ComplianceAsCode / ComplianceAsCode/content

Grub2 kernel arguments rules detection failure on ostree OS

Open
#11,220 1 comment 0 reactions 0 assignees View on GitHub
Fedora triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Apply at least to rules :
- `grub2_slub_debug_argument`
- `grub2_page_poison_argument`
- `grub2_audit_argument`
- `grub2_audit_backlog_limit_argument`

Kernel arguments passed to Grub using `rpm-ostree kargs` are not properly detected. The scan checks `GRUB_CMDLINE_LINUX` and `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, but not `rpm-ostree kargs` arguments.

Note that the kernel arguments are properly detected in current boot entries ( `/boot/loader/entries/`).

#### SCAP Security Guide Version:

Benchmark ID: xccdf_org.ssgproject.content_benchmark_FEDORA
Benchmark version: 0.1.69
Profile ID: xccdf_org.ssgproject.content_profile_ospp

#### Operating System Version:

Fedora 38 (Kinoite)

#### Steps to Reproduce:

- Add kernel arguments using `sudo rpm-ostree kargs --append slub_debug=P`
- Ensure it is present to all boot entries in `/boot/loader/entries/`
- Run `oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml` : `grub2_slub_debug_argument` does not pass.

#### Actual Results:

The rules check FAIL

#### Expected Results:

The rules check PASS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.