ComplianceAsCode / ComplianceAsCode/content
Grub2 kernel arguments rules detection failure on ostree OS
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Apply at least to rules :
- `grub2_slub_debug_argument`
- `grub2_page_poison_argument`
- `grub2_audit_argument`
- `grub2_audit_backlog_limit_argument`
Kernel arguments passed to Grub using `rpm-ostree kargs` are not properly detected. The scan checks `GRUB_CMDLINE_LINUX` and `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, but not `rpm-ostree kargs` arguments.
Note that the kernel arguments are properly detected in current boot entries ( `/boot/loader/entries/`).
#### SCAP Security Guide Version:
Benchmark ID: xccdf_org.ssgproject.content_benchmark_FEDORA
Benchmark version: 0.1.69
Profile ID: xccdf_org.ssgproject.content_profile_ospp
#### Operating System Version:
Fedora 38 (Kinoite)
#### Steps to Reproduce:
- Add kernel arguments using `sudo rpm-ostree kargs --append slub_debug=P`
- Ensure it is present to all boot entries in `/boot/loader/entries/`
- Run `oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml` : `grub2_slub_debug_argument` does not pass.
#### Actual Results:
The rules check FAIL
#### Expected Results:
The rules check PASS
Contributor guide
Assessment
This issue has not been assessed yet.