Bug 1687826

Summary:	Remediation of STIG DISA profile double audit rules
Product:	Red Hat Enterprise Linux 7	Reporter:	Watson Yuuma Sato <wsato>
Component:	scap-security-guide	Assignee:	Watson Yuuma Sato <wsato>
Status:	CLOSED ERRATA	QA Contact:	Jan Černý <jcerny>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.7	CC:	jcerny, mhaicman, openscap-maint, rmullett
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.43-2.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 13:04:20 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Watson Yuuma Sato 2019-03-12 12:59:04 UTC

Description of problem:


Version-Release number of selected component (if applicable):
Remediation of RHEL7 with stig-rhel7-disa profile using scap-security-guide-0.1.43 duplicates audit rules and causes "augenrules --load" to fail.

The duplication of audit rules occurs when remediation in online mode (with --remediate) and with generated bash fix (with generate fix).


How reproducible:
always

Steps to Reproduce:
1. oscap xccdf eval --remediate --profile stig-rhel7-disa --report report.html --oval-results --results results.xml ssg-rhel7-ds.xml
Or

2. oscap xccdf generate fix --output stig.sh --profile stig-rhel7-disa ./ssg-rhel7-ds.xml
3. ./stig.sh

Actual results:
Rules are duplicated with each remediation run.

Expected results:
No duplication of rules occur

Additional info:
It seems that rules "audit_rules_privileged_commands" and its individual rules "audit_rules_privileged_commands" are working fine. As test scenarios are passing.
Very likely some other rule remediation is breaking the audit rules, and causing them to be duplicated.

See also, https://github.com/ComplianceAsCode/content/issues/4104

Comment 2 Watson Yuuma Sato 2019-03-20 09:57:00 UTC

This patch should fix this: https://github.com/ComplianceAsCode/content/pull/4200

Comment 9 errata-xmlrpc 2019-08-06 13:04:20 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2198