Bug 1886037

Hello,
could you please attach html reports? Just add --report file.html to the command. I think I know what are the problems and if I am right, none of them is caused by our content.
Thank you.

Sure, I'll attach the results file for two different runs.

FWIW, you will see this one as well, I didn't mention this earlier since I had manually changed the setting already (and I'm not sure would this be safe to address automatically as you might lock yourself out):

Title   Set Default firewalld Zone for Incoming Packets
Rule    xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
Ident   CCE-80890-7
Result  fail

Thanks.

Created attachment 1720193 [details]
results-1.xml

Created attachment 1720194 [details]
results-2.xml

Thank you. One more thing, could you please during the run where the rule audit_rules_privileged_commands fails run it with following additional arguments?
--verbose DEVEL --verbose-log-file debug.log
and send me the debug log?
I am investigating the grub.cfg problem, it seems like problem with ordering.

Created attachment 1720224 [details]
results.xml.gz

Created attachment 1720225 [details]
debug.log.gz

Ok, attached results.xml and debug.log from a test run. Thanks.

Hello,
I have tried to reproduce your problem. I partially succeeded.
I managed to reproduce the problem with the Rule    xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg. The problem is similar to one with cron described at https://bugzilla.redhat.com/show_bug.cgi?id=1843913
The RPM package for grub2-pc expects /boot/grub2/grub.cfg to have permissions 644. This is ensured by the rule xccdf_org.ssgproject.content_rule_rpm_verify_permissions But the rule    xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg wants permissions 600. So one of these rules will unfortunately always fail. I am not sure if there is any real fix apart from documentation.
I did not manage to reproduce your problem with audit_rules_privileged_commands. From the debug log, it seems as there were no files within the /etc/audit/rules.d directory. Please what is the state of the /etc/audit directories and subdirectories after 1st/2nd/3rd run?
Thank you.

Created attachment 1720937 [details]
audit-dir.tar.gz

I attached a tarball containing /etc/audit contents after 1st/2nd/3rd run, prior the first run there was nothing except for the default configuration file from the audit package.

I am using a kickstart similar to https://github.com/myllynen/misc/blob/master/rhel-8-base.ks to install my test VM but without IPv6 disable and non-automatic partition table. Perhaps you could try out reproducing on your end by using that kickstart if still unclear what might be causing this?

Thanks.

After investigation, it seems that the problem lies in remediation of the rule audit_rules_privileged_commands. The rule uses this command to search for binaries:
find / -xdev -type f -perm -4000 -o -type f -perm -2000                      
And the -xdev option prevents the command from traversing into other file systems. But in this particular setup, the /usr folder is on a different file system. However, the OVAL check traverses LOCAL file systems. Because the remediation can't find any privileged executables in the root file system, it does not remediate anything and check fails. I will investigate possible fix. I believe we should be able to adapt to various partition layouts.

https://github.com/ComplianceAsCode/content/pull/6227

The audit_rules_privileged_commands rule passes in the CIS profile on RHEL 8.4. Closing as CURRENTRELEASE.