ComplianceAsCode / ComplianceAsCode/content

Rule package_rsh_removed could return false positive on Ubuntu with OpenSCAP 1.4.3

Open
#14,187 2 comments 0 reactions 1 assignee Claimed by @mpurg View on GitHub
Debian triaged Ubuntu
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Since version [1.4.3](https://github.com/OpenSCAP/openscap/releases/tag/1.4.3), OpenSCAP's dpkg probe is able to handle virtual packages.

This causes an issue with the [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule.

The [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule checks for the absence of the `rsh-client` package. However, the `rsh-client` package could either be the actual unwanted `rsh-client` package, or a virtual package provided by the `openssh-client` package.

When the `openssh-client` package is installed, the virtual package `rsh-client` is satisfied, hence triggering false positive on the [package_rsh_removed](https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml) rule.

Ubuntu 20.04 and 22.04 both have the issue, since there is a actual `rsh-client` package present, as well as the `rsh-client` virtual package provided by the `openssh-client` package.

Ubuntu 24.04 doesn't have the issue, since the `rsh-client` package is not present and, while the `rsh-client` virtual package still exists, it's not provided by any package.

#### SCAP Security Guide Version:

[0.1.78](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.78)

#### Operating System Version:

Ubuntu 20.04, 22.04.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.