ComplianceAsCode / ComplianceAsCode/content

RHEL8 DS object_accounts_interactive_users results in Error if file like .esd_auth is present in homedir

Open
#11,276 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
The OpenSCAP scan with Disa STIG list on a fresh install of RHEL7, 8 or 9 server with GUI results in an error for the `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` section

#### SCAP Security Guide Version:
0.1.70

#### Operating System Version:
RHEL7, 8 and 9

#### Steps to Reproduce:
1. Install RHEL7,8 or 9 server with GUI
2. Install OpenSCAP and necessary dependencies
3. Perform OpenSCAP scan using ssg-rhel[7,8,9]-ds.xml profile
4. The section `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` scan results in Error

#### Actual Results:
The scan result for `ssg-object_accounts_umask_interactive_users_objects_local_interactive_users` is "Error". When the scan is run with debug log, the output shows various failures to parse files with name .esd_auth to determine if these contain 'umask'. The resulting report shows this section result "Error" . Mentioned files contain authorization cookies created by PulseAudio after a user logon via GNome Desktop environment. Removing the files is only a temporary fix as the files are created again after GUI logon.

#### Expected Results:
The scan result should either be Passed or Failed.

#### Additional Information/Debugging Steps:
In the related xml files, I found the following solution:

```
319822
319823 /etc/passwd
319824 ^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!\/sbin\/nologin)[^:]*$
319825 1
319826 oval:ssg-state_object_accounts_umask_interactive_users_objects_users_ignored:ste:1
319827
319828
319829
319830 ^\..*
319831 ^[\s]*umask\s*
319832 1
319833 oval:ssg-state_accounts_umask_interactive_users_bash_history:ste:1
319834

```
Changing:
```
319830 ^\..*
```
To:
```
319830 ^\..*[^?!esd_auth$)]$
```
Appears to have fixed this or, at least, the result was as expected (Fail / Pass).

So, the solution apparently is to do one of the following:
- exclude files by name .esd_auth (meh)
- exclude files by contents (.esd_auth is a COM executable for DOS according to the file command) (slightly more robust, but how?)
- or perhaps the pattern `^[\s]*umask\s*` for parsing the files needs adjusting

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.