Security & Compliance Checks
Relevant source files
The following files were used as context for generating this wiki page:
Security & Compliance Checks provide a framework for enforcing organizational standards and security policies across managed resources such as Virtual Machines (VMs), Hosts, and Container Images. The system allows for both proactive monitoring and reactive enforcement by evaluating resource states against defined policy sets.
The module integrates with the core policy engine to perform checks and record historical results, ensuring that infrastructure remains within defined operational boundaries. It supports asynchronous execution via the MiqQueue to handle large-scale environments efficiently.
Sources: app/models/compliance.rb:1-5, spec/models/compliance_spec.rb:4-13, README.md
Core Compliance Architecture
The compliance system is built around the Compliance model, which acts as a historical record for compliance checks performed on various resource types. It utilizes a polymorphic association to link results to different entities.
Data Model and Relationships
The system tracks overall compliance status and granular policy details through a parent-child relationship between the Compliance and ComplianceDetail models.
The Compliance record stores the high-level result, while ComplianceDetail captures the specific policies and conditions that were evaluated during the check.
Sources: app/models/compliance.rb:1-4, app/models/compliance.rb:83-99
Component Summary
| Component | Description |
|---|---|
Compliance | Main model representing a single compliance check execution and result. |
ComplianceDetail | Sub-component storing individual policy and condition evaluation results. |
ComplianceMixin | Included in resource models (Host, Vm) to provide compliance-related instance methods. |
MiqPolicy | The engine used to enforce and evaluate defined compliance policies. |
MiqEvent | Used to raise system-wide events based on check results (e.g., vm_compliance_passed). |
Sources: app/models/compliance.rb:1-10, app/models/host.rb:194, spec/support/examples_group/shared_examples_for_compliance_mixin.rb:1-26
Compliance Check Workflows
Compliance checks can be triggered manually or automatically. The system provides two primary entry points: standard compliance checks and "Scan and Check" workflows.
Standard Compliance Check Flow
A standard check initiates a policy enforcement event for the target resource.
If no compliance policies are assigned to the resource, the system logs the absence of scope and exits without creating a record.
Sources: app/models/compliance.rb:6-14, app/models/compliance.rb:49-78
Scan and Check Workflow
Specifically for Host resources, the system supports a combined scan and check operation. This ensures that the compliance evaluation is performed against the most recent data by triggering a SmartState Analysis (scan) before the compliance check.
| Workflow Step | Action |
|---|---|
| Queue | The request is placed in the MiqQueue with the ems_inventory role and vc-refresher task ID to avoid refresh clashes. |
| Scan | Triggers MiqEvent.raise_evm_job_event with type scan. |
| Execution | Calls target.scan_from_queue to update resource metadata. |
| Check | Immediately follows the scan with a call to Compliance.check_compliance. |
Sources: app/models/compliance.rb:16-47, app/models/host.rb:584-604
Policy Enforcement Logic
The compliance engine relies on MiqPolicy.enforce_policy to determine the state of a resource. Policies are grouped into modes, where the compliance mode specifically dictates how objects are evaluated.
Execution Sequence
- Event Generation: A resource-specific event name is generated (e.g.,
vm_compliance_checkorhost_compliance_check). - Policy Evaluation: The policy engine evaluates all active policies in scope for that event.
- Result Aggregation:
- If any action keyed as
:compliance_failedexists in the results, the overall status is set tofalse. - Individual condition results are mapped to
ComplianceDetailrecords.
- If any action keyed as
- Event Notification: The system raises asynchronous events such as
{target}_compliance_passedor{target}_compliance_failed.
Sources: app/models/compliance.rb:61-78, spec/models/miq_policy_spec.rb:179-198
Condition Evaluation
Conditions are evaluated using expressions. For example, a policy might check if a VM has a specific number of CPUs or is in a retired state.
Host-Specific Security Features
Hosts possess additional security and diagnostic capabilities that feed into compliance and security monitoring, including SmartState Analysis and management of system services.
Host Scanning and Metadata
Hosts support comprehensive scanning via SSH or IPMI to retrieve:
- System Services: Status of services (e.g., via
systemctlorchkconfig). - Patches: Highest patch levels and installed updates (e.g.,
esxupdate query). - Users/Groups: Local account information retrieved from the OS.
- Firewall Rules: Enabled inbound and outbound ports.
Sources: app/models/host.rb:636-680, app/models/host.rb:732-750
Security Configuration Management
The system includes specialized tools for configuring secure external authentication on the appliance itself, such as Apache and SSSD/LDAP integration.
- Apache Configuration: Manages
httpd-authand external authentication modules (e.g., GSSAPI/Kerberos). - SSSD Configuration: Handles LDAP search bases, URIs, and user attributes for identity management.
Sources: spec/tools/miq_config_sssd_ldap/configure_apache_spec.rb:71-85, spec/tools/miq_config_sssd_ldap/sssd_conf_spec.rb:90-110
Summary
The Security & Compliance module ensures that managed infrastructure adheres to predefined policies through a structured workflow of scanning, policy enforcement, and historical reporting. By utilizing a queued architecture and integrating directly with the SmartState Analysis framework, the system provides a robust mechanism for maintaining visibility and control over resource integrity. Key components include the Compliance recording engine, the MiqPolicy evaluator, and resource-specific metadata collectors like Host SSH/IPMI scanners.