various small fixes to RHEL 7 and RHEL 8 CIS

[vojtapolasek]

Description:

• see commit messages for details

Rationale:

• I went through rule differences between RHEL 7 CIS level 2 server and its RHEL 8 counterpart
• I found several discrepancies and these are suggested fixes

Review Hints:

• verify each commit agains official CIS policy

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[vojtapolasek]

/packit retest-failed

[jan-cerny]

Unfortunately, the rule auditd_data_retention_admin_space_left_action isn't able to accept a multiple value variable. I believe this is the reason of the CI fail, the rule service_auditd_enabled fails because auditd can't start because its configuration is broken because the remediation of this rule inserts both values there which is an invalid config. The OVAL, Bash and Ansible need to be changed to handle this. We have done a similar change in auditd_data_retention_space_left_action , so you can do the same thing here

[Mab879]

@vojtapolasek please rebase this.

[vojtapolasek]

Hello, @jan-cerny I modified the rule
@Mab879 I rebased.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled'.
--- xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
+++ xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
@@ -179,6 +179,9 @@
 RHEL-08-010370
 
 [reference]:
+1.2.2
+
+[reference]:
 SV-230264r880711_rule
 
 [rationale]:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
@@ -3,6 +3,8 @@
 
 var_auditd_admin_space_left_action=''
 
+
+var_auditd_admin_space_left_action="$(echo $var_auditd_admin_space_left_action | cut -d \| -f 1)"
 
 AUDITCONFIG=/etc/audit/auditd.conf
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
@@ -27,7 +27,8 @@
 - name: Configure auditd admin_space_left Action on Low Disk Space
   lineinfile:
     dest: /etc/audit/auditd.conf
-    line: admin_space_left_action = {{ var_auditd_admin_space_left_action }}
+    line: admin_space_left_action = {{ var_auditd_admin_space_left_action .split('|')[0]
+      }}
     regexp: ^\s*admin_space_left_action\s*=\s*.*$
     state: present
     create: true

[jan-cerny]

@vojtapolasek thanks

[codeclimate]

Code Climate has analyzed commit 58be005 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.3% (0.0% change).

View more on Code Climate.

[jan-cerny]

/packit retest-failed

[jan-cerny]

The Automatus test scenarios pass locally when executed against a RHEL 8 virtual machine back end:

jcerny@fedora:~/work/git/scap-security-guide (pr/11487)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 auditd_data_retention_admin_space_left_action
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-01-26-1703/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
INFO - Script admin_space_left_action_email.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_exec.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_halt.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_halt_cis.pass.sh using profile xccdf_org.ssgproject.content_profile_cis OK
INFO - Script admin_space_left_action_ignore.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_not_there.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_rotate.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_single.pass.sh using profile (all) OK
INFO - Script admin_space_left_action_suspend.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_syslog.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_email_cis.fail.sh using profile xccdf_org.ssgproject.content_profile_cis OK
jcerny@fedora:~/work/git/scap-security-guide (pr/11487)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 --remediate-using ansible auditd_data_retention_admin_space_left_action
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-01-26-1710/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
INFO - Script admin_space_left_action_email.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_exec.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_halt.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_halt_cis.pass.sh using profile xccdf_org.ssgproject.content_profile_cis OK
INFO - Script admin_space_left_action_ignore.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_not_there.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_rotate.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_single.pass.sh using profile (all) OK
INFO - Script admin_space_left_action_suspend.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_syslog.fail.sh using profile (all) OK
INFO - Script admin_space_left_action_email_cis.fail.sh using profile xccdf_org.ssgproject.content_profile_cis OK

I believe the fail we can see in the GitHub Actions Automatus job is caused by a collision with the removal of prodtype, specifically, the automatus's option --add-product-to-fips-certified fedora that is used by the GitHub Actions job is broken. However, this problem isn't caused by the contents of this PR.