Bug 1829743

Summary:	Undocumented fact that file ownership-related rules dont work with remote user/group backends
Product:	Red Hat Enterprise Linux 7	Reporter:	Matěj Týč <matyc>
Component:	scap-security-guide	Assignee:	Vojtech Polasek <vpolasek>
Status:	CLOSED ERRATA	QA Contact:	Matus Marhefka <mmarhefk>
Severity:	medium	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	medium
Version:	7.8	CC:	ggasparb, mhaicman, mjahoda, vpolasek, wsato
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.49-5.el7	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 19:52:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matěj Týč 2020-04-30 09:04:47 UTC

Description of problem:

Rules

- xccdf_org.ssgproject.content_rule_file_permissions_ungroupowned
- xccdf_org.ssgproject.content_rule_no_files_unowned_by_user

may not work correctly if the system uses remote user/group backend s.a. LDAP.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.40-12.el7.noarch

Steps to Reproduce:

1. Scan a system where a remote user has their home directory

Actual results:

Scan will fail because of files in that directory, although they are legitimate.

Expected results:

Scan passes

Additional info:

Comment 2 Matěj Týč 2020-04-30 09:08:34 UTC

The OVAL language that is the language behind checks in SCAP as of 4/2020 has no means how to query the system about remote groups that would work with appropriate LDAP configurations.
The only way how to address the issue right now is to document this limitation in the rule prose.

Comment 3 Matěj Týč 2020-04-30 09:10:09 UTC

https://github.com/ComplianceAsCode/content/pull/5657

Comment 18 errata-xmlrpc 2020-09-29 19:52:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3909