+++ This bug was initially created as a clone of Bug #1754550 +++ Description of problem: Some audit rules are erroring when remediating machine to PCI-DSS profile. List of rules: xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday xccdf_org.ssgproject.content_rule_audit_rules_time_stime xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init xccdf_org.ssgproject.content_rule_audit_rules_login_events xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification xccdf_org.ssgproject.content_rule_audit_rules_media_export Version-Release number of selected component (if applicable): scap-security-guide-0.1.46-1.el8.noarch How reproducible: 100% Steps to Reproduce: 1. Remediate RHEL 8.1 machine with openscap: `oscap xccdf eval --remediate --profile pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml` Actual results: Audit rules are erroring. Expected results: Audit rules are passing/fixed. Additional info: Output from the remediation: Fix execution completed and returned: 0 sed: can't read : No such file or directory /tmp/oscap.z3ROMP/fix-XXASOJzI: line 227: : No such file or directory sed: can't read : No such file or directory /tmp/oscap.z3ROMP/fix-XXASOJzI: line 227: : No such file or directory Failed to verify applied fix: Checking engine returns: fail
Following PR fixes one of the issues in the shared/bash_remediation_functions/fix_audit_syscall_rule.sh: https://github.com/ComplianceAsCode/content/pull/4791
PR https://github.com/ComplianceAsCode/content/pull/4886 fixes rule: xccdf_org.ssgproject.content_rule_audit_rules_login_events
PR https://github.com/ComplianceAsCode/content/pull/4888 fixes evaluation of rule: xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification Which started to fail with merge of https://github.com/ComplianceAsCode/content/pull/4791
This PR is also important to fix the audit bash functions: https://github.com/ComplianceAsCode/content/pull/4881
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1583