Bug 2172555

Summary: Check of network interfaces assignment in Firewalld zones fails when upgrading RHEL8 to RHEL9
Product: Red Hat Enterprise Linux 9 Reporter: Marcus Burghardt <maburgha>
Component: scap-security-guideAssignee: Marcus Burghardt <maburgha>
Status: CLOSED ERRATA QA Contact: Milan Lysonek <mlysonek>
Severity: low Docs Contact:
Priority: unspecified    
Version: 9.2CC: ggasparb, jcerny, jjaburek, mhaicman, mlysonek, openscap-maint, vpolasek
Target Milestone: rcKeywords: AutoVerified, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: scap-security-guide-0.1.69-1.el9 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-07 08:37:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marcus Burghardt 2023-02-22 14:15:06 UTC
Description of problem:

The firewalld_sshd_port_enabled rule was recently refactored[1] to ensure the SSH access is properly enabled in alignment to NetworkManager and Firewalld standards.

Part of the rule check is to ensure that all existing NICs are assigned to a Firewalld zone. This is accomplished by checking the NIC configuration files.

In RHEL8 the NIC settings are stored by default in "/etc/sysconfig/network-scripts". In RHEL9 the NIC settings are stored by default in "/etc/NetworkManager/system-connections". The check is consistent with this, looking in different directories according to the RHEL version.

For compatibility purposes, NetworkManager can work with both directories depending on how the NetworkManager plugins are defined in NetworkManager.conf file.

Therefore, in case a NIC is configured in both directories, one will have precedence over the other according to the order they are defined. This makes it hard to ensure the correct file is properly configured.

The issue in this BZ is specific for a scenario where the RHEL8, which uses ifcfg files, is upgraded to a RHEL9, which prefers NetworkManager keyfiles. During the upgrade, the ifcfg files are not migrated to keyfiles and this causes a false negative during the check because the check expects to find the keyfiles in a RHEL9 system.

- [1] https://github.com/ComplianceAsCode/content/pull/9712

Version-Release number of selected component (if applicable):
RHEL9
scap-security-guide-0.1.66

How reproducible:
Always

Steps to Reproduce:
1. Install a clean RHEL8 system
2. Upgrade the RHEL8 system to RHEL9
3. Scan the system for the firewalld_sshd_port_enabled rule, choosing to remediate if necessary:
4. oscap xccdf eval --remediate --profile stig --rule xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Actual results:
The scan after remediation fail.

Expected results:
The scan after remediation pass.

Additional info:

The initial scan will report fail because the expected NetworkManager keyfile is not found in RHEL9, then the remediation will be executed and the ifcfg file will be properly fixed honoring existing ifcfg file.
However, the scan after the remediation will return error because the keyfile was not found.

There is a NetworkManager command used to migrate legacy ifcfg files to keyfile format:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_and_managing_networking/assembly_manually-creating-networkmanager-profiles-in-keyfile-format_configuring-and-managing-networking#proc_migrating-networkmanager-profiles-from-ifcfg-to-keyfile-format_assembly_manually-creating-networkmanager-profiles-in-keyfile-format

However, this migration is not automatic during the system Upgrade neither during the remediation. On the remediation side, although recommended the migration to keyfile format in RHEL9, it is intentional to preserve desired standards defined by the administrators.

Comment 3 Jan Černý 2023-06-14 13:55:51 UTC
the https://github.com/ComplianceAsCode/content/pull/10330 has been merged upstream

Comment 13 errata-xmlrpc 2023-11-07 08:37:02 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6552