Bug 2152208

Summary:	The stig rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication fails due to space in in the "timestamp_timeout" value
Product:	Red Hat Enterprise Linux 8	Reporter:	Ameya Patil <amepatil>
Component:	scap-security-guide	Assignee:	Vojtech Polasek <vpolasek>
Status:	CLOSED ERRATA	QA Contact:	Jiri Jaburek <jjaburek>
Severity:	medium	Docs Contact:	Jan Fiala <jafiala>
Priority:	medium
Version:	8.7	CC:	ggasparb, jafiala, jjaburek, mhaicman, mlysonek, peter.vreman, rmetrich, vpolasek, wsato
Target Milestone:	rc	Keywords:	AutoVerified, Triaged, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.66-1.el8	Doc Type:	Bug Fix
Doc Text:	.The `sudo_require_reauthentication` SCAP Security Guide rule accepts correct spacing in `sudoers` Previously, a bug in the checking of the `xccdf_org.ssgproject.content_rule_sudo_require_reauthentication` rule caused it to require specific spacing between the `timestamp_timeout` key and its value in the `/etc/sudoers` file and the `/etc/sudoers.d` directory. Consequently, valid and compliant syntax caused the rule to fail incorrectly. With this update, the check for `xccdf_org.ssgproject.content_rule_sudo_require_reauthentication` has been updated to accept blank spaces around the equal sign. As a result, the rule accepts correct and compliant definitions of `timestamp_timeout` with any of the following spacing formats: * `Defaults timestamp_timeout = 5` * `Defaults timestamp_timeout= 5` * `Defaults timestamp_timeout =5` * `Defaults timestamp_timeout=5`	Story Points:	---
Clone Of:
Clones:	2168066 2168067 2168068 (view as bug list)		Environment:
Last Closed:	2023-05-16 08:39:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2168066, 2168067, 2168068

Description Ameya Patil 2022-12-09 18:41:29 UTC

Description of problem:

One of our customer observed that as part of stig scan , the scap rule - xccdf_org.ssgproject.content_rule_sudo_require_reauthentication which is used to check if value of "Default timestamp_timeout" is set or not , fails when there is a space character in between the value

For example the rules fails when there is a space around the "timestamp_timeout=value"

Fails:       Defaults timestamp_timeout = 1
Fails:       Defaults timestamp_timeout= 1
Passes:      Defaults timestamp_timeout=1

I tested and found that visudo is able to parse this in all three scenarios and also verified that all three scenarios the sudo does work with the configured value.

Due to this, the rule should be able to Pass in in all three scenarios.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.63-4.el8.noarch

How reproducible:
Everytime

Steps to Reproduce:

1. Edit /etc/sudoers files and add a line "Defaults timestamp_timeout = 1" i.e. space around the "=" sign and run the oscap scan and it will fail.

~~~
# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout
Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
Ident   CCE-87838-9
Result  fail
~~~

2. Now change the visudo file so there is no spaces around "=" i.e. "timestamp_timeout=1" and run the oscap scan for this rule and it will pass.
~~~
# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout
Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
Ident   CCE-87838-9
Result  pass
~~~


Actual results:
The scan fails when there is space between key/value pair for timestamp_timeout

Expected results:
The scan should pass even when there is space around the timestamp_timeout as visudo parses it correctly and sudo also behaves correctly in this cases.


Additional info:

Comment 2 Watson Yuuma Sato 2022-12-12 15:36:18 UTC

Moving to post: https://github.com/ComplianceAsCode/content/pull/9923

Comment 19 errata-xmlrpc 2023-05-16 08:39:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2869