Bug 1571319 – Rule audit_rules_kernel_module_loading does not remediate properly [rhel-7.5.z]

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1571319 - Rule audit_rules_kernel_module_loading does not remediate properly [rhel-7.5.z]

Summary:	Rule audit_rules_kernel_module_loading does not remediate properly [rhel-7.5.z]

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	scap-security-guide (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	rc
Target Release:	---
Assigned To:	Watson Yuuma Sato
QA Contact:	Marek Haicman
Docs Contact:	Mirek Jahoda

URL:
Whiteboard:
Keywords:	ZStream

Duplicates:	1572136 (view as bug list)
Depends On:	1547694
Blocks:
	Show dependency tree / graph

Reported:	2018-04-24 09:54 EDT by Oneata Mircea Teodor
Modified:	2018-05-14 12:13 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:	scap-security-guide-0.1.36-8.el7_5
Doc Type:	Bug Fix
Doc Text:	Due to a bug in remediation for the kernel_module_loading rule, the rule did not fix the system properly and subsequent scans of a remediated system failed. With this update, the remediation has been fixed to add audit rules for both 32- and 64-bit architectures when remediating a 64-bit system. As a result, remediated systems can now pass scans with kernel_module_loading.
Story Points:	---
Clone Of:	1547694
Environment:
Last Closed:	2018-05-14 12:13:49 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Knowledge Base (Solution)	3380131	None	None	None	2018-04-24 09:54 EDT
Red Hat Product Errata	RHBA-2018:1410	None	None	None	2018-05-14 12:13 EDT

Groups: None (edit)

Description Oneata Mircea Teodor 2018-04-24 09:54:22 EDT

This bug has been copied from bug #1547694 and has been proposed to be backported to 7.5 z-stream (EUS).

Comment 2 Oneata Mircea Teodor 2018-04-26 08:54:50 EDT

*** Bug 1572136 has been marked as a duplicate of this bug. ***

Comment 6 Marek Haicman 2018-04-30 05:13:06 EDT

Verified fix in version scap-security-guide-0.1.36-9.el7_5.noarch through SSG Test Suite on commit https://github.com/OpenSCAP/scap-security-guide/commit/04ddc39b88f5756bf078b28b78fe11226096b438

NEW (scap-security-guide-0.1.36-9.el7_5.noarch):
[dahaic@machine tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-rhel7 --datastream ./ssg-7.5.1-2.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml audit_rules_kernel_module_loading
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
<snip>

OLD (scap-security-guide-0.1.36-7.el7.noarch):
[dahaic@machine tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-rhel7 --datastream ./ssg-7.5.0.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml audit_rules_kernel_module_loading
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
ERROR - Scan has exited with return code 2, instead of expected 0 during stage remediation
ERROR - The remediation failed for rule 'xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading'.
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
<snip>

Comment 9 errata-xmlrpc 2018-05-14 12:13:49 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1410

Note You need to log in before you can comment on or make changes to this bug.