Bug 1404392 - SCAP Security Guide false positives when scanning Docker containers
Summary: SCAP Security Guide false positives when scanning Docker containers
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide   
(Show other bugs)
Version: 7.4
Hardware: All
OS: Unspecified
medium
high
Target Milestone: rc
: ---
Assignee: Watson Yuuma Sato
QA Contact: Matus Marhefka
Mirek Jahoda
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-12-13 18:08 UTC by Martin Preisler
Modified: 2017-08-04 13:11 UTC (History)
3 users (show)

Fixed In Version: scap-security-guide-0.1.32-1.el7
Doc Type: Enhancement
Doc Text:
_scap-security-guide_ and *oscap-docker* now support containers The user can now use the *oscap-docker* utility and the SCAP Security Guide to assess compliance of container or container image without encountering false positive results. Tests that make no sense in container context, such as partitioning, has been set to the `not applicable` value, and containers can be now scanned with a selected security policy.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 12:24:43 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2064 normal SHIPPED_LIVE scap-security-guide bug fix and enhancement update 2017-08-01 16:05:50 UTC

Description Martin Preisler 2016-12-13 18:08:05 UTC
Description of problem:
SCAP Security Guide has a bunch of security compliance profiles for RHEL7 - PCI-DSS, STIG, OSPP are the most important ones. These profiles were created with bare-metal and virtual machines in mind. They contain rules such as:

- Ensure /home Located On Separate Partition
- Ensure /tmp Located On Separate Partition
- ...
- Kernel Runtime Parameter "kernel.exec-shield" Check
- Kernel Runtime Parameter IPv6 Check
- ...

These rules make perfect sense on bare-metal machines or VMs but they make no sense in docker images. These should return "notapplicable" instead of "fail" when scanning container images using oscap-docker.

Version-Release number of selected component (if applicable):
0.1.30
0.1.31

How reproducible:
Always

Steps to Reproduce:
1. yum install openscap-utils atomic scap-security-guide
2. oscap-docker image $IMAGE_ID xccdf eval --profile $PROFILE /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Actual results:
Failures for rules that don't make sense in container images

Expected results:
Pass and fail for "universal" rules. "notapplicable" for rules that only make sense outside containers.

Additional info:

Comment 6 errata-xmlrpc 2017-08-01 12:24:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2064


Note You need to log in before you can comment on or make changes to this bug.