Description of problem:
The rule set under OpenSCAP profile 'xccdf_org.ssgproject.content_profile_pci-dss' below is checking group_id with 4 instead of 0 (root). So the rule is failing even if group_id is set as expected.
<ns4:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
<ns4:group_id datatype="int">4</ns4:group_id> <<< ### 4 and not 0
<ns4:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
Version-Release number of selected component (if applicable):
Run the report to check group ownership on all rsyslog log files as follows.
Steps to Reproduce:
1. Install scap-security-guide package
2. Set owner and group as root.root for all rsyslog log files
3. Run rule to check group ownership of root files
Rule fails, as it expects group_id to be 4 instead of 0.
Rule should pass, as group is set as root for all the files. The rule should check group_id to be '0' and not '4'.
Yes, this is a bug in SSG-0.1.40.
This bug is already fixed upstream (https://github.com/ComplianceAsCode/content/pull/3126/commits/c2effd951187a7e3525b3c88759d9893dd4cdd83) and already released in SSG-0.1.41.
As I noted that PCI-DSS profile needs to select a value for 'file_owner_logfiles_value', I'm moving this back to NEW.
Actually, there is already a patch that selects default value for 'file_owner_logfiles_value': https://github.com/ComplianceAsCode/content/pull/3665/commits/b032fc0c9ff2dcae799f5e0a0aaa49178f206d4c
*** Bug 1673935 has been marked as a duplicate of this bug. ***
Granting devel ack because it's fixed by rebase to 0.1.43
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.