-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Review rpm_verify_ownership rule #11333
Review rpm_verify_ownership rule #11333
Conversation
Also update warning about high consume of system resources in some scenarios.
The OVAL check was inneficient by searching the RPM database twice and consequently creating two similar objects and two tests. The logic was simplified to one single test, one single query in the RPM databases and one single object covering all necessary cases. Besides the simplification, the performance during the check was also improved.
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_ownership'.
--- xccdf_org.ssgproject.content_rule_rpm_verify_ownership
+++ xccdf_org.ssgproject.content_rule_rpm_verify_ownership
@@ -3,22 +3,27 @@
Verify and Correct Ownership with RPM
[description]:
-The RPM package management system can check file ownership
-permissions of installed software packages, including many that are
-important to system security. After locating a file with incorrect
-permissions, which can be found with
+The RPM package management system can check file ownership permissions of installed software
+packages, including many that are important to system security. After locating a file with
+incorrect permissions, which can be found with:
rpm -Va | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
run the following command to determine which package owns it:
$ rpm -qf FILENAME
-Next, run the following command to reset its permissions to
-the correct values:
+Next, run the following command to reset its permissions to the correct values:
$ sudo rpm --setugids PACKAGENAME
[warning]:
Profiles may require that specific files be owned by root while the default owner defined
-by the vendor is different.
-Such files will be reported as a finding and need to be evaluated according to your policy
-and deployment environment.
+by the vendor is different. Such files will be reported as a finding and need to be
+evaluated according to your policy and deployment environment.
+
+[warning]:
+This rule can take a long time to perform the check and might consume a considerable
+amount of resources depending on the number of packages present on the system. It is not a
+problem in most cases, but especially systems with a large number of installed packages
+can be affected.
+
+See https://access.redhat.com/articles/6999111.
[reference]:
1
@@ -354,10 +359,9 @@
6.1.9
[rationale]:
-Ownership of binaries and configuration files that is incorrect
-could allow an unauthorized user to gain privileges that they should
-not have. The ownership set by the vendor should be maintained. Any
-deviations from this baseline should be investigated.
+Ownership of binaries and configuration files that is incorrect could allow an unauthorized
+user to gain privileges that they should not have. The ownership set by the vendor should be
+maintained. Any deviations from this baseline should be investigated.
[ident]:
CCE-82196-7
OVAL for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_ownership' differs.
--- oval:ssg-rpm_verify_ownership:def:1
+++ oval:ssg-rpm_verify_ownership:def:1
@@ -1,3 +1,2 @@
criteria AND
-criterion oval:ssg-test_verify_all_rpms_user_ownership:tst:1
-criterion oval:ssg-test_verify_all_rpms_group_ownership:tst:1
+criterion oval:ssg-test_rpm_verify_ownership_verify_all_rpms_ownership:tst:1 |
/packit retest-failed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
jcerny@fedora ~/work/git/scap-security-guide (pr/11332) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible rpm_verify_ownership
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-04-1343/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rpm_verify_ownership
INFO - Script all_ownerships_ok.pass.sh using profile (all) OK
INFO - Script wrong_group_ownership.fail.sh using profile (all) OK
INFO - Script wrong_ownership.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11333) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 rpm_verify_ownership
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-04-1351/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rpm_verify_ownership
INFO - Script all_ownerships_ok.pass.sh using profile (all) OK
INFO - Script wrong_group_ownership.fail.sh using profile (all) OK
INFO - Script wrong_ownership.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11333) $
This rule can take a long time to perform the check and might consume a considerable | ||
amount of resources depending on the number of packages present on the system. It is not a | ||
problem in most cases, but especially systems with a large number of installed packages | ||
can be affected. See <code>https://access.redhat.com/articles/6999111</code>. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that the link to the article should be present only in RHEL products because users who aren't Red Hat customers can't access this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
Code Climate has analyzed commit 4475fc9 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
/packit retest-failed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have seen that the link is visible in a RHEL 9 HTML guide but isn't visible in a OL9 e8 HTML guide.
Description:
This PR extract the commits related to
rpm_verify_ownership
from #11319It:
Rationale:
Better description and awareness of possible performance issues in the rule.
Rule performance improvement.
Review Hints:
Automatus tests should be enough.