Bug 1404392

Summary:	SCAP Security Guide false positives when scanning Docker containers
Product:	Red Hat Enterprise Linux 7	Reporter:	Martin Preisler <mpreisle>
Component:	scap-security-guide	Assignee:	Watson Yuuma Sato <wsato>
Status:	CLOSED ERRATA	QA Contact:	Matus Marhefka <mmarhefk>
Severity:	high	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	medium
Version:	7.4	CC:	mhaicman, mmarhefk, openscap-maint
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Unspecified
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.32-1.el7	Doc Type:	Enhancement
Doc Text:	_scap-security-guide_ and oscap-docker now support containers The user can now use the oscap-docker utility and the SCAP Security Guide to assess compliance of container or container image without encountering false positive results. Tests that make no sense in container context, such as partitioning, has been set to the `not applicable` value, and containers can be now scanned with a selected security policy.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 12:24:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Preisler 2016-12-13 18:08:05 UTC

Description of problem:
SCAP Security Guide has a bunch of security compliance profiles for RHEL7 - PCI-DSS, STIG, OSPP are the most important ones. These profiles were created with bare-metal and virtual machines in mind. They contain rules such as:

- Ensure /home Located On Separate Partition
- Ensure /tmp Located On Separate Partition
- ...
- Kernel Runtime Parameter "kernel.exec-shield" Check
- Kernel Runtime Parameter IPv6 Check
- ...

These rules make perfect sense on bare-metal machines or VMs but they make no sense in docker images. These should return "notapplicable" instead of "fail" when scanning container images using oscap-docker.

Version-Release number of selected component (if applicable):
0.1.30
0.1.31

How reproducible:
Always

Steps to Reproduce:
1. yum install openscap-utils atomic scap-security-guide
2. oscap-docker image $IMAGE_ID xccdf eval --profile $PROFILE /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Actual results:
Failures for rules that don't make sense in container images

Expected results:
Pass and fail for "universal" rules. "notapplicable" for rules that only make sense outside containers.

Additional info:

Comment 1 Martin Preisler 2017-03-02 15:26:34 UTC

Upstream fixes:
- https://github.com/OpenSCAP/scap-security-guide/pull/1716
- https://github.com/OpenSCAP/scap-security-guide/pull/1670
- https://github.com/OpenSCAP/scap-security-guide/pull/1645

Comment 6 errata-xmlrpc 2017-08-01 12:24:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2064