Add root user to interactive users #11729

jan-cerny · 2024-03-19T15:51:14Z

The rule file_permission_user_init_files now checks only dot files of users with UID greater than or equal 1000. But according to RHEL 9 STIG and CIS benchmarks it should check also the root user's dot files. This commit extends the rule to account also for the root user and adds a simple test scenario covering this situation.

Fixes #11699

github-actions · 2024-03-19T15:53:00Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel9 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-03-19T15:56:03Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files'.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -16,12 +16,6 @@
 [reference]:
 R50
 
-[reference]:
-RHEL-09-232045
-
-[reference]:
-SV-257889r925654_rule
-
 [rationale]:
 Local initialization files are used to configure the user's shell environment
 upon logon. Malicious modification of these files could compromise accounts upon

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -10,7 +10,6 @@
     database: passwd
   tags:
   - CCE-83637-9
-  - DISA-STIG-RHEL-09-232045
   - file_permission_user_init_files
   - low_complexity
   - low_disruption
@@ -33,7 +32,6 @@
   register: found_init_files
   tags:
   - CCE-83637-9
-  - DISA-STIG-RHEL-09-232045
   - file_permission_user_init_files
   - low_complexity
   - low_disruption
@@ -50,7 +48,6 @@
     {''skip_missing'': True}) }}'
   tags:
   - CCE-83637-9
-  - DISA-STIG-RHEL-09-232045
   - file_permission_user_init_files
   - low_complexity
   - low_disruption

github-actions · 2024-03-19T15:57:22Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11729
This image was built from commit: af615e2

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11729

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11729 make deploy-local

Mab879 · 2024-03-20T00:24:54Z

Tests pass locally

$ ./automatus.py rule --datastream ../build/ssg-rhel9-ds.xml --libvirt qemu:///system automatus_rhel9_4 file_permission_user_init_files
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/ComplianceAsCode/content/tests/logs/rule-custom-2024-03-19-1855/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permission_user_init_files
INFO - Script all_permissions.fail.sh using profile (all) OK
INFO - Script correct_permissions.pass.sh using profile (all) OK
INFO - Script different_home_correct_permissions.pass.sh using profile (all) OK
INFO - Script different_home_wrong_permissions.fail.sh using profile (all) OK
INFO - Script lenient_permissions.fail.sh using profile (all) OK
INFO - Script stricter_permissions.pass.sh using profile (all) OK
INFO - Script lenient_permissions_root.fail.sh using profile (all) OK
$ ./automatus.py rule --datastream ../build/ssg-rhel9-ds.xml --libvirt qemu:///system automatus_rhel9_4 file_permission_user_init_files
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/ComplianceAsCode/content/tests/logs/rule-custom-2024-03-19-1855/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permission_user_init_files
INFO - Script all_permissions.fail.sh using profile (all) OK
INFO - Script correct_permissions.pass.sh using profile (all) OK
INFO - Script different_home_correct_permissions.pass.sh using profile (all) OK
INFO - Script different_home_wrong_permissions.fail.sh using profile (all) OK
INFO - Script lenient_permissions.fail.sh using profile (all) OK
INFO - Script stricter_permissions.pass.sh using profile (all) OK
INFO - Script lenient_permissions_root.fail.sh using profile (all) OK

marcusburghardt · 2024-03-20T10:30:18Z

shared/macros/10-oval.jinja

+    </set>
+  </unix:password_object>
+
+  <unix:password_object id="{{{ object_id }}}_root" version="1">


There are more rules using this macro. We should ensure the remediation on them are aligned to the OVAL assessment.

yes already working on it

Mab879

The scan has option for root, but the remediation doesn't. Is that expected.

Mab879 · 2024-03-20T19:15:05Z

linux_os/guide/system/accounts/accounts-session/file_permission_user_init_files/bash/shared.sh

-readarray -t interactive_users < <(awk -F: '$3>={{{ uid_min }}}   {print $1}' /etc/passwd)
-readarray -t interactive_users_home < <(awk -F: '$3>={{{ uid_min }}}   {print $6}' /etc/passwd)
-readarray -t interactive_users_shell < <(awk -F: '$3>={{{ uid_min }}}   {print $7}' /etc/passwd)
+readarray -t interactive_users < <(awk -F: '$3==0 || $3>={{{ uid_min }}}   {print $1}' /etc/passwd)


This always checks root do we want that?

I think yes - I think that is the point of the issue that the root's files were not evaluated and were not remediatied.

Mab879

The testing farm failure for RHEL 7 looks valid, please take look.

jan-cerny · 2024-03-22T09:30:54Z

The rule passes after first remediation and passes after second remediation but suddenly it fails in the final scan. I suspect something happens during the third reboot. I will try to identify the cause.

jan-cerny · 2024-03-22T12:31:05Z

The problem is that it conflicts with the rule rpm_verify_permissions. The root's dot files are owned by the rootfiles RPM package and they're shipped with different permissions. The first remediation changes the permissions in the code for rule file_permission_user_init_files, but that makes the rule rpm_verify_permissions fail and this fail is fixed during the second remediation and that makes the rule file_permission_user_init_files fail.

jan-cerny · 2024-03-22T15:56:52Z

We're trying to fix a RHEL 9 STIG misalignement. But the conflict with rpm_verify_permissions happens on RHEL 7. The reason is that RHEL 9 STIG doesn't contain rpm_verify_permissions. So we can solve this situation this way: We won't change rule file_permission_user_init_files. We will create a new rule that will be similar but will check the root files. We will replace the file_permission_user_init_files in RHEL 9 STIG with the new rule. We will select the new rule only in RHEL 9 STIG. This way, we won't break other products. What do you think?

Mab879 · 2024-03-22T18:06:05Z

We're trying to fix a RHEL 9 STIG misalignement. But the conflict with rpm_verify_permissions happens on RHEL 7. The reason is that RHEL 9 STIG doesn't contain rpm_verify_permissions. So we can solve this situation this way: We won't change rule file_permission_user_init_files. We will create a new rule that will be similar but will check the root files. We will replace the file_permission_user_init_files in RHEL 9 STIG with the new rule. We will select the new rule only in RHEL 9 STIG. This way, we won't break other products. What do you think?

That seems like a fine solution.

jan-cerny · 2024-03-25T07:54:07Z

OK I will proceed with my proposal

The rule file_permission_user_init_files now checks only dot files of users with UID greater than or equal 1000. But according to RHEL 9 STIG and CIS benchmarks it should check also the root user's dot files. This commit creates a new rule file_permission_user_init_files_root which is almost the same as file_permission_user_init_files, but the new rule accounts also for the root user and his init files. We also change the OVAL jinja macro. This change will include the root user to the user list only if needed. We will use the root in the rule file_permission_user_init_file. But we will not use the root in accounts_user_interactive_home_directory_defined where we keep the old behavior. The commit also adds a simple test scenario covering this situation. Fixes: ComplianceAsCode#11699

codeclimate · 2024-03-26T09:02:42Z

Code Climate has analyzed commit af615e2 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.3% (0.0% change).

View more on Code Climate.

Mab879

LGTM.

Thanks

jan-cerny added bugfix Fixes to reported bugs. Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. STIG STIG Benchmark related. labels Mar 19, 2024

jan-cerny added this to the 0.1.73 milestone Mar 19, 2024

Mab879 self-assigned this Mar 19, 2024

Mab879 approved these changes Mar 20, 2024

View reviewed changes

marcusburghardt reviewed Mar 20, 2024

View reviewed changes

Mab879 reviewed Mar 20, 2024

View reviewed changes

Mab879 requested changes Mar 22, 2024

View reviewed changes

jan-cerny force-pushed the issue11699 branch from 126841d to af615e2 Compare March 26, 2024 08:44

Mab879 approved these changes Mar 26, 2024

View reviewed changes

Mab879 merged commit ad141d4 into ComplianceAsCode:master Mar 26, 2024
43 of 44 checks passed

marcusburghardt mentioned this pull request Apr 12, 2024

file_permission_user_init_files_root is misaligned with RHEL 9 STIG #11778

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add root user to interactive users #11729

Add root user to interactive users #11729

jan-cerny commented Mar 19, 2024

github-actions bot commented Mar 19, 2024 •

edited

Loading

github-actions bot commented Mar 19, 2024 •

edited

Loading

github-actions bot commented Mar 19, 2024 •

edited

Loading

Mab879 commented Mar 20, 2024

marcusburghardt Mar 20, 2024

jan-cerny Mar 20, 2024

Mab879 left a comment

Mab879 Mar 20, 2024

jan-cerny Mar 21, 2024

Mab879 left a comment

jan-cerny commented Mar 22, 2024

jan-cerny commented Mar 22, 2024

jan-cerny commented Mar 22, 2024

Mab879 commented Mar 22, 2024

jan-cerny commented Mar 25, 2024

codeclimate bot commented Mar 26, 2024

Mab879 left a comment

Add root user to interactive users #11729

Add root user to interactive users #11729

Conversation

jan-cerny commented Mar 19, 2024

github-actions bot commented Mar 19, 2024 • edited Loading

github-actions bot commented Mar 19, 2024 • edited Loading

github-actions bot commented Mar 19, 2024 • edited Loading

Mab879 commented Mar 20, 2024

marcusburghardt Mar 20, 2024

Choose a reason for hiding this comment

jan-cerny Mar 20, 2024

Choose a reason for hiding this comment

Mab879 left a comment

Choose a reason for hiding this comment

Mab879 Mar 20, 2024

Choose a reason for hiding this comment

jan-cerny Mar 21, 2024

Choose a reason for hiding this comment

Mab879 left a comment

Choose a reason for hiding this comment

jan-cerny commented Mar 22, 2024

jan-cerny commented Mar 22, 2024

jan-cerny commented Mar 22, 2024

Mab879 commented Mar 22, 2024

jan-cerny commented Mar 25, 2024

codeclimate bot commented Mar 26, 2024

Mab879 left a comment

Choose a reason for hiding this comment

github-actions bot commented Mar 19, 2024 •

edited

Loading

github-actions bot commented Mar 19, 2024 •

edited

Loading

github-actions bot commented Mar 19, 2024 •

edited

Loading