Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1404392 - SCAP Security Guide false positives when scanning Docker containers
SCAP Security Guide false positives when scanning Docker containers
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide (Show other bugs)
7.4
All Unspecified
medium Severity high
: rc
: ---
Assigned To: Watson Yuuma Sato
Matus Marhefka
Mirek Jahoda
:
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2016-12-13 13:08 EST by Martin Preisler
Modified: 2017-08-04 09:11 EDT (History)
3 users (show)

See Also:
Fixed In Version: scap-security-guide-0.1.32-1.el7
Doc Type: Enhancement
Doc Text:
_scap-security-guide_ and *oscap-docker* now support containers The user can now use the *oscap-docker* utility and the SCAP Security Guide to assess compliance of container or container image without encountering false positive results. Tests that make no sense in container context, such as partitioning, has been set to the `not applicable` value, and containers can be now scanned with a selected security policy.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 08:24:43 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2064 normal SHIPPED_LIVE scap-security-guide bug fix and enhancement update 2017-08-01 12:05:50 EDT

  None (edit)
Description Martin Preisler 2016-12-13 13:08:05 EST 
Description of problem:
SCAP Security Guide has a bunch of security compliance profiles for RHEL7 - PCI-DSS, STIG, OSPP are the most important ones. These profiles were created with bare-metal and virtual machines in mind. They contain rules such as:

- Ensure /home Located On Separate Partition
- Ensure /tmp Located On Separate Partition
- ...
- Kernel Runtime Parameter "kernel.exec-shield" Check
- Kernel Runtime Parameter IPv6 Check
- ...

These rules make perfect sense on bare-metal machines or VMs but they make no sense in docker images. These should return "notapplicable" instead of "fail" when scanning container images using oscap-docker.

Version-Release number of selected component (if applicable):
0.1.30
0.1.31

How reproducible:
Always

Steps to Reproduce:
1. yum install openscap-utils atomic scap-security-guide
2. oscap-docker image $IMAGE_ID xccdf eval --profile $PROFILE /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Actual results:
Failures for rules that don't make sense in container images

Expected results:
Pass and fail for "universal" rules. "notapplicable" for rules that only make sense outside containers.

Additional info:
Comment 6 errata-xmlrpc 2017-08-01 08:24:43 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2064
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.