Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
I have copied the the 30-pci-dss-v31.rules in the /etc/audit/rules.d/ and rebuild the audit rules.
The SCAP report for pci-dss fails on missing many audit rules.
For example the 2 rules below:
- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr
- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir
For the OSPP the provided rules in /usr/share/audit/sample-rules where enough to Pass all the Audit check of the OSPP SCAP run.
I expected the same for PCI-DSS SCAP report, just copy the 30-pci-dss-v31.rules to the /etc/audit/rules.d/ and all Audit rules tests are getting Passed.
Version-Release number of selected component (if applicable):
How reproducible:
Always
Steps to Reproduce:
- Copy usr/share/audit/sample-rules/30-pci-dss-v31.rules and the surround boiler plate 10-base-config and 99-finalize to /etc/audit/rules.d
- Run augenrules
- Run scap for pcidss
/usr/bin/oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss -
-results-arf /var/tmp/compliance-report-pci-dss.xml /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
usr/bin/oscap xccdf generate report /var/tmp/compliance-report-pci-dss.xml
Results:
- Many failing SCAP tests on Audit
Expectation
- Audit tests in SCAP report are Passed
Additional info:
More info in case.
The way the audit rules are intended to be used is to switch out the 30-xx rule to be compliant with the given security standard. Note that PCI-DSS changes every couple of years. I don't think the audit PCI rules have been looked at in 5 or 6 years.
I just looked at PCI-DSS v4. The language is different in some spots which in turn changes some of what the audit system should be gathering. I think a new 30-pci-dss-v4.rules should be created which would be intended to meet v4. I think v31 should be left alone since it is still correct to the 3.1->3.2.1 era of audit requirements.
Summary:
When creating OSPP security profile (common criteria) e.g. for RHEL 8, currently there are two working ways on how to configure audit in accordance with this profile:
1. Use the SCAP content provided by scap-security-guide, which creates files in the rules.d directory with predefined content
2. Use the files from /usr/share/audit/sample-rules
The reason why this approach is not feasible in the first place is that any change introduced to one of the mentioned components needs to be propagated to the other one. Otherwise, we are not in sync. But there are other reasons as well described in https://docs.google.com/document/d/13IGJHLT3gPPfbPro5KGGXfCyLCvHyh9JUGpMbXPbf94/edit?usp=sharing
This request(bz) is mostly to provide users only one single source of truth for Audit rules for all SCAP profiles. With this in mind, we would like to mention this in the documentation:
* /usr/share/audit/example-rules files
* RHEL system administator guide and maybe some more
What do you think?