ComplianceAsCode / ComplianceAsCode/content
test_aide_periodic_cron_checking is too restrictive
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
##### Arguments #####
The first issue is that either `--check` or `-C` are valid arguments to AIDE and different scanners tend to want different arguments so either should be valid.
##### Scheduling Method #####
The second issue is that there are multiple methods for scheduling this service:
1. `systemd` because the 90's called and want your crontab back
2. The `root` crontab
3. `/etc/cron.*`
Any and/or all of these locations should be valid (`systemd` should be preferred at this point I would think).
##### Operational Impact #####
The third issue is that `aide` is a very CPU intensive process and users will probably want to `nice` the application down so that it does not interfere with production systems.
The application should be allowed to be run under `nice` restrictions so that the system is not impacted.
It looks like there is no real reason to check the actual scheduling in the regex since the valid presence in any of the locations above indicates that it has been scheduled (and therefore meets the requirement).
#### SCAP Security Guide Version:
https://github.com/ComplianceAsCode/content/blob/c1aa29c927b976389abbfe94000b72c01f5aff08/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/oval/shared.xml
Contributor guide
Assessment
This issue has not been assessed yet.