ComplianceAsCode / ComplianceAsCode/content
RHEL8 DS object_accounts_interactive_users results in Error if file like .esd_auth is present in homedir
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
The OpenSCAP scan with Disa STIG list on a fresh install of RHEL7, 8 or 9 server with GUI results in an error for the `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` section
#### SCAP Security Guide Version:
0.1.70
#### Operating System Version:
RHEL7, 8 and 9
#### Steps to Reproduce:
1. Install RHEL7,8 or 9 server with GUI
2. Install OpenSCAP and necessary dependencies
3. Perform OpenSCAP scan using ssg-rhel[7,8,9]-ds.xml profile
4. The section `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` scan results in Error
#### Actual Results:
The scan result for `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` is "Error". When the scan is run with debug log, the output shows various failures to parse files with name .esd_auth to determine if these contain 'umask'. The resulting report shows this section result "Error" . Mentioned files contain authorization cookies created by PulseAudio after a user logon via GNome Desktop environment. Removing the files is only a temporary fix as the files are created again after GUI logon.
#### Expected Results:
The scan result should either be Passed or Failed.
#### Additional Information/Debugging Steps:
In the related xml files, I found the following solution:
```
319822
319823 /etc/passwd
319824 ^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!\/sbin\/nologin)[^:]*$
319825 1
319826 oval:ssg-state_object_accounts_umask_interactive_users_objects_users_ignored:ste:1
319827
319828
319829
319830 ^\..*
319831 ^[\s]*umask\s*
319832 1
319833 oval:ssg-state_accounts_umask_interactive_users_bash_history:ste:1
319834
```
Changing:
```
319830 ^\..*
```
To:
```
319830 ^\..*[^?!esd_auth$)]$
```
Appears to have fixed this or, at least, the result was as expected (Fail / Pass).
So, the solution apparently is to do one of the following:
- exclude files by name .esd_auth (meh)
- exclude files by contents (.esd_auth is a COM executable for DOS according to the file command) (slightly more robust, but how?)
- or perhaps the pattern `^[\s]*umask\s*` for parsing the files needs adjusting
Contributor guide
Assessment
This issue has not been assessed yet.