Bug 1658136

Summary:	Rule audit_rules_kernel_module_loading checks for syscalls finit and create, but does not mention or remediate accordingly
Product:	Red Hat Enterprise Linux 7	Reporter:	Watson Yuuma Sato <wsato>
Component:	scap-security-guide	Assignee:	Watson Yuuma Sato <wsato>
Status:	CLOSED ERRATA	QA Contact:	Matus Marhefka <mmarhefk>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.6	CC:	jcerny, mhaicman, openscap-maint, rmetrich, rmullett
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.43-1.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 13:04:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Watson Yuuma Sato 2018-12-11 10:39:05 UTC

Description of problem:
Rule audit_rules_kernel_module_loading fails to remediate.
The the rule was updated to also check for presence of audit rules for syscalls "finit" and "create", but the rule description doesn't mention such thing, and remediation is also not able to fix system to pass the updated check.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.40


How reproducible:
Always


Steps to Reproduce:
1. Scan with scap-security-guide-0.1.40 using a profile which contains rule audit_rules_kernel_module_loading
2. 
3.

Actual results:
Rule fails, and remediating rule doesn't bring system to compliance.

Expected results:
The remediation should bring system to compliance, and rule should pass.
The rule description should also be clear to what is being checked.

Additional info:

Comment 2 Watson Yuuma Sato 2018-12-11 10:46:56 UTC

A work around for this is to add manually the audit rules as follows: 
-a always,exit -F arch=32 -S init_module -S delete_module -S finit_module -S create_module -F key=modules
-a always,exit -F arch=64 -S init_module -S delete_module -S finit_module -S create_module -F key=modules

Comment 4 Watson Yuuma Sato 2018-12-11 10:54:29 UTC

Fix for rule description: https://github.com/ComplianceAsCode/content/pull/3213
Fix for rhel7 remediation: https://github.com/ComplianceAsCode/content/pull/3553
Fix for rhel6 remediation: https://github.com/ComplianceAsCode/content/pull/3624

Comment 5 Jan Černý 2019-03-07 08:21:05 UTC

Granting devel ack because it's fixed by rebase to 0.1.43.

Comment 8 Watson Yuuma Sato 2019-03-25 12:26:44 UTC

*** Bug 1691912 has been marked as a duplicate of this bug. ***

Comment 9 Matus Marhefka 2019-05-10 12:28:42 UTC

Verified for scap-security-guide-0.1.43-5.el7 by running upstream test scanarios:

INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_modprobe
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_rmmod
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script syscalls_multiple_per_arg.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script syscalls_one_per_line.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script syscalls_one_per_arg.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_insmod
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK

Comment 11 errata-xmlrpc 2019-08-06 13:04:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2198