Bug 1657701
| Summary: | PCI DSS - Ensure Log Files Are Owned By Appropriate Group - checks group_id with 4 instead of 0 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ravindra Patil <ravpatil> |
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> |
| Status: | CLOSED ERRATA | QA Contact: | Jan Černý <jcerny> |
| Severity: | urgent | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.6 | CC: | b.prins, jcerny, mhaicman, openscap-maint, rmetrich |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | scap-security-guide-0.1.43-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:04:08 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hello, Yes, this is a bug in SSG-0.1.40. This bug is already fixed upstream (https://github.com/ComplianceAsCode/content/pull/3126/commits/c2effd951187a7e3525b3c88759d9893dd4cdd83) and already released in SSG-0.1.41. As I noted that PCI-DSS profile needs to select a value for 'file_owner_logfiles_value', I'm moving this back to NEW. Actually, there is already a patch that selects default value for 'file_owner_logfiles_value': https://github.com/ComplianceAsCode/content/pull/3665/commits/b032fc0c9ff2dcae799f5e0a0aaa49178f206d4c *** Bug 1673935 has been marked as a duplicate of this bug. *** Granting devel ack because it's fixed by rebase to 0.1.43 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2198 |
Description of problem: The rule set under OpenSCAP profile 'xccdf_org.ssgproject.content_profile_pci-dss' below is checking group_id with 4 instead of 0 (root). So the rule is failing even if group_id is set as expected. <ns4:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1"> <ns4:type operation="equals">regular</ns4:type> <ns4:group_id datatype="int">4</ns4:group_id> <<< ### 4 and not 0 </ns4:file_state> <ns4:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1"> <ns4:type operation="equals">regular</ns4:type> <ns4:user_id datatype="int">0</ns4:user_id> Version-Release number of selected component (if applicable): openscap-1.2.10-3.el7_3.x86_64 How reproducible: Run the report to check group ownership on all rsyslog log files as follows. Steps to Reproduce: 1. Install scap-security-guide package 2. Set owner and group as root.root for all rsyslog log files 3. Run rule to check group ownership of root files Actual results: Rule fails, as it expects group_id to be 4 instead of 0. Expected results: Rule should pass, as group is set as root for all the files. The rule should check group_id to be '0' and not '4'. Additional info: