Created attachment 1584527 [details]
tailoring file for this oscap command

Description of problem:
False negatives are produced for the following rules:
xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
xccdf_org.ssgproject.content_rule_audit_rules_login_events
CCE-27129-6
CCE-27204-7

Version-Release number of selected component (if applicable):
scap-security-guide-0.1.40-13

How reproducible:
Easily

Steps to Reproduce:
1. Add rules to /etc/audit/rules.d/*.rules as needed per CCE. Restart machine to take effect

2. Run oscap against the tailoring file provided in the attachments as follows:
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_C2S --tailoring-file ./ssg-rhel7-ds-tailoring_SE.xml --results results_file.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml  > oscap-out.log

Actual results:
grep -A 1 -B 2 -E "CCE-27204-7|CCE-27129-6" oscap-out.log
Title   Ensure auditd Collects Information on Kernel Module Loading and Unloading
Rule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
Ident   CCE-27129-6
Result  fail
--
Title   Record Attempts to Alter Logon and Logout Events
Rule    xccdf_org.ssgproject.content_rule_audit_rules_login_events
Ident   CCE-27204-7
Result  fail



Expected results:
Title   Ensure auditd Collects Information on Kernel Module Loading and Unloading
Rule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading
Ident   CCE-27129-6
Result  pass
--
Title   Record Attempts to Alter Logon and Logout Events
Rule    xccdf_org.ssgproject.content_rule_audit_rules_login_events
Ident   CCE-27204-7
Result  pass


Additional info:
CCE-27204-7 seems to be an error with the documented remediation for this CCE.
Title   Record Attempts to Alter Logon and Logout Events
Rule    xccdf_org.ssgproject.content_rule_audit_rules_login_events
Ident   CCE-27204-7


The following audit rules are the documented resolve and will fail the scan:
-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins


The following audit rules will pass the scan:
-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins



CCE-27129-6 appears to be a problem with the fix_audit_syscall_rule function.
The function will return a 0 or 1 which determines the pass/fail of the CCE, and this function does not enter a case to change $retval to 1 if the rule exists.