Bug 1719769

Summary: Bash remediation for configure_opensc_card_drivers and force_opensc_card_drivers fails to apply
Product: Red Hat Enterprise Linux 7 Reporter: Gabriel Gaspar Becker <ggasparb>
Component: scap-security-guideAssignee: Watson Yuuma Sato <wsato>
Status: CLOSED ERRATA QA Contact: Milan Lysonek <mlysonek>
Severity: medium Docs Contact: RaTasha Tillery-Smith <rtillery>
Priority: medium    
Version: 7.7CC: ggasparb, mhaicman, mlysonek, openscap-maint, rtillery, vpolasek
Target Milestone: rc   
Target Release: 7.8   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: scap-security-guide-0.1.45-2.el7 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-31 19:38:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Report from OAA installation with NCP (previous OSPP) profile none

Description Gabriel Gaspar Becker 2019-06-12 14:06:49 UTC 
Description of problem:
Bash remediation for both rules fail to apply,
configure_opensc_card_drivers and force_opensc_card_drivers

Description of problem:
When running a fresh installation of RHEL7.7 (RHEL-7.7-20190606.n.0) and selecting OSPP profile in Security Policy section, the rules configure_opensc_card_drivers and force_opensc_card_drivers fail to remediate and the rules state produced are "error".


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.43-12.el7.noarch.rpm

How reproducible:
100%

Steps to Reproduce:
1. Run fresh installation of RHEL7.7
2. Select OSPP profile in Security Policy section
3. Evaluate the HTML report and check that both rules (configure_opensc_card_drivers and force_opensc_card_drivers) have the status as "error"

Steps to Reproduce 2:
1. oscap xccdf eval --remediate --profile ospp --rule xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers /usr/share/xml/scap/ssg/ssg-rhel7-ds.xml
2. oscap xccdf eval --remediate --profile ospp --rule xccdf_org.ssgproject.content_rule_force_opensc_card_drivers /usr/share/xml/scap/ssg/ssg-rhel7-ds.xml

Actual results:
configure_opensc_card_drivers errors
force_opensc_card_drivers errors

Expected results:
configure_opensc_card_drivers passes
force_opensc_card_drivers passes


Additional info:
In RHEL7.7 the file (/etc/opensc*.conf) which holds the configuration checked by aforementioned rules doesn't have any default configuration and the remediation doesn't know how to handle missing values.
Comment 2 Gabriel Gaspar Becker 2019-06-12 14:09:59 UTC 
Fixed upstream: https://github.com/ComplianceAsCode/content/pull/4377
Comment 4 Watson Yuuma Sato 2019-08-15 15:24:06 UTC 
Fixed by rebase to 0.1.45.
Comment 6 Milan Lysonek 2019-09-24 09:06:57 UTC 
Created attachment 1618539 [details]
Report from OAA installation with NCP (previous OSPP) profile
Comment 7 Milan Lysonek 2019-09-24 09:16:49 UTC 
Verified for scap-security-guide-0.1.46-1.el7.
Tested on fresh RHEL 7.8 installation using OAA with NCP profile (old OSPP profile contains configure_opensc_card_drivers and force_opensc_card_drivers, new OSPP doesn't) and both rules are passing - see attached html report (comment 6). After installation both rules were verified also with "oscap xccdf eval" and they pass.
Comment 9 errata-xmlrpc 2020-03-31 19:38:15 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1019