ComplianceAsCode / ComplianceAsCode/content

Rule file_permissions_audit_configuration_stig fails after Ansible Remediation on CentOS Stream

Open
#15,006 0 comments 0 reactions 0 assignees View on GitHub
Ansible productization-issue triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
PR https://github.com/ComplianceAsCode/content/pull/14991/ introduced new rule `file_permissions_audit_configuration_stig`. The rule fails in the test `/hardening/host-os/ansible/stig` on CentOS Stream.

The rule fails in the final OpenSCAP scan because `/etc/audit/audit.rules` has incorrect permissions - it has 0640 but the expected mode is 0600.

The fail isn't reproducible with RHEL, we couldn't reproduce it in a custom GitLab pipeline on RHEL, it happens only on CentOS Stream.

#### SCAP Security Guide Version:

#### Operating System Version:
CentOS Stream 8
CentOS Stream 9

#### Steps to Reproduce:

1. Run contest test `/hardening/host-os/ansible/stig` on CentOS Stream machine

#### Actual Results:
file_permissions_audit_configuration_stig is evaluated as `fail` in the post-remediaton scan

#### Expected Results:
file_permissions_audit_configuration_stig is evaluated as `pass` in the post-remediaton scan

#### Additional Information/Debugging Steps:
See the discussion in https://github.com/ComplianceAsCode/content/pull/14991

Contributor guide

Open the contributing guide

Research direction

Run contest test `/hardening/host-os/ansible/stig` on CentOS Stream 8 and 9 and inspect the post-remediation OpenSCAP result for `file_permissions_audit_configuration_stig`. Trace the remediation introduced by PR #14991 and the resulting `/etc/audit/audit.rules` mode; done means the file is 0600 and the final scan evaluates the rule as pass on CentOS Stream.

Written by the indexing model from the issue text.

Assessment

Tech stack
ansible, centos
Domain
operating-systems, security, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
66/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.