Create OVAL macro to consistently identify Interactive Users #10215

marcusburghardt · 2023-02-16T08:39:35Z

Description:

Currently, there are 14 rules checking for requirements related to "interactive users":

accounts_umask_interactive_users
accounts_user_dot_user_ownership
accounts_user_dot_group_ownership
accounts_user_dot_no_world_writable_programs
accounts_user_interactive_home_directory_defined
accounts_user_interactive_home_directory_exists
accounts_users_home_files_groupownership
accounts_users_home_files_ownership
accounts_users_home_files_permissions
file_groupownership_home_directories
file_ownership_home_directories
file_permissions_home_directories
file_permissions_home_dirs
no_forward_files

For all these rules, the approach to identify interactive users is exactly the same.
However, each rule had its own OVAL check.

Besides the code duplication, during the review of these rules it was also noticed other minor issues:

Some rules consider the nobody user while others not.
Some rules ignore users based on a user list while other not.
Some rules were filtering interactive users by their gids while the uids should be used instead.
Some rules were using hard-coded uids or gids instead of products variables.

These issues prove how difficult is to keep consistency among these rules.
The maintenance is also expensive considering 14 rules.

Recently, after some discussions in CIS Community, after checking related requirements in existing benchmarks, like STIG and CIS, and also after offline conversations with experts, it was agreed that users configured with /sbin/nologin shell should also be ignored in the "Interactive Users" list.

This change inevitably would demand OVAL update in the 14 mentioned rules.
It was a great opportunity to improve the consistency of these rules, reduce maintenance cost and make it easier to introduce new similar rules.

So, in this PR I have created a OVAL macro to properly and consistently identify "Interactive Users" and provide a OVAL object to be used in the rules. Once the macro was created, the OVAL for these all 14 rules was updated to use the new macro and a new test scenario was included to cover the case of non-system accounts that has /sbin/nologin shell.

The minor issues mentioned before were also fixed.

Rationale:

Maintenance cost reduced
Stronger consistency
Simplification

Review Hints:

Although I identified improvement opportunities also in remediation, I decided to limit the scope of this PR to OVAL updates and minor fixes in remediation. It makes the PR easier to review and test since the changes are more controlled.

For review, check commit by commit in the order they are presented.
For test, I would recommend to use a loop for testing these 14 rules using automatus. Here is a simple example that can be used as reference:

for rule in accounts_umask_interactive_users accounts_user_dot_group_ownership accounts_user_dot_user_ownership accounts_user_dot_no_world_writable_programs accounts_user_interactive_home_directory_defined accounts_user_interactive_home_directory_exists accounts_users_home_files_groupownership accounts_users_home_files_ownership accounts_users_home_files_permissions file_groupownership_home_directories file_ownership_home_directories file_permissions_home_directories file_permissions_home_dirs no_forward_files; do
  for os in rhel9 rhel8 rhel7; do
    for flavor in bash ansible; do
      echo "`date` - $os - $rule - $flavor VM"
      ./tests/automatus.py rule --libvirt qemu:///session $os --datastream build/ssg-$os-ds.xml --dontclean --remediate-using $flavor $rule
    done
  done
done

As a follow-up, something similar should be done with the remediation.

github-actions · 2023-02-16T08:44:33Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-02-16T08:49:33Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership'.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
@@ -1,6 +1,6 @@
 
 [title]:
-User Initialization Files Must Be Group-Owned By The Primary User
+User Initialization Files Must Be Group-Owned By The Primary Group
 
 [description]:
 Change the group owner of interactive users files to the group found

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
@@ -1,2 +1,2 @@
 
-awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $3" "$6"/.[^\.]?*") }' /etc/passwd
+awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6"/.[^\.]?*") }' /etc/passwd

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_user_dot_group_ownership
@@ -1,7 +1,7 @@
 - name: Ensure interactive local users are the group-owners of their respective initialization
 files
 ansible.builtin.command:
- cmd: awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $3" "$6"/.[^\.]?*")
+ cmd: awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6"/.[^\.]?*")
 }' /etc/passwd
 tags:
 - accounts_user_dot_group_ownership

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership'.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -1,6 +1,6 @@
 
 [title]:
-All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary User
+All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group
 
 [description]:
 Change the group of a local interactive users files and directories to a

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -1,5 +1,5 @@
 
-for user in $(awk -F':' '{ if ($4 >= 1000 && $4 != 65534) print $1 }' /etc/passwd); do
+for user in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $1 }' /etc/passwd); do
 home_dir=$(getent passwd $user | cut -d: -f6)
 group=$(getent passwd $user | cut -d: -f4)
 # Only update the group-ownership when necessary. This will avoid changing the inode timestamp

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -25,15 +25,15 @@
 - no_reboot_needed
 - restrict_strategy
 
-- name: Test for existence home directories to avoid creating them, but only fixing
+- name: Test for existence of home directories to avoid creating them, but only fixing
 ownership
 ansible.builtin.stat:
 path: '{{ item.value[4] }}'
 register: path_exists
 loop: '{{ local_users }}'
 when:
- - item.value[2]|int >= 1000
- - item.value[2]|int != 65534
+ - item.value[1]|int >= 1000
+ - item.value[1]|int != 65534
 tags:
 - CCE-86534-5
 - DISA-STIG-RHEL-08-010741

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -21,7 +21,7 @@
 - no_reboot_needed
 - restrict_strategy
 
-- name: Test for existence home directories to avoid creating them, but only fixing
+- name: Test for existence of home directories to avoid creating them, but only fixing
 ownership
 ansible.builtin.stat:
 path: '{{ item.value[4] }}'

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -1,6 +1,6 @@
 
 [title]:
-All Interactive User Home Directories Must Be Group-Owned By The Primary User
+All Interactive User Home Directories Must Be Group-Owned By The Primary Group
 
 [description]:
 Change the group owner of interactive users home directory to the

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -1,2 +1,2 @@
 
-awk -F':' '{ if ($4 >= 1000 && $4 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd
+awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -32,8 +32,8 @@
 register: path_exists
 loop: '{{ local_users }}'
 when:
- - item.value[2]|int >= 1000
- - item.value[2]|int != 65534
+ - item.value[1]|int >= 1000
+ - item.value[1]|int != 65534
 tags:
 - CCE-83434-1
 - DISA-STIG-RHEL-08-010740

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_ownership_home_directories
@@ -23,7 +23,7 @@
 - no_reboot_needed
 - restrict_strategy
 
-- name: Test for existence home directories to avoid creating them, but only fixing
+- name: Test for existence of home directories to avoid creating them, but only fixing
 ownership
 ansible.builtin.stat:
 path: '{{ item.value[4] }}'

marcusburghardt · 2023-02-16T14:56:23Z

Automatus CS8 is failing with this message:
ERROR - Rule 'xccdf_org.ssgproject.content_rule_no_forward_files' isn't present in benchmark 'xccdf_org.ssgproject.content_benchmark_RHEL-8' in '/tmp/ssgts-ds-2ej7kupl'

The no_forward_files doesn't have rhel8 in prodtype. I don't know why it was considered in Automatus CS8 test, but it should be fine to waive. This rule will be included for RHEL products in another PR.

Many rules deal with interactive users in a pretty similar way. It was created a generic macro to be used in these rules in order to keep the approach consistent among the rules and the maintainability easier.

There is a new OVAL macro to filter interactive users in a consistent way among the relevant rules. It was also included a new test scenario to test the exclusion of users using /sbin/nologin shell.

As a consequence of this improvement, a minor fix was also included in this commit. The filter for interactive users was checking the "unix:user_id" field but using "{{{ gid_min }}}" as pattern. The intention of the object was to collect interactive users and not interactive groups.

Also improved the existing test scenarios to ensure the expected permissions are set in the test environment. Comparing to chmod alone find command can better manage hidden files.

…acro

Like the accounts_users_home_files_groupownership rule, this was also improved with the macro. Before, the interactive users were filtered by gids while uids is more appropriated.

This commit also created some minor updates in the test scenarios in order to improve the readability.

This rule is deprecated in favor of file_permissions_home_directories. However, its OVAL was also updated to keep the approach of collecting interactive users aligned in all related rules.

marcusburghardt · 2023-02-17T07:30:15Z

/retest

jan-cerny

I like this idea very much

jan-cerny · 2023-02-17T10:45:47Z

...system/accounts/accounts-session/accounts_users_home_files_groupownership/ansible/shared.yml

+    - item.value[1]|int >= {{{ uid_min }}}
+    - item.value[1]|int != {{{ nobody_uid }}}


small nit pick: it might be useful for future readers to add a comment about type of data at index 1 (and at index 4 above) in the array

Great point. I wrote this some time ago and when working on this PR, honestly I had to confirm the position of the fields myself. : )) I also intend to open another PR to improve these remediations. But for now, these comments will already come in handy. I will include.

jan-cerny · 2023-02-17T10:48:53Z

linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/rule.yml

@@ -2,7 +2,7 @@ documentation_complete: true

 prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004,ubuntu2204

-title: 'User Initialization Files Must Be Group-Owned By The Primary User'
+title: 'User Initialization Files Must Be Group-Owned By The Primary Group'


item.value[1]|int is used in some Ansible tasks when looping through a dictionary created from /etc/passwd file. It could not be intuitive the index and values of the resulting dictionary. It is basically formed by the fields in /etc/passwd, where the first field is the key and the next 6 fields are in the list of values. Each file line is a item in the dictionary.

codeclimate · 2023-02-17T14:13:33Z

Code Climate has analyzed commit 97d023a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.7% (0.0% change).

View more on Code Climate.

marcusburghardt · 2023-02-20T08:57:14Z

/retest

jan-cerny

I have reviewed the code and I have executed some of the test scenarios

[jcerny@thinkpad scap-security-guide{pr/10215}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 accounts_umask_interactive_users
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-02-20-1817/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_accounts_umask_interactive_users
INFO - Script bash_history_ignored.pass.sh using profile (all) OK
INFO - Script hidden_folder_ignored.pass.sh using profile (all) OK
INFO - Script home_dirs_all_absent.pass.sh using profile (all) OK
INFO - Script home_dirs_one_absent.pass.sh using profile (all) OK
INFO - Script interactive_users_absent.pass.sh using profile (all) OK
INFO - Script no_dot_file_ignored.pass.sh using profile (all) OK
INFO - Script umask_defined.fail.sh using profile (all) OK
INFO - Script interactive_user_nologin_ignored.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/10215}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible accounts_umask_interactive_users
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-02-20-1821/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_accounts_umask_interactive_users
INFO - Script bash_history_ignored.pass.sh using profile (all) OK
INFO - Script hidden_folder_ignored.pass.sh using profile (all) OK
INFO - Script home_dirs_all_absent.pass.sh using profile (all) OK
INFO - Script home_dirs_one_absent.pass.sh using profile (all) OK
INFO - Script interactive_users_absent.pass.sh using profile (all) OK
INFO - Script no_dot_file_ignored.pass.sh using profile (all) OK
INFO - Script umask_defined.fail.sh using profile (all) OK
INFO - Script interactive_user_nologin_ignored.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/10215}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 file_permissions_home_directories
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-02-20-1825/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permissions_home_directories
INFO - Script acceptable_permission.pass.sh using profile (all) OK
INFO - Script expected_permissions.pass.sh using profile (all) OK
INFO - Script home_dirs_absent.pass.sh using profile (all) OK
INFO - Script interactive_users_absent.pass.sh using profile (all) OK
INFO - Script lenient_permission.fail.sh using profile (all) OK
INFO - Script special_permissions.fail.sh using profile (all) OK
INFO - Script interactive_user_nologin_ignored.pass.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/10215}]$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible file_permissions_home_directories
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-02-20-1828/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permissions_home_directories
INFO - Script acceptable_permission.pass.sh using profile (all) OK
INFO - Script expected_permissions.pass.sh using profile (all) OK
INFO - Script home_dirs_absent.pass.sh using profile (all) OK
INFO - Script interactive_users_absent.pass.sh using profile (all) OK
INFO - Script lenient_permission.fail.sh using profile (all) OK
INFO - Script special_permissions.fail.sh using profile (all) OK
INFO - Script interactive_user_nologin_ignored.pass.sh using profile (all) OK

jan-cerny · 2023-02-20T17:34:14Z

The error of automatus is expected because some of the rules aren't present in the RHEL 9 data stream

marcusburghardt added enhancement General enhancements to the project. OVAL OVAL update. Related to the systems assessments. labels Feb 16, 2023

marcusburghardt added this to the 0.1.67 milestone Feb 16, 2023

marcusburghardt force-pushed the interactive_users_nologin branch from cc4dc78 to b697b72 Compare February 16, 2023 15:26

marcusburghardt added 15 commits February 16, 2023 16:27

Include macro to create interactive users object

5ec2d08

Many rules deal with interactive users in a pretty similar way. It was created a generic macro to be used in these rules in order to keep the approach consistent among the rules and the maintainability easier.

Update file_ownership_home_directories to use OVAL macro

809f60e

There is a new OVAL macro to filter interactive users in a consistent way among the relevant rules. It was also included a new test scenario to test the exclusion of users using /sbin/nologin shell.

Update file_groupownership_home_directories to use OVAL macro

0bfaf93

Update file_permissions_home_directories to use OVAL macro

d26a61c

Update accounts_users_home_files_ownership to use OVAL macro

e611c8f

Update accounts_users_home_files_permissions to use OVAL macro

967ec73

Also improved the existing test scenarios to ensure the expected permissions are set in the test environment. Comparing to chmod alone find command can better manage hidden files.

Update accounts_user_interactive_home_directory_defined to use OVAL m…

50fb02d

…acro

Update accounts_user_interactive_home_directory_exists to use OVAL macro

818baee

Update accounts_user_dot_user_ownership to use OVAL macro

7430d80

Update accounts_user_dot_group_ownership to use OVAL macro

cf499cd

Like the accounts_users_home_files_groupownership rule, this was also improved with the macro. Before, the interactive users were filtered by gids while uids is more appropriated.

Update accounts_user_dot_no_world_writable_programs to use OVAL macro

25d5158

This commit also created some minor updates in the test scenarios in order to improve the readability.

Update file_permissions_home_dirs to use OVAL macro

5ff9248

This rule is deprecated in favor of file_permissions_home_directories. However, its OVAL was also updated to keep the approach of collecting interactive users aligned in all related rules.

Update accounts_umask_interactive_users to use OVAL macro

083f30c

Update no_forward_files to use OVAL macro

dec8988

marcusburghardt force-pushed the interactive_users_nologin branch from b697b72 to dec8988 Compare February 16, 2023 15:27

jan-cerny reviewed Feb 17, 2023

View reviewed changes

marcusburghardt requested a review from jan-cerny February 20, 2023 08:57

jan-cerny self-assigned this Feb 20, 2023

jan-cerny approved these changes Feb 20, 2023

View reviewed changes

jan-cerny merged commit 2657bcb into ComplianceAsCode:master Feb 20, 2023

marcusburghardt deleted the interactive_users_nologin branch February 21, 2023 08:02

marcusburghardt added the Update Rule Issues or pull requests related to Rules updates. label Mar 3, 2023

marcusburghardt mentioned this pull request Apr 5, 2023

Add implementation for accounts_users_netrc_file_permissions rule #9988

Merged

marcusburghardt mentioned this pull request Aug 25, 2023

Transform user_list into a product attribute (follow up from #8426) #8429

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create OVAL macro to consistently identify Interactive Users #10215

Create OVAL macro to consistently identify Interactive Users #10215

marcusburghardt commented Feb 16, 2023 •

edited

Loading

github-actions bot commented Feb 16, 2023

github-actions bot commented Feb 16, 2023

marcusburghardt commented Feb 16, 2023

marcusburghardt commented Feb 17, 2023

jan-cerny left a comment

jan-cerny Feb 17, 2023

marcusburghardt Feb 17, 2023

marcusburghardt Feb 17, 2023

jan-cerny Feb 17, 2023

codeclimate bot commented Feb 17, 2023

marcusburghardt commented Feb 20, 2023

jan-cerny left a comment

jan-cerny commented Feb 20, 2023

		- item.value[1]\|int >= {{{ uid_min }}}
		- item.value[1]\|int != {{{ nobody_uid }}}

Create OVAL macro to consistently identify Interactive Users #10215

Create OVAL macro to consistently identify Interactive Users #10215

Conversation

marcusburghardt commented Feb 16, 2023 • edited Loading

Description:

Rationale:

Review Hints:

github-actions bot commented Feb 16, 2023

github-actions bot commented Feb 16, 2023

marcusburghardt commented Feb 16, 2023

marcusburghardt commented Feb 17, 2023

jan-cerny left a comment

Choose a reason for hiding this comment

jan-cerny Feb 17, 2023

Choose a reason for hiding this comment

marcusburghardt Feb 17, 2023

Choose a reason for hiding this comment

marcusburghardt Feb 17, 2023

Choose a reason for hiding this comment

jan-cerny Feb 17, 2023

Choose a reason for hiding this comment

codeclimate bot commented Feb 17, 2023

marcusburghardt commented Feb 20, 2023

jan-cerny left a comment

Choose a reason for hiding this comment

jan-cerny commented Feb 20, 2023

marcusburghardt commented Feb 16, 2023 •

edited

Loading