Bug 1946252

Summary:	Smartcards fail with STIG'd RH8.4 Beta
Product:	Red Hat Enterprise Linux 8	Reporter:	Mike Ralph <mralph>
Component:	scap-security-guide	Assignee:	Gabriel Gaspar Becker <ggasparb>
Status:	CLOSED ERRATA	QA Contact:	Milan Lysonek <mlysonek>
Severity:	high	Docs Contact:	Khushbu Borole <kborole>
Priority:	unspecified
Version:	8.4	CC:	awestbro, ekolesni, fdelehay, ggasparb, jafiala, matyc, mhaicman, mlysonek, rsroka, sveerank, vpolasek, wsato
Target Milestone:	beta	Keywords:	AutoVerified, Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.57-1.el8	Doc Type:	Bug Fix
Doc Text:	.USB devices now work correctly with the DISA STIG profile Previously, the DISA STIG profile enabled the `USBGuard` service but did not configure any initially connected USB devices. Consequently, the `USBGuard` service blocked any device that was not specifically allowed. This made some USB devices, such as smart cards, unreachable. With this update, the initial USBGuard configuration is generated when applying the DISA STIG profile and allows the use of any connected USB device. As a result, USB devices are not blocked and work correctly.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 18:43:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 4 Jakub Jelen 2021-04-07 09:37:15 UTC

It looks like the lsusb detects the reader correctly. The opensc looks like it can talk to the pcscs fine too, but the pcscd debug log does not mention the omnikey reader at all.

Grepping through the stig profile, I noticed there is usbguard configured as part of the process. Does it have some logs? Does stopping/disabling the usbguard helps?

Is it something new in the STIG profile or something that has changed in openscap? I will move it to the openscap anyway as it does not look like something that can be fixed inside of opensc.

Comment 17 Matěj Týč 2021-08-18 10:25:12 UTC

Fixed by https://github.com/ComplianceAsCode/content/pull/7105 which is already in 0.1.57

Comment 28 errata-xmlrpc 2021-11-09 18:43:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4265