Bug 1571319

Summary: Rule audit_rules_kernel_module_loading does not remediate properly [rhel-7.5.z]
Product: Red Hat Enterprise Linux 7 Reporter: Oneata Mircea Teodor <toneata>
Component: scap-security-guideAssignee: Watson Yuuma Sato <wsato>
Status: CLOSED ERRATA QA Contact: Marek Haicman <mhaicman>
Severity: high Docs Contact: Mirek Jahoda <mjahoda>
Priority: high    
Version: 7.4CC: kbost, mhaicman, mjahoda, mpreisle, mthacker, openscap-maint, toneata, wsato, yhuang, zpytela
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: scap-security-guide-0.1.36-8.el7_5 Doc Type: Bug Fix
Doc Text:
Due to a bug in remediation for the kernel_module_loading rule, the rule did not fix the system properly and subsequent scans of a remediated system failed. With this update, the remediation has been fixed to add audit rules for both 32- and 64-bit architectures when remediating a 64-bit system. As a result, remediated systems can now pass scans with kernel_module_loading.
Story Points: ---
Clone Of: 1547694 Environment:
Last Closed: 2018-05-14 16:13:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1547694    
Bug Blocks:    

Description Oneata Mircea Teodor 2018-04-24 13:54:22 UTC
This bug has been copied from bug #1547694 and has been proposed to be backported to 7.5 z-stream (EUS).

Comment 2 Oneata Mircea Teodor 2018-04-26 12:54:50 UTC
*** Bug 1572136 has been marked as a duplicate of this bug. ***

Comment 6 Marek Haicman 2018-04-30 09:13:06 UTC
Verified fix in version scap-security-guide-0.1.36-9.el7_5.noarch through SSG Test Suite on commit https://github.com/OpenSCAP/scap-security-guide/commit/04ddc39b88f5756bf078b28b78fe11226096b438

NEW (scap-security-guide-0.1.36-9.el7_5.noarch):
[dahaic@machine tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-rhel7 --datastream ./ssg-7.5.1-2.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml audit_rules_kernel_module_loading
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
<snip>

OLD (scap-security-guide-0.1.36-7.el7.noarch):
[dahaic@machine tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-rhel7 --datastream ./ssg-7.5.0.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml audit_rules_kernel_module_loading
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
ERROR - Scan has exited with return code 2, instead of expected 0 during stage remediation
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading'.
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
<snip>

Comment 9 errata-xmlrpc 2018-05-14 16:13:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1410