ComplianceAsCode / ComplianceAsCode/content
Rule package_rsh_removed could return false positive on Ubuntu with OpenSCAP 1.4.3
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Since version [1.4.3](https://github.com/OpenSCAP/openscap/releases/tag/1.4.3), OpenSCAP's dpkg probe is able to handle virtual packages.
This causes an issue with the [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule.
The [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule checks for the absence of the `rsh-client` package. However, the `rsh-client` package could either be the actual unwanted `rsh-client` package, or a virtual package provided by the `openssh-client` package.
When the `openssh-client` package is installed, the virtual package `rsh-client` is satisfied, hence triggering false positive on the [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule.
Ubuntu 20.04 and 22.04 both have the issue, since there is a actual `rsh-client` package present, as well as the `rsh-client` virtual package provided by the `openssh-client` package.
Ubuntu 24.04 doesn't have the issue, since the `rsh-client` package is not present and, while the `rsh-client` virtual package still exists, it's not provided by any package.
#### SCAP Security Guide Version:
[0.1.78](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78)
#### Operating System Version:
Ubuntu 20.04, 22.04.
Contributor guide
Assessment
This issue has not been assessed yet.