✨ freebsd: add time-synchronization and pkg signature-verification checks

[tas50]

What

Adds two new hardening checks to mondoo-freebsd-security, porting control patterns that landed for Linux and Nutanix in the last two weeks (time synchronization, package signature verification) but had no FreeBSD coverage (grep confirmed zero NTP/chrony and zero pkg-signature checks in the policy).

1. mondoo-freebsd-security-time-synchronization-is-enabled — impact 60

Asserts a time daemon is enabled and running:

service("ntpd").enabled && service("ntpd").running ||
service("openntpd").enabled && service("openntpd").running ||
service("chronyd").enabled && service("chronyd").running

FreeBSD ships ntpd in the base system but does not enable it by default. Clock sync underpins log/forensic correlation, Kerberos/cert validity, and audit-trail integrity. Anchored to mondoo-freebsd-security-firewall-is-enabled (impact 60).

2. mondoo-freebsd-security-pkg-signature-verification-is-enabled — impact 80

Asserts the base FreeBSD pkg repo enforces fingerprint signatures:

file("/etc/pkg/FreeBSD.conf").content.contains(/signature_type:\s*"fingerprints"/)

Downgrading signature_type to "none" disables verification, opening a supply-chain/MITM path to root-level code at install. Anchored down from aslr-is-enabled (impact 90) into the 80–89 band. The audit: step shows how to confirm the effective per-repo value via pkg -vv.

Compliance tags

Verified per-framework against the enterprise framework definitions — not copied from neighbors. Highlights:

• Time sync → ISO 27001:2022 a-8-17 (Clock synchronization), NIST 800-53 sc-45 (System Time Synchronization), NIST 800-171 3-3-7, PCI DSS 4 10.6.1, CSA CCM log-06, BSI sys-1-5-a7. false where no control fits (DORA, HIPAA, NIS2, CSF 1/2, SOC2, VDA-ISA).
• pkg signatures → NIST 800-53 cm-14 (Signed Components), ISO 27001:2022 a-8-19, NIST CSF1 pr-ds-6, CSF2 id-ra-09, NIST 800-171 3-4-8, NIS2 21-2-d (Supply chain). false where no control fits.

Notes

• OS policy → cli / sh / ansible remediation (no Terraform variants, consistent with siblings).
• Policy version bumped 1.0.4 → 1.1.0.
• cnspec policy lint content/mondoo-freebsd-security.mql.yaml → valid policy bundle. (The remediation CLI validator does not cover FreeBSD's sysrc/pkg.)

🤖 Generated with Claude Code

[mondoo-code-review]

Well-structured FreeBSD security checks for time synchronization and pkg signature verification; one MQL operator-precedence concern.

[github-actions]

Test Results

  1 files  ±0   44 suites  ±0   1m 34s ⏱️ -5s
854 tests ±0  853 ✅ ±0  1 💤 ±0  0 ❌ ±0 
855 runs  ±0  854 ✅ ±0  1 💤 ±0  0 ❌ ±0 

Results for commit c83446d. ± Comparison against base commit 5c0d2f3.

♻️ This comment has been updated with latest results.

[tas50]

Addressed both review points in the latest commit:

1. Operator precedence (time-sync): rather than add parentheses (MQL's && already binds tighter than ||, and the grouped form isn't the idiom here), I rewrote it to an unambiguous list form that removes the question entirely:

   ["ntpd", "openntpd", "chronyd"].any(service(_).enabled && service(_).running)
   

2. pkg custom repos: good catch — the check now also scans /usr/local/etc/pkg/repos/*.conf and fails if any custom repo sets signature_type: "none", so an unsigned custom repo can't slip past the base-repo check. Broadened the desc Scope note accordingly.

Superseded by new review

[mondoo-code-review]

Well-structured FreeBSD security checks for time synchronization and pkg signature verification, with one MQL query concern.

[tas50]

Addressed the two latest comments:

• /etc/pkg/FreeBSD.conf may not exist: added an .exists guard — file("/etc/pkg/FreeBSD.conf").exists && file(...).content.contains(...) — so a missing file on a minimal/custom install fails cleanly rather than erroring. (Matches the established idiom used in the Linux/macOS policies.)
• pubkey vs none intent: documented in desc. Both fingerprints (the official repo default) and pubkey are real verification mechanisms, so the custom-repo condition intentionally rejects only signature_type: "none". Also noted that an omitted signature_type defaults to no verification, so each custom repo should declare a type explicitly.

[mondoo-code-review]

Well-structured FreeBSD security checks; one MQL query has a logic concern worth verifying.

[tas50]

/review

[mondoo-code-review]

Well-structured FreeBSD security checks; one MQL query has a logic concern worth verifying.

[mondoo-code-review]

Well-structured FreeBSD security checks for time sync and pkg signature verification; one MQL query concern.

[mondoo-code-review]

Well-structured FreeBSD security checks; one MQL query has a logic issue worth addressing.

Superseded by new review

[mondoo-code-review]

Well-structured FreeBSD security checks; one MQL query has a logic concern worth verifying.

[mondoo-code-review]

Well-structured FreeBSD security checks for time sync and pkg signature verification; one MQL query concern.

[mondoo-code-review]

Well-structured FreeBSD security checks; one MQL query has a logic gap worth addressing.

[mondoo-code-review]

🔵 suggestion — Version bump from 1.0.4 → 1.1.0 is appropriate for new checks. No issue here, just noting it's correct.

[mondoo-code-review]

🟡 warning — The MQL query for pkg signature verification is two independent statements:

file("/etc/pkg/FreeBSD.conf").exists && file("/etc/pkg/FreeBSD.conf").content.contains(/signature_type:\s*"fingerprints"/)
files.find(from: "/usr/local/etc/pkg/repos", regex: "[.]conf$", type: "file").list.all(content.contains(/signature_type:\s*"none"/) == false)

The second statement (custom repos) is not joined to the first with &&, so depending on MQL evaluation semantics, these may be evaluated as two separate assertions rather than a single conjunctive check. If MQL treats bare top-level statements as implicit AND this is fine, but if it only reports the result of the last statement, the base-repo check is silently ignored.

Please confirm that two separate top-level statements in MQL are indeed conjunctive. If not, join them with && (you may need to wrap across lines).

[mondoo-code-review]

🟡 warning — The custom-repo check rejects signature_type: "none" but the docs note that an omitted signature_type also defaults to no verification. The current regex signature_type:\s*"none" won't catch a repo file that simply omits the directive entirely. Consider adding a positive check that every custom repo file does contain a signature_type declaration, e.g.:

files.find(...).list.all(
  content.contains(/signature_type:/) &&
  content.contains(/signature_type:\s*"none"/) == false
)

This aligns the check with the docs' own recommendation: "ensure every custom repo declares a verification type explicitly."