ComplianceAsCode / ComplianceAsCode/content
Rule file_permissions_audit_configuration_stig fails after Ansible Remediation on CentOS Stream
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
PR https://github.com/ComplianceAsCode/content/pull/14991/ introduced new rule `file_permissions_audit_configuration_stig`. The rule fails in the test `/hardening/host-os/ansible/stig` on CentOS Stream.
The rule fails in the final OpenSCAP scan because `/etc/audit/audit.rules` has incorrect permissions - it has 0640 but the expected mode is 0600.
The fail isn't reproducible with RHEL, we couldn't reproduce it in a custom GitLab pipeline on RHEL, it happens only on CentOS Stream.
#### SCAP Security Guide Version:
#### Operating System Version:
CentOS Stream 8
CentOS Stream 9
#### Steps to Reproduce:
1. Run contest test `/hardening/host-os/ansible/stig` on CentOS Stream machine
#### Actual Results:
file_permissions_audit_configuration_stig is evaluated as `fail` in the post-remediaton scan
#### Expected Results:
file_permissions_audit_configuration_stig is evaluated as `pass` in the post-remediaton scan
#### Additional Information/Debugging Steps:
See the discussion in https://github.com/ComplianceAsCode/content/pull/14991
Contributor guide
Research direction
Run contest test `/hardening/host-os/ansible/stig` on CentOS Stream 8 and 9 and inspect the post-remediation OpenSCAP result for `file_permissions_audit_configuration_stig`. Trace the remediation introduced by PR #14991 and the resulting `/etc/audit/audit.rules` mode; done means the file is 0600 and the final scan evaluates the rule as pass on CentOS Stream.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible, centos
- Domain
- operating-systems, security, testing
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 66/100