Bug 2178740 - system account with uid >= 1000 is badly detected as user interactive account
Summary: system account with uid >= 1000 is badly detected as user interactive account
Keywords:
Status: MODIFIED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: scap-security-guide
Version: 8.7
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Marcus Burghardt
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks: 2228460 2228461
TreeView+ depends on / blocked
 
Reported: 2023-03-15 17:38 UTC by vharyan
Modified: 2023-08-14 11:22 UTC (History)
10 users (show)

Fixed In Version: scap-security-guide-0.1.69-1.el8
Doc Type: Enhancement
Doc Text:
Feature: Extend the criteria used for selecting interactive users in order to avoid special users without shell to be considered interactive users. Reason: Rules related to interactive users where considering any user with uid >= 1000 as interactive users. However, there are valid cases where users with uid >= 1000 have no interactive shell and therefore should not be considered interactive users. Result: All rules related to interactive users are aligned using the same criteria to identify interactive users in a system. These criteria are: - uid >= 1000 - except nobody and nfsnobody users - except users with /sbin/nologin shell
Clone Of:
: 2228460 2228461 (view as bug list)
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-151979 0 None None None 2023-03-15 17:40:46 UTC

Description vharyan 2023-03-15 17:38:41 UTC 
Description of problem:
system account with uid >= 1000 is badly detected as user interactive account


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.66-2.el8_7.noarch


Actual results:

in RHEL8's one, the check for "interactive users" relies only on DEFAULT_UID_MIN which is hardcoded to 1000.

But with Upstream code , it relies on both DEFAULT_UID_MIN but also shell being /sbin/nologin, additionally DEFAULT_UID_MIN is computed from the system's settings.


Expected results:

Openscap scan should consider DEFAULT_UID_MIN aswell as /sbin/nologin
Comment 1 Renaud Métrich 2023-03-16 07:50:46 UTC 
This is an issue for customers having service accounts with UID >= 1000.

Would it be possible to rebase RHEL8's scap-security-guide against Upstream one?
Or at least backport the create_interactive_users_list_object() macro (see shared/macros/10-oval.jinja)?
Note You need to log in before you can comment on or make changes to this bug.