Bug 1554932

Summary:	OSCAP rule xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading fails with error even after remediation applied
Product:	Red Hat Enterprise Linux 7	Reporter:	Zdenek Pytela <zpytela>
Component:	scap-security-guide	Assignee:	Watson Yuuma Sato <wsato>
Status:	CLOSED DUPLICATE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	mhaicman, mpreisle, openscap-maint, pierre-yves.goubet
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-13 16:08:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Zdenek Pytela 2018-03-13 15:20:41 UTC

Description of problem:
OSCAP rule xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
fails with Result: error even after the remediation has been applied

Version-Release number of selected component (if applicable):
scap-security-guide-0.1.33-5.el7.noarch
scap-security-guide-0.1.36-7.el7.noarch

How reproducible:
always (RHEL 7.4, 7.5)

Steps to Reproduce:
1. yum install openscap-scanner scap-security-guide
2. oscap xccdf eval --results /tmp/results.xml --remediate --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml


Actual results:
Title   Ensure auditd Collects Information on Kernel Module Loading and Unloading
Rule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
Ident   CCE-27129-6
Result  fail


Expected results:
Result  pass

Additional info:
  $ grep init_module /etc/audit/audit.rules 
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules

Comment 2 Zdenek Pytela 2018-03-13 15:30:30 UTC

This is the screenshot (Result: error is the relevant error message):

  # oscap xccdf eval --results /tmp/results.xml --remediate --fetch-remote-
resources --profile xccdf_org.ssgproject.content_profile_pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
...
Title   Ensure auditd Collects Information on Kernel Module Loading and Unloading
Rule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
Ident   CCE-27129-6
Result  fail
...
 --- Starting Remediation ---
Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok
...
Title   Ensure auditd Collects Information on Kernel Module Loading and Unloading
Rule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
Ident   CCE-27129-6
Result  error
...

Comment 3 Marek Haicman 2018-03-13 16:08:04 UTC


*** This bug has been marked as a duplicate of bug 1547694 ***