Hide Forgot
Description of problem: With this rule enforced, yum only installs packages from repositories with signed metadata. Red Hat currently does not provide such repositories, thus by enabling this option, machine effectively loses ability to update packages. From the security standpoint, this is bad thing. Proposal is to leave it failing, with notice for users explaining situation. Version-Release number of selected component (if applicable): scap-security-guide-0.1.33-5.el7.noarch How reproducible: reliably Steps to Reproduce: 1. perform remediation of rule_ensure_gpgcheck_repo_metadata 2. try to install something from Red Hat repository 3. Actual results: 1) is remedied 2) fails Expected results: 1) is not remedied, explanation is given that Red Hat does not support this right now 2) is successful Additional info: For context, see Bug 1360939
Note: this might prevent full profile remediation of profiles containing this rule (profile_stig-rhel7-disa)
This is already fixed upstream by https://github.com/OpenSCAP/scap-security-guide/pull/2189.
Verified in version scap-security-guide-0.1.36-7.el7 no remediation is performed OLD (scap-security-guide-0.1.33-6.el7): [dahaic@machine]$ oscap xccdf eval --fetch-remote-resources --rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata --profile xccdf_org.ssgproject.content_profile_stig-rhel7-disa --remediate 0.1.33-6/ssg-rhel7-ds.xml Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok Title Ensure gpgcheck Enabled for Repository Metadata Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata Ident CCE-80348-6 Result fail --- Starting Remediation --- Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok Title Ensure gpgcheck Enabled for Repository Metadata Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata Ident CCE-80348-6 Result error NEW (scap-security-guide-0.1.36-7.el7): [dahaic@machine]$ oscap xccdf eval --fetch-remote-resources --rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata --profile xccdf_org.ssgproject.content_profile_stig-rhel7-disa --remediate 0.1.36-7/ssg-rhel7-ds.xml Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok Title Ensure gpgcheck Enabled for Repository Metadata Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_repo_metadata Ident CCE-80348-6 Result fail --- Starting Remediation --- Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok [dahaic@machine]$
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0761