Bug 1392681
| Summary: | SCAP Security Guide remediation fail - CCE-80258-7 - Disable KDump Kernel Crash Analyzer (kdump) | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Shawn Wells <swells> | ||||||
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Marek Haicman <mhaicman> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 7.3 | CC: | mhaicman, mpreisle, openscap-maint, redhatrises | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | scap-security-guide-0.1.40-1.el7 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2018-10-30 11:46:47 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 1564903 | ||||||||
| Bug Blocks: | |||||||||
| Attachments: |
|
||||||||
|
Description
Shawn Wells
2016-11-08 02:25:16 UTC
Shawn, Since you were testing this with anaconda, is this because kdump is configured/enabled/disabled on firstboot? To be able to disable services through anaconda remediation we need add support for 'service' fix element in oscap-anaconda-addon. There is also another approach using an Anaconda addon (com_redhat_kdump) that can disable kdump, but oscap-anaconda-addon doesn't support this fix element too. I say that we should add both 'service' and 'com_redhat_kdump' to the oscap-anaconda-addon to better support kickstart builds. Created attachment 1270865 [details]
Anaconda oscap and kdump addon logs
Although there is no anaconda remediation, I did not understand why the post-install evaluation and remediation would not fix it, if there is script remediation for this. After some investigation I found out that com_redhat_kdump addon runs right after oscap-anaconda-addon and applies its configuration, and default configuration is kdump enabled. See attached log snippet from anaconda. With latest version of oscap-anaconda-addon (0.9), and following patches to SSG, we can disable kdump at install time. https://github.com/OpenSCAP/scap-security-guide/pull/2764 https://github.com/OpenSCAP/scap-security-guide/pull/2827 Created attachment 1478985 [details]
failed anaconda hardening run
Hi, it looks like this is still somehow buggy - the anaconda has been properly informed to disable kdump (the spoke has updated to kdump disable by profile selection).
My finding in Comment 11 was manifestation of Bug 1629490. Kdump is truly disabled by the profile after reboot of the machine in version scap-security-guide-0.1.40-5.el7. Verified manually. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3308 |