ComplianceAsCode / ComplianceAsCode/content

Test for mount-options on `/tmp` are incomplete

Open
#11,184 2 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Remediation- and scan-profiles don't know how to deal with systems where `/tmp` is a pseudofilesystem (managed by the `tmp.mount` systemd service).

#### SCAP Security Guide Version:

0.1.68

#### Operating System Version:

Red Hat 8.8

#### Steps to Reproduce:

1. Install compliance-as-code tooling on RHEL 8 system configured with the `tmp.mount` service enabled
2. Executed the bundled remediation automation-content
3. Reboot system
4. Perform a compliance scan
5. Receive a scan-report calling out `/tmp` missing the required mount-option

#### Actual Results:

Scan-results call out call out `/tmp` missing the required mount-option

#### Expected Results:

Scan-results should not call out call out `/tmp` missing the required mount-option

#### Additional Information/Debugging Steps:

Instead of testing _just_ `/etc/fstab`, scan should also test for actual mount-options in `/proc/mounts` and any specified in systemd file, `/etc/systemd/system/tmp.mount.d/options.conf`

Recommended additions:

1. Check for presence of an `/etc/systemd/system/tmp.mount.d/options.conf` file
1. If `/etc/systemd/system/tmp.mount.d/options.conf` file exists, check requested mount-options:
~~~bash
# cat /etc/systemd/system/tmp.mount.d/options.conf
[Mount]
Options=mode=1777,strictatime,nosuid,noexec,nodev
~~~

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.