Bug 2055860

Summary:	configure_bashrc_exec_tmux now errors during remediation
Product:	Red Hat Enterprise Linux 8	Reporter:	Jan Pazdziora (Red Hat) <jpazdziora>
Component:	scap-security-guide	Assignee:	Gabriel Gaspar Becker <ggasparb>
Status:	CLOSED ERRATA	QA Contact:	Milan Lysonek <mlysonek>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.6	CC:	amusil, ggasparb, jpazdziora, mhaicman, mlysonek, wsato
Target Milestone:	rc	Keywords:	AutoVerified, Regression, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.60-5.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	2056847 (view as bug list)		Environment:
Last Closed:	2022-05-10 14:15:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2015796, 2015802, 2056847

Description Jan Pazdziora (Red Hat) 2022-02-17 20:02:55 UTC

Description of problem:

The configure_bashrc_exec_tmux rule of ospp profile now errors during remediation.

Version-Release number of selected component (if applicable):

scap-security-guide-0.1.60-3.el8

How reproducible:

Deterministic.

Steps to Reproduce:
1. dnf install -y /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
2. oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_ospp --rule xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Actual results:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title
	Support session locking with tmux
Rule
	xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux
Ident
	CCE-82266-8
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
Result
	fail


--- Starting Remediation ---

Title
	Support session locking with tmux
Rule
	xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux
Ident
	CCE-82266-8
Result
	error

Expected results:

WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title
	Support session locking with tmux
Rule
	xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux
Ident
	CCE-82266-8
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
Result
	fail


--- Starting Remediation ---

Title
	Support session locking with tmux
Rule
	xccdf_org.ssgproject.content_rule_configure_bashrc_exec_tmux
Ident
	CCE-82266-8
Result
	fixed

Additional info:

This is a regression against scap-security-guide-0.1.60-1.el8.

Comment 2 Vojtech Polasek 2022-02-21 10:06:07 UTC

Hello,
thank you for the BZ. The rule OVAL check has two parts which are connected with conjunction:
1. It checks for the correct snippet in either /etc/bashrc or /etc/profile.d/*. I guess this part passes after remediation.
2. It checks if a tmux process is running. I guess this part fails. This will be probably always reported as "error" because the Tmux process will just not get started. Someone has to log in so that their shell sources the particular snippet and starts tmux.
Two questions:
1. do you have tmux package installed?
2. Does the rule pass if you reboot and perform the scan again?
I am not sure if this has any simple fix because of the nature of checks.

Comment 3 Jan Pazdziora (Red Hat) 2022-02-21 10:48:54 UTC

1. No, tmux is not installed.
2. No, it does not pass after reboot either.

I must ask: why should tmux be running? It gets started when a user logs in ... why does compliance check (which might be run from a cron job for all we know) care if there is a user logged in or not?

Comment 8 Gabriel Gaspar Becker 2022-02-21 17:57:37 UTC

https://github.com/ComplianceAsCode/content/pull/8246

Comment 9 Jan Pazdziora (Red Hat) 2022-02-22 08:13:32 UTC

The same issue is on RHEL 9 now, filed bug 2056847.

Comment 19 errata-xmlrpc 2022-05-10 14:15:29 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1900