Bug 2030966

Description of problem:

Bash scripts for remediations on grub2_slub_debug and poisoning doesn't work on RHEL 8 as expected.


The finding ID's tell to so things as,

    V-230277

"Configure RHEL 8 to enable page poisoning with the following commands:
$ sudo grubby --update-kernel=ALL --args=""page_poison=1""
Add or modify the following line in ""/etc/default/grub"" to ensure the configuration survives kernel updates:
GRUB_CMDLINE_LINUX=""page_poison=1"""

    V-230279

"Configure RHEL 8 to enable poisoning of SLUB/SLAB objects with the following commands:
$ sudo grubby --update-kernel=ALL --args=""slub_debug=P""
Add or modify the following line in ""/etc/default/grub"" to ensure the configuration survives kernel updates:
GRUB_CMDLINE_LINUX=""slub_debug=P"""

What I see the scripts are doing,

# rpm -qf /usr/share/scap-security-guide/bash/rhel8-script-stig.sh 
scap-security-guide-0.1.48-7.el8.noarch

In file /usr/share/scap-security-guide/bash/rhel8-script-stig.sh we see

###############################################################################
# BEGIN fix (160 / 217) for 'grub2_slub_debug_argument'
###############################################################################
(>&2 echo "Remediating rule 160/217: 'grub2_slub_debug_argument'")


#in later versions of rhel grub2-editenv is used
grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) slub_debug=P"

# END fix for 'grub2_slub_debug_argument'

###############################################################################
# BEGIN fix (161 / 217) for 'grub2_page_poison_argument'
###############################################################################
(>&2 echo "Remediating rule 161/217: 'grub2_page_poison_argument'")


#in later versions of rhel grub2-editenv is used
grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) page_poison=1"

# END fix for 'grub2_page_poison_argument'

So here I don't see they (remediations) are bothering about doing changes to actual config files of grub
to maintain persistent nature and just dealing with kernelopts in current grubenv.
If we install a new kernel the parameters will not be inherited and while using BLS even the current kernel
will not reflect them as the above script do not update the bootloader entries for BLS loader from where it
fetches the defaults for kernelopts!

Overall this isn't working on RHEL 8 as expected with BLS and even without BLS if we install a new kernel.
Version-Release number of selected component (if applicable):


How reproducible:

Always using STIG 


Steps to Reproduce:

   1. Install a RHEL 8 system ( default it will have BLS )
   2. Apply the things as below or how you prefer!

# oscap xccdf eval --profile stig --results /root/$(hostname)-RHEL-scap-report-pre.xml --remediate --cpe /usr/share/xml/scap/ssg/content/ssg-rhel8-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml > /root/fix_report_RHEL.txt
 
# oscap xccdf generate fix --profile stig --output /root/stig_fix_script_RHEL.sh /usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 

Looking at the /root/stig_fix_script_RHEL.sh fix script, it is using grub2-editenv to modify the /boot/grub2/grubenv file but the /etc/default/grub file is not getting modified.

Actual results:

It just adds the things to kernelopts which is temporary and this doesn't work to reflect with BLS loader or if a latest kernel is installed.

Expected results:

Shall work fine by making changes to the actual config files with BLS.

Additional info:

This works fine with RHEL 7 as they target actual config files,
https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-ospp.html#xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument

Filed for being specific on upstream as,
https://github.com/ComplianceAsCode/content/issues/7980

Got to know there is already a pull request to have grubby migrated for rest RHEL releases

https://github.com/ComplianceAsCode/content/pull/7931