RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1658136 - Rule audit_rules_kernel_module_loading checks for syscalls finit and create, but does not mention or remediate accordingly
Summary: Rule audit_rules_kernel_module_loading checks for syscalls finit and create, ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: scap-security-guide
Version: 7.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Watson Yuuma Sato
QA Contact: Matus Marhefka
URL:
Whiteboard:
: 1691912 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-12-11 10:39 UTC by Watson Yuuma Sato
Modified: 2022-03-13 16:26 UTC (History)
5 users (show)

Fixed In Version: scap-security-guide-0.1.43-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-06 13:04:08 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:2198 0 None None None 2019-08-06 13:04:20 UTC

Description Watson Yuuma Sato 2018-12-11 10:39:05 UTC 
Description of problem:
Rule audit_rules_kernel_module_loading fails to remediate.
The the rule was updated to also check for presence of audit rules for syscalls "finit" and "create", but the rule description doesn't mention such thing, and remediation is also not able to fix system to pass the updated check.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.40


How reproducible:
Always


Steps to Reproduce:
1. Scan with scap-security-guide-0.1.40 using a profile which contains rule audit_rules_kernel_module_loading
2. 
3.

Actual results:
Rule fails, and remediating rule doesn't bring system to compliance.

Expected results:
The remediation should bring system to compliance, and rule should pass.
The rule description should also be clear to what is being checked.

Additional info:
Comment 2 Watson Yuuma Sato 2018-12-11 10:46:56 UTC 
A work around for this is to add manually the audit rules as follows: 
-a always,exit -F arch=32 -S init_module -S delete_module -S finit_module -S create_module -F key=modules
-a always,exit -F arch=64 -S init_module -S delete_module -S finit_module -S create_module -F key=modules
Comment 4 Watson Yuuma Sato 2018-12-11 10:54:29 UTC 
Fix for rule description: https://github.com/ComplianceAsCode/content/pull/3213
Fix for rhel7 remediation: https://github.com/ComplianceAsCode/content/pull/3553
Fix for rhel6 remediation: https://github.com/ComplianceAsCode/content/pull/3624
Comment 5 Jan Černý 2019-03-07 08:21:05 UTC 
Granting devel ack because it's fixed by rebase to 0.1.43.
Comment 8 Watson Yuuma Sato 2019-03-25 12:26:44 UTC 
*** Bug 1691912 has been marked as a duplicate of this bug. ***
Comment 9 Matus Marhefka 2019-05-10 12:28:42 UTC 
Verified for scap-security-guide-0.1.43-5.el7 by running upstream test scanarios:

INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_modprobe
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_rmmod
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
INFO - Script syscalls_multiple_per_arg.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script syscalls_one_per_line.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script syscalls_one_per_arg.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_insmod
INFO - Script default.fail.sh using profile xccdf_org.ssgproject.content_profile_ospp OK
Comment 11 errata-xmlrpc 2019-08-06 13:04:08 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2198
Note You need to log in before you can comment on or make changes to this bug.