Bug 1987231
| Summary: | Rule grub2_uefi_password fails detect that password was set | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Jan Pazdziora (Red Hat) <jpazdziora> |
| Component: | scap-security-guide | Assignee: | Watson Yuuma Sato <wsato> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Matus Marhefka <mmarhefk> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.0 | CC: | fmartine, ggasparb, jjaburek, jpazdziora, matyc, mhaicman, vpolasek |
| Target Milestone: | beta | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | scap-security-guide-0.1.57-3.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-12-07 21:42:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jan Pazdziora (Red Hat)
2021-07-29 09:23:21 UTC
This rule doesn't have a remediation since it means it would have to set a password. Fair point. However the rule currently also fails to detect when RHEL 9 is provisioned with kickstart saying bootloader --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 pti=on vsyscall=none" --iscrypted --password=grub.pbkdf2.sha512.10000.3A8BA0AB351ADA8FAD49BC54A8730AD53F67EA1762E99DF4881FD2FF9CD2A361623DB0AA6FF31A8C0E9731EB60ACA8AE7B2E870BE5D2B9E2CA7DE2EC2A013B3D.4161020F9952809D4F0BF6E0B40795283673769E869B74C52EF2FBFE751A5B0F2B149B409922D6EB1073ABEC531696F92AA8B8A5A7CA2F575D3BBBDA0BFC1A98 which seems to put the value to # cat /boot/grub2/user.cfg GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.3A8BA0AB351ADA8FAD49BC54A8730AD53F67EA1762E99DF4881FD2FF9CD2A361623DB0AA6FF31A8C0E9731EB60ACA8AE7B2E870BE5D2B9E2CA7DE2EC2A013B3D.4161020F9952809D4F0BF6E0B40795283673769E869B74C52EF2FBFE751A5B0F2B149B409922D6EB1073ABEC531696F92AA8B8A5A7CA2F575D3BBBDA0BFC1A98 Would you like a separate bugzilla for that, or can we turn this one without the --remediate part? As mentioned in comment 3, not having remediation is fine ... but on RHEL 9 the rule does not seem to correctly detect that the password has been set via the kickstart. Would you like a separate bugzilla for that, or can we turn this one into the failing evaluation (no --remediate)? The Description text of the xccdf_org.ssgproject.content_rule_grub2_uefi_password still seems wrong. It says
Once the superuser password has been added, update the grub.cfg file by running:
grub2-mkconfig -o /boot/grub2/grub.cfg
However, that does not seem to be needed at all, at least per https://access.redhat.com/solutions/4575381 and per testing the behaviour on both RHEL 8 and RHEL 9 where the password_pbkdf2 root ${GRUB2_PASSWORD} is there always, just wrapped in
if [ -f ${prefix}/user.cfg ]; then
source ${prefix}/user.cfg
if [ -n "${GRUB2_PASSWORD}" ]; then
set superusers="root"
export superusers
password_pbkdf2 root ${GRUB2_PASSWORD}
fi
fi
Would you like separate bugzilla for getting that Description fixed, or would you prefer to address it via this bugzilla?
|