard, is that correct? If so, that means we can retire them when we retire rhel updater?

@daynewlee we'd still need both of them:

  • repository-to-cpe.json
    • The way we match against the VEX data still relies on the CPEs we get from this file. We just change the way we use the CPEs (instead of doing an exact match, always, we may do some sort of subset match)
  • container-name-repos-map.json
    • Not 100% certain how we will implement the RHCC stuff when using VEX data, but it's not currently implemented. At the moment, we only support using VEX data for RPMs at this time

@RTann
Copy link
Contributor Author

RTann commented Sep 27, 2024

What is your plan regarding the vulnerability bundle version?

This will break 4.[45] now that we use v1 for everything from what I understand.

@jvdm this is the case I brought up offline before, but I completely forgot about it until you mentioned it. I believe this will merit a bump to v2 because the way the CPE data is interpreted and used by the matcher is now different from before. I am actually curious if older Scanner V4s will handle getting VEX data, so I will test that before making a v2. Thanks for bringing it up!

Copy link
Contributor

@jvdm jvdm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to confirm: Is CSAF/VEX unaffected by that weird OpenShift 4.x CPE version matching expansion?

@RTann:

I am actually curious if older Scanner V4s will handle getting VEX data, so I will test that before making a v2. Thanks for bringing it up!

I think bumping the bundle version is the way to go here; I don't think the DB will support filtering updates for "disabled updaters", need to check though.

@RTann
Copy link
Contributor Author

RTann commented Sep 30, 2024

Just to confirm: Is CSAF/VEX unaffected by that weird OpenShift 4.x CPE version matching expansion?

@RTann:

I am actually curious if older Scanner V4s will handle getting VEX data, so I will test that before making a v2. Thanks for bringing it up!

I think bumping the bundle version is the way to go here; I don't think the DB will support filtering updates for "disabled updaters", need to check though.

@jvdm I spent some time thinking about it, and I probably could just test it to be absolutely sure, but I think it may be best to be safe, and I'll make a v2

@RTann RTann force-pushed the scanner-vex-init branch 2 times, most recently from 652847b to 0c62e00 Compare September 30, 2024 21:49
@RTann RTann requested a review from jvdm September 30, 2024 21:58
@RTann RTann force-pushed the scanner-vex-init branch from f8dc642 to 448b56a Compare October 2, 2024 21:23
Copy link
Contributor

@jvdm jvdm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One question/clarification on the changelog entry, otherwise all good.

From testing instructions @RTann:

Install StackRox 4.5.2. I used an SSD for the Scanner V4 DB PVC to speed up DB initialization
The vulnerability URL is pointing to dev

Curious: The old RHEL updater data, does it get cleaned-up by the garbage collector? Since the updater was disabled, I was wondering...

@RTann
Copy link
Contributor Author

RTann commented Oct 2, 2024

One question/clarification on the changelog entry, otherwise all good.

From testing instructions @RTann:

Install StackRox 4.5.2. I used an SSD for the Scanner V4 DB PVC to speed up DB initialization
The vulnerability URL is pointing to dev

Curious: The old RHEL updater data, does it get cleaned-up by the garbage collector? Since the updater was disabled, I was wondering...

@jvdm Claircore added a migration to remove all the OVAL data: https://github.com/quay/claircore/blob/v1.5.31/datastore/postgres/migrations/matcher/13-delete-rhel-oval.sql. We also clean up references to the old updater timestamp in last_vuln_update once the latest versions of the vulnerabilities are added

@RTann RTann enabled auto-merge (squash) October 2, 2024 23:03
@RTann RTann force-pushed the scanner-vex-init branch from 9b89a13 to 29278a7 Compare October 4, 2024 21:53
@RTann RTann force-pushed the scanner-vex-init branch from 8251514 to 61310af Compare October 4, 2024 23:22
@openshift-ci
Copy link

openshift-ci bot commented Oct 5, 2024

@RTann: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ocp-4-12-scanner-v4-tests 9b89a13 link false /test ocp-4-12-scanner-v4-tests
ci/prow/gke-sensor-integration-tests 61310af link false /test gke-sensor-integration-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@RTann RTann merged commit 1c6af3e into master Oct 5, 2024
@RTann RTann deleted the scanner-vex-init branch October 5, 2024 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci area/helm area/scanner pr-update-scanner-vulns Update Scanner's vulnerability data for this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants