Bug 2120978
| Summary: | audit_rules_usergroup_modification_shadow don't remediate existing audit rule | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Vojtech Polasek <vpolasek> | |
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milan Lysonek <mlysonek> | |
| Severity: | medium | Docs Contact: | Jan Fiala <jafiala> | |
| Priority: | unspecified | |||
| Version: | 9.1 | CC: | gfialova, ggasparb, matyc, mhaicman, mlysonek, openscap-maint, qe-baseos-security, vpolasek, wsato | |
| Target Milestone: | rc | Keywords: | AutoVerified, Triaged, ZStream | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | scap-security-guide-0.1.66-1.el9_1 | Doc Type: | Bug Fix | |
| Doc Text: |
.Scans and remediations correctly ignore SCAP Audit rules Audit key
Previously, Audit watch rules that were defined without an Audit key (`-k` or `-F` key) encountered the following problems:
* The rules were marked as non-compliant even if other parts of the rule were correct.
* Bash remediation fixed the path and permissions of the watch rule, but it did not add the Audit key correctly.
* Remediation sometimes did not fix the missing key, returning an `error` instead of a `fixed` value.
This affected the following rules:
* `audit_rules_login_events`
* `audit_rules_login_events_faillock`
* `audit_rules_login_events_lastlog`
* `audit_rules_login_events_tallylog`
* `audit_rules_usergroup_modification`
* `audit_rules_usergroup_modification_group`
* `audit_rules_usergroup_modification_gshadow`
* `audit_rules_usergroup_modification_opasswd`
* `audit_rules_usergroup_modification_passwd`
* `audit_rules_usergroup_modification_shadow`
* `audit_rules_time_watch_localtime`
* `audit_rules_mac_modification`
* `audit_rules_networkconfig_modification`
* `audit_rules_sysadmin_actions`
* `audit_rules_session_events`
* `audit_rules_sudoers`
* `audit_rules_sudoers_d`
With this update, the Audit key has been removed from checks and from Bash and Ansible remediations. As a result, inconsistencies caused by the key field during checking and remediating no longer occur, and auditors can choose these keys arbitrarily to make searching Audit logs easier.
|
Story Points: | --- | |
| Clone Of: | 2119356 | |||
| : | 2169441 2169442 (view as bug list) | Environment: | ||
| Last Closed: | 2023-11-27 15:18:47 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2119356, 2123367 | |||
| Bug Blocks: | 2169441, 2169442 | |||
|
Comment 2
Watson Yuuma Sato
2022-10-04 15:49:50 UTC
Fixed by means of z=stream inheritance without an erratum |