Back to bug 2184487

Who When What Removed Added
Red Hat Bugzilla 2023-04-04 20:33:40 UTC Pool ID sst_security_compliance_rhel_8
Red Hat One Jira (issues.redhat.com) 2023-04-04 20:34:58 UTC Link ID Red Hat Issue Tracker RHELPLAN-154037
Vojtech Polasek 2023-04-24 11:30:56 UTC Keywords Triaged
Maynord Rosales 2023-05-12 15:33:35 UTC CC libin.babu, maynord.rosales
Peter Vreman 2023-06-27 15:05:38 UTC CC peter.vreman
Marcus Burghardt 2023-07-13 13:13:14 UTC CC dbodnarc, vpolasek
Flags needinfo?(vpolasek)
CC maburgha
Marcus Burghardt 2023-07-20 08:54:18 UTC Assignee vpolasek maburgha
Status NEW ASSIGNED
Marcus Burghardt 2023-07-20 11:16:28 UTC Doc Type If docs needed, set a value Bug Fix
Doc Text Cause: Default permissions of uefi files were not accepted and where not possible to be changed via chmod when /boot/efi was using a vfat file system.

Consequence: The file_permissions_efi_user_cfg rule was failing and the remediation was ineffective.

Fix: Allow the "0700" permission for files in /boot/efi instead of only "0600". "0700" is the default permission and is accepted by CIS, so the assessment and remediation are not better aligned to CIS.

Result: The file_permissions_efi_user_cfg rule should no longer fail if /boot/efi is mounted using the default permissions.
Jan Černý 2023-07-20 12:29:04 UTC CC jcerny
Status ASSIGNED POST
Jiri Jaburek 2023-08-01 23:28:44 UTC Flags needinfo?(vpolasek)
CC jjaburek
RHEL Program Management Team 2023-08-02 12:10:06 UTC Blocks 2228443
RHEL Program Management Team 2023-08-02 12:10:20 UTC Blocks 2228445
RHEL Program Management Team 2023-08-02 12:10:30 UTC Keywords ZStream
Matěj Týč 2023-08-10 14:36:51 UTC Fixed In Version scap-security-guide-0.1.69-1.el8
CC matyc
Status POST MODIFIED

Back to bug 2184487