Bug 1592970
| Summary: | Ansible remediation setting SELinux policy fails | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Shawn K. O'Shea <shawn> | |
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> | |
| Status: | CLOSED ERRATA | QA Contact: | Marek Haicman <mhaicman> | |
| Severity: | medium | Docs Contact: | Mirek Jahoda <mjahoda> | |
| Priority: | high | |||
| Version: | 7.5 | CC: | jvilicic, matyc, mhaicman, mjahoda, mpreisle, mthacker, openscap-maint | |
| Target Milestone: | rc | Keywords: | ZStream | |
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | All | |||
| Whiteboard: | ||||
| Fixed In Version: | scap-security-guide-0.1.40-5.el7 | Doc Type: | Bug Fix | |
| Doc Text: |
Previously, the playbook for setting SELinux policy did not include the "state" parameter to the Ansible SELinux module. As a consequence, remediation playbooks generated by the oscap command failed to set the SELinux policy accordingly to the "var_selinux_policy_name" variable. With this update, the remediation playbook has been changed to use the "lineinfile" module, and it can now correctly set the SELinux policy as defined in "var_selinux_policy_name".
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1601929 (view as bug list) | Environment: | ||
| Last Closed: | 2018-10-30 11:46:49 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1601929 | |||
Hello Engineering Team,
1) As of now, OpenSCAP remediation by generating Ansible Playbooks does not work correctly if it has this bug.
The Red Hat customer in the case attached to this bug (who actually filed the bug) is asking if the fix for this bug, since it has already been fixed upstream, can be backported.
Would a z-stream release be possible?
2) This is the same customer from:
a) "Ansible remediation of default umask in login.defs sets incorrect value"
https://bugzilla.redhat.com/show_bug.cgi?id=1592957
b) "Ansible remediation of various dconf settings contains typo"
https://bugzilla.redhat.com/show_bug.cgi?id=1592887
Take care,
Jo Vilicic
irc: jo -- jvilicic
TSE -- IdM -- 919-754-4951
Changing state as there indeed is a fix upstream: https://github.com/OpenSCAP/scap-security-guide/pull/2451 Verified version scap-security-guide-0.1.40-5.el7 contains required fix.
OLD (scap-security-guide-0.1.36-9.el7_5):
grep -C3 '{{ var_selinux_state }}' /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
- name: "Ensure SELinux State is Enforcing"
selinux:
state: "{{ var_selinux_state }}"
tags:
- selinux_state
- high_severity
--
- name: "Ensure SELinux State is Enforcing"
selinux:
state: "{{ var_selinux_state }}"
tags:
- selinux_state
- high_severity
NEW (scap-security-guide-0.1.40-5.el7):
grep -C3 '{{ var_selinux_state }}' /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
lineinfile:
path: /etc/sysconfig/selinux
regexp: '^SELINUX='
line: "SELINUX={{ var_selinux_state }}"
create: yes
tags:
- selinux_state
--
lineinfile:
path: /etc/sysconfig/selinux
regexp: '^SELINUX='
line: "SELINUX={{ var_selinux_state }}"
create: yes
tags:
- selinux_state
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3308 |
Description of problem: Remediation playbooks generated by oscap fail to set the SELinux policy held in the variable 'var_selinux_policy_name'. This is because in the RHEL version of the package, the ansible 'selinux' module is used, and if setting policy with this module, you *must* set state as well (i.e. enforcing, permissive or disabled) [1]. The generated ansible for setting policy does not include the 'state' parameter to the ansible selinux module, which causes ansible to error out. Version-Release number of selected component (if applicable): scap-security-guide-0.1.36-9.el7_5.noarch How reproducible: Always Steps to Reproduce: 1. Generate Ansible for remediation, for example: oscap xccdf generate fix --fix-type ansible --profile xccdf_org.ssgproject.content_profile_stig-rhel7-disa --output stig-rhel7-role.yml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 2. Apply the offending control: ansible-playbook -b -c local -i localhost, --tags selinux_policytype stig-rhel7-role.yml Actual results: Ansible playbook fails with: fatal: [localhost]: FAILED! => {"changed": false, "msg": "missing required arguments: state"} Expected results: Successfully set SELinux state Additional info: This was fixed upstream. Upstream it was changed to NOT use the ansible 'selinux' module for both the 'var_selinux_state' and 'var_selinux_policy_name'. Upstream changed instead use the 'lineinfile' module and to modify the values in /etc/sysconfig/selinux. Upstream commit db2622612eea33095ee42a448a4e7c6cc4f30ac6 [2] in pull request 2451 [3] makes these changes. These fixes were released as part of SCAP Security Guide 0.1.37 [4]. [1] Ansible docs for selinux module - https://docs.ansible.com/ansible/2.4/selinux_module.html [2] Upstream commit db26226 - https://github.com/OpenSCAP/scap-security-guide/commit/db2622612eea33095ee42a448a4e7c6cc4f30ac6 [3] Upstream PR2451 - https://github.com/OpenSCAP/scap-security-guide/pull/2451 [4] SCAP Security Guide v0.1.37 release notes - https://github.com/OpenSCAP/scap-security-guide/releases/tag/v0.1.37