ComplianceAsCode / ComplianceAsCode/content

False Positive finding with `configure_openssl_tls_crypto_policy` on UBI 9 container

Open
#13,439 1 comment 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
- The check `xccdf_org.ssgproject.content_rule_configure_openssl_tls_crypto_policy` in STIG mode presents a false positive finding if ran on a minimized redhat UBI container that does not have the `sudo` utility.
- The STIG check runs `sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config` and expects back the TLS and DTLS protocol versions. If ran on a redhat system without `sudo` , the command returns `bash: sudo: command not found` which is returned as a False Positive.
- This can be demonstrated by running the RHEL-9 STIG profile on the [Gitlab CNG Base FIPS image](https://gitlab.com/gitlab-org/build/CNG/container_registry/2918287?orderBy=PUBLISHED_AT&sort=desc&search%5B%5D=master-fips)

#### SCAP Security Guide Version:
- Using the packages available in the Ubuntu 24.04 repository
```
Package: ssg-base
Version: 0.1.71-1
Priority: optional
Section: universe/admin
Source: scap-security-guide
Origin: Ubuntu
```
```
Package: ssg-nondebian
Version: 0.1.71-1
Priority: optional
Section: universe/admin
Source: scap-security-guide
```
#### Operating System Version:
RHEL 9.5 / UBI 9.5

#### Steps to Reproduce:

1. Setup OpenSCAP, OpenSCAP-Podman, SSG - [relevant bootstrap script](https://gitlab.com/dwilmoth/scap-bootstrapping/-/blob/main/scap-boostrap.sh?ref_type=heads)
2. Pull the Gitlab CNG Fips container `podman pull registry.gitlab.com/gitlab-org/build/cng/gitlab-base:master-fips`
2. Run the check - `oscap-podman $image xccdf eval --report /tmp/cng-base-stig.html --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml`
3. Review the result HTML for "Configure OpenSSL library to use TLS Encryption" and see that it fails
4. run the container, exec into it and run the check manually, both with and without `sudo` -
- ` podman run --rm -it $image /bin/bash`
- `grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config`
- `sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config`
#### Actual Results:
fail

#### Expected Results:
pass

#### Additional Information/Debugging Steps:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.