Bug 1657701 - PCI DSS - Ensure Log Files Are Owned By Appropriate Group - checks group_id with 4 instead of 0
Summary: PCI DSS - Ensure Log Files Are Owned By Appropriate Group - checks group_id w...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide
Version: 7.6
Hardware: x86_64
OS: Linux
medium
urgent
Target Milestone: rc
: ---
Assignee: Watson Yuuma Sato
QA Contact: Jan Černý
URL:
Whiteboard:
: 1673935 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-10 10:06 UTC by Ravindra Patil
Modified: 2020-01-08 12:59 UTC (History)
5 users (show)

Fixed In Version: scap-security-guide-0.1.43-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 13:04:08 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2198 None None None 2019-08-06 13:04:20 UTC

Description Ravindra Patil 2018-12-10 10:06:55 UTC
Description of problem:

The rule set under OpenSCAP profile 'xccdf_org.ssgproject.content_profile_pci-dss' below is checking group_id with 4 instead of 0 (root). So the rule is failing even if group_id is set as expected.

<ns4:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
          <ns4:type operation="equals">regular</ns4:type>
          <ns4:group_id datatype="int">4</ns4:group_id>      <<< ### 4 and not 0
        </ns4:file_state>
        <ns4:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
          <ns4:type operation="equals">regular</ns4:type>
          <ns4:user_id datatype="int">0</ns4:user_id>

Version-Release number of selected component (if applicable):
openscap-1.2.10-3.el7_3.x86_64

How reproducible:
Run the report to check group ownership on all rsyslog log files as follows.


Steps to Reproduce:
1. Install scap-security-guide package
2. Set owner and group as root.root for all rsyslog log files
3. Run rule to check group ownership of root files

Actual results:
Rule fails, as it expects group_id to be 4 instead of 0.

Expected results:
Rule should pass, as group is set as root for all the files. The rule should check group_id to be '0' and not '4'.

Additional info:

Comment 2 Watson Yuuma Sato 2018-12-10 16:32:54 UTC
Hello,

Yes, this is a bug in SSG-0.1.40.
This bug is already fixed upstream (https://github.com/ComplianceAsCode/content/pull/3126/commits/c2effd951187a7e3525b3c88759d9893dd4cdd83) and already released in SSG-0.1.41.

Comment 4 Watson Yuuma Sato 2018-12-10 16:52:57 UTC
As I noted that PCI-DSS profile needs to select a value for 'file_owner_logfiles_value', I'm moving this back to NEW.

Comment 5 Watson Yuuma Sato 2019-01-08 17:34:49 UTC
Actually, there is already a patch that selects default value for 'file_owner_logfiles_value': https://github.com/ComplianceAsCode/content/pull/3665/commits/b032fc0c9ff2dcae799f5e0a0aaa49178f206d4c

Comment 6 Watson Yuuma Sato 2019-02-11 09:11:27 UTC
*** Bug 1673935 has been marked as a duplicate of this bug. ***

Comment 7 Jan Černý 2019-03-07 08:49:15 UTC
Granting devel ack because it's fixed by rebase to 0.1.43

Comment 12 errata-xmlrpc 2019-08-06 13:04:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2198


Note You need to log in before you can comment on or make changes to this bug.