security: Update on CIS benchmarks

[mayankfz]

Summary

security: Update on CIS benchmarks
Doc -> https://microsoftapc-my.sharepoint.com/:w:/g/personal/mayansingh_microsoft_com/IQBPQGV0CWHsTLuKSDKsTOGfASfMARMQJnRTFUxFPwuuA6I?e=dclE6g

Change Log

• security: Update on CIS benchmarks

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

https://dev.azure.com/mariner-org/ACL/_workitems/edit/19664

Test Methodology

• Test details:
  aks-e2e failures are same with/without my changes seems to be flaky behaviour.
  aks-e2e -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1161851&view=results
  aks-e2e (without changes) -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1162283&view=results
  acldevel -> https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1161789&view=results

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

Pull request overview

This PR updates the RPM-mode image hardening steps to better align with CIS benchmarks by tightening SSH configuration, blacklisting additional kernel modules, and improving log file permission hardening during image build.

Changes:

• Tighten permissions on generated sshd_config.d snippets and add a new CIS-focused SSH hardening drop-in (access limitation, forwarding disabled, MaxAuthTries).
• Extend CIS kernel module blacklisting to include sctp alongside cramfs.
• Add waagent service hardening (UMask drop-in) and a tmpfiles-based attempt to enforce /var/log/azure permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

build_library/rpm/build_image_util.sh:1397

• The tmpfiles directive type z does not create the path if it’s missing, so this won’t ensure /var/log/azure exists “at boot” (it only adjusts perms/label if already present). Add a d entry to create the directory, then keep z to restore SELinux context/permissions.

    sudo tee "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" > /dev/null <<'TMPFILES_LOG'
z /var/log/azure 0750 root root - -
TMPFILES_LOG

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

build_library/rpm/build_image_util.sh:1394

• The tmpfiles comment says it "ensures" /var/log/azure is 0750 at boot, but the z tmpfiles directive only applies to an existing path (it won’t create the directory if missing). Also, the referenced waagent drop-in umask is documented as 0137 here, but the waagent systemd drop-in being added sets UMask=0027. Please correct the comments to match the actual behavior/setting.

    # tmpfiles.d: ensure /var/log/azure dir is 0750 at boot (CIS 6.1.3.1).
    # File perms handled by waagent UMask=0137 drop-in.