Bug 2178740

Summary:	system account with uid >= 1000 is badly detected as user interactive account
Product:	Red Hat Enterprise Linux 8	Reporter:	vharyan
Component:	scap-security-guide	Assignee:	Marcus Burghardt <maburgha>
Status:	MODIFIED ---	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.7	CC:	ggasparb, jcerny, jjaburek, maburgha, mhaicman, mlysonek, peter.vreman, rmetrich, vpolasek, wsato
Target Milestone:	rc	Keywords:	AutoVerified, Triaged, ZStream
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	scap-security-guide-0.1.69-1.el8	Doc Type:	Enhancement
Doc Text:	Feature: Extend the criteria used for selecting interactive users in order to avoid special users without shell to be considered interactive users. Reason: Rules related to interactive users where considering any user with uid >= 1000 as interactive users. However, there are valid cases where users with uid >= 1000 have no interactive shell and therefore should not be considered interactive users. Result: All rules related to interactive users are aligned using the same criteria to identify interactive users in a system. These criteria are: - uid >= 1000 - except nobody and nfsnobody users - except users with /sbin/nologin shell	Story Points:	---
Clone Of:
Clones:	2228460 2228461 (view as bug list)		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2228460, 2228461

Description vharyan 2023-03-15 17:38:41 UTC

Description of problem:
system account with uid >= 1000 is badly detected as user interactive account


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.66-2.el8_7.noarch


Actual results:

in RHEL8's one, the check for "interactive users" relies only on DEFAULT_UID_MIN which is hardcoded to 1000.

But with Upstream code , it relies on both DEFAULT_UID_MIN but also shell being /sbin/nologin, additionally DEFAULT_UID_MIN is computed from the system's settings.


Expected results:

Openscap scan should consider DEFAULT_UID_MIN aswell as /sbin/nologin

Comment 1 Renaud Métrich 2023-03-16 07:50:46 UTC

This is an issue for customers having service accounts with UID >= 1000.

Would it be possible to rebase RHEL8's scap-security-guide against Upstream one?
Or at least backport the create_interactive_users_list_object() macro (see shared/macros/10-oval.jinja)?