Bug 1691877

Summary:	Remediation for xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands rule doesn't fix the system.
Product:	Red Hat Enterprise Linux 7	Reporter:	Ryan Mullett <rmullett>
Component:	scap-security-guide	Assignee:	Vojtech Polasek <vpolasek>
Status:	CLOSED ERRATA	QA Contact:	Matus Marhefka <mmarhefk>
Severity:	medium	Docs Contact:	Jan Fiala <jafiala>
Priority:	high
Version:	7.6	CC:	ggasparb, jafiala, janarula, jsenkyri, matyc, mhaicman, mmarhefk, openscap-maint, sadas, stefan.schwiedel, vpolasek, wsato
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.49-6.el7	Doc Type:	Bug Fix
Doc Text:	.`audit_rules_privileged_commands` now works correctly for privileged commands Remediation of the `audit_rules_privileged_commands` rule in the `scap-security-guide` packages did not account for a special case in parsing command names. Additionally, the ordering of certain rules prevented successful remediation. As a consequence, remediation of certain combinations of rules reported they were fixed although successive scans reported the rule as failing again. This update improves regular expressions in the rule and the ordering of the rules. As a result, all privileged commands are correctly audited after remediation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 19:52:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ryan Mullett 2019-03-22 17:40:27 UTC

Description of problem:
When remediating with C2S or DISA STIG the xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands rule will not properly recognize the remediation. During a scan it will still show as vulnerable even after the remediation script is run.

Version-Release number of selected component (if applicable):
openscap-1.2.17-2.el7.x86_64
openscap-scanner-1.2.17-2.el7.x86_64
scap-security-guide-0.1.40-12.el7.noarch

How reproducible:
Always

Steps to Reproduce:
1. Remediate/scan a system using openscap with C2S or DISA STIG

Actual results:
System shows fail for xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands even after running the remediation script

Expected results:
System will properly recognize that the audit rules were implemented by the STIG xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands

Additional info:

Comment 7 Watson Yuuma Sato 2019-08-15 17:59:53 UTC

This could actually be caused by the rule order in the benchmark.

If any package with privileged command is installed after xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands will fail.

Comment 9 Vojtech Polasek 2020-04-15 08:36:02 UTC

The fix affecting mentioned profiles is upstream at https://github.com/ComplianceAsCode/content/pull/5569

Comment 28 errata-xmlrpc 2020-09-29 19:52:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3909