Hide Forgot
Description of problem: The rule set under OpenSCAP profile 'xccdf_org.ssgproject.content_profile_pci-dss' below is checking group_id with 4 instead of 0 (root). So the rule is failing even if group_id is set as expected. <ns4:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1"> <ns4:type operation="equals">regular</ns4:type> <ns4:group_id datatype="int">4</ns4:group_id> <<< ### 4 and not 0 </ns4:file_state> <ns4:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1"> <ns4:type operation="equals">regular</ns4:type> <ns4:user_id datatype="int">0</ns4:user_id> Version-Release number of selected component (if applicable): openscap-1.2.10-3.el7_3.x86_64 How reproducible: Run the report to check group ownership on all rsyslog log files as follows. Steps to Reproduce: 1. Install scap-security-guide package 2. Set owner and group as root.root for all rsyslog log files 3. Run rule to check group ownership of root files Actual results: Rule fails, as it expects group_id to be 4 instead of 0. Expected results: Rule should pass, as group is set as root for all the files. The rule should check group_id to be '0' and not '4'. Additional info:
Hello, Yes, this is a bug in SSG-0.1.40. This bug is already fixed upstream (https://github.com/ComplianceAsCode/content/pull/3126/commits/c2effd951187a7e3525b3c88759d9893dd4cdd83) and already released in SSG-0.1.41.
As I noted that PCI-DSS profile needs to select a value for 'file_owner_logfiles_value', I'm moving this back to NEW.
Actually, there is already a patch that selects default value for 'file_owner_logfiles_value': https://github.com/ComplianceAsCode/content/pull/3665/commits/b032fc0c9ff2dcae799f5e0a0aaa49178f206d4c
*** Bug 1673935 has been marked as a duplicate of this bug. ***
Granting devel ack because it's fixed by rebase to 0.1.43
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2198