Bug 1465380 – auditd is not installed as part of remediation

Bug 1465380 - auditd is not installed as part of remediation

Summary:	auditd is not installed as part of remediation

Status:	NEW

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	scap-security-guide (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	rc
Target Release:	---
Assigned To:	Watson Yuuma Sato
QA Contact:	BaseOS QE Security Team
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-06-27 06:37 EDT by Marek Haicman
Modified:	2018-06-20 22:26 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Marek Haicman 2017-06-27 06:37:20 EDT

Description of problem:
Because of missing XCCDF rule checking whether auditd is installed, SCAP Security Guide cannot remediate it. This results in lots of failed rules after hardened installation.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.33-5.el7.noarch

How reproducible:
reliably

Steps to Reproduce:
either:
1. install system with selection of pci-dss
2. open datastream in scap-workbench and search within content_group_auditing for rule checking installation of the auditd
3.

Actual results:
1. machine is failing all audit-related rules
2. no rule checking for installation of package

Expected results:
1. machine has no failing audit-related rules
2. rule is present there (and enabled) for pci-dss profile

Additional info:

Comment 1 Marek Haicman 2017-06-27 07:09:51 EDT

Update: audit is installed by default, so the 1) scenario in description is not caused by this.

Comment 2 Marek Haicman 2017-06-27 08:20:50 EDT

Reason for 1) scenario is discussed in Bug 1465402

Note You need to log in before you can comment on or make changes to this bug.