CMP-4609: Fix file_permissions_scheduler rule to check for 0600 per CIS Benchmark

[taimurhafeez]

Problem

The rule file_permissions_scheduler (CIS Benchmark control 1.1.5) checks the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml on master nodes.

The rule was configured with filemode: 0644, but the CIS Benchmark requires 0600. On OCP clusters, these files already ship with the correct 0600 permissions (-rw-------).

This caused two issues:

1. Misleading remediation guidance: The rule description told users to run chmod 0644, which would weaken the existing 0600 permissions by adding group-read and other-read access.
2. Incorrect OVAL check: The OVAL state only checked for bits more permissive than 0644 (suid, sgid, sticky, uexec, gwrite, gexec, owrite, oexec). It did not flag gread or oread as violations, meaning a file with 0644 would incorrectly pass when it should fail per CIS requirements.

Fix

Changed the filemode template parameter from 0644 to 0600 in applications/openshift/master/file_permissions_scheduler/rule.yml.

This produces four changes in the generated content:

• Description: chmod 0644 → chmod 0600
• Instructions: -rw-r--r-- → -rw-------
• OVAL state: Adds gread and oread to the list of prohibited permission bits (matching the existing pattern used by 10 other rules like etcd_data_files, master_admin_kubeconfigs, openshift_pki_key_files)
• OVAL state ID: mode_not_0644 → mode_not_0600

How to Reproduce / Verify

Reproduce the bug (before the fix)

1. Install the compliance operator on an OCP 4.x cluster
2. Run a CIS-node scan: oc get rules.compliance -n openshift-compliance ocp4-file-permissions-scheduler -o yaml
3. Observe the description says chmod 0644 and instructions say -rw-r--r--
4. Check actual permissions on a master node:

   oc debug node/<master> -- chroot /host bash -c \
     'stat -c "%a %n" /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml'

5. Actual permissions are 600 (-rw-------), not 644

Verify the fix

1. Build the content with this fix: ./build_product ocp4 --datastream
2. Build a content image: podman build -f Dockerfiles/compliance_operator_content.Dockerfile -t <registry>/content:fix .
3. Push and patch the ProfileBundle: oc patch profilebundle ocp4 -n openshift-compliance --type merge -p '{"spec":{"contentImage":"<registry>/content:fix"}}'
4. Check the rule description now says chmod 0600 and -rw-------
5. Run a targeted scan — result should be PASS since actual files have 0600

Verified on

• OCP 4.22.0 nightly (2026-08-11) cluster with 3 master nodes
• All scheduler pod spec files confirmed at 0600
• Scan result: PASS with the fixed content

[openshift-ci]

Hi @taimurhafeez. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[taimurhafeez]

/ok-to-test

[openshift-ci]

@taimurhafeez: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_scheduler'.
--- xccdf_org.ssgproject.content_rule_file_permissions_scheduler
+++ xccdf_org.ssgproject.content_rule_file_permissions_scheduler
@@ -6,7 +6,7 @@
 
 [description]:
 To properly set the permissions of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command:
-$ sudo chmod 0644 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml
+$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml
 
 [warning]:
 This rule is only applicable for nodes that run the Kubernetes Scheduler service.

OCIL for rule 'xccdf_org.ssgproject.content_rule_file_permissions_scheduler' differs.
--- ocil:ssg-file_permissions_scheduler_ocil:questionnaire:1
+++ ocil:ssg-file_permissions_scheduler_ocil:questionnaire:1
@@ -12,6 +12,6 @@
 Then,run the command:
 $ ls -l /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml
 If properly configured, the output should indicate the following permissions:
--rw-r--r--
-      Is it the case that /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml does not have unix mode -rw-r--r--?
+-rw-------
+      Is it the case that /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml does not have unix mode -rw-------?
       

[yuumasato]

/ok-to-test

[yuumasato]

/ok-to-test

[taimurhafeez]

/test e2e-aws-openshift-platform-compliance

[openshift-ci]

@taimurhafeez: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	0e55c0d	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	0e55c0d	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.