Use nss-altfiles in file_groupowner_etc_chrony_keys #12789
+95
−16
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The bootable containers and Image Mode Operating systems use `/usr/lib/group` provided by the `nss-altfiles` RPM package as an alternative place to define user groups in the system. The rule `file_groupowner_etc_chrony_keys` didn't read the `/usr/lib/group`. As a result the rule failed in the after-deployment scan with the ANSSI BP28 High profile. This commit extends the check to read `/usr/lib/group`, which makes the rule pass in Image Mode. This change has been inspired by the code in rule `file_permissions_ungroupowned` which already has been modified for Image Mode. The code that is same in OVALs in both rules has been extracted to a Jinja 2 macro to prevent code duplication and enable further reuse in future.
jan-cerny
added
OVAL
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_chrony_keys' differs.
--- oval:ssg-file_groupowner_etc_chrony_keys:def:1
+++ oval:ssg-file_groupowner_etc_chrony_keys:def:1
@@ -1,2 +1,7 @@
+criteria OR
criteria AND
-criterion oval:ssg-test_file_groupowner_etc_chrony_keys_0:tst:1
+criterion oval:ssg-test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:tst:1
+criterion oval:ssg-test_file_groupowner_etc_chrony_keys:tst:1
+criteria AND
+criterion oval:ssg-test_file_groupowner_etc_chrony_keys_nsswitch_uses_altfiles:tst:1
+criterion oval:ssg-test_file_groupowner_etc_chrony_keys_with_usrlib:tst:1 |
|
I don't know what is the problem because I pass all locally. Any help? |
Mab879
requested changes
Jan 8, 2025
| <def-group> | ||
|
|
||
| <definition class="compliance" id="{{{ rule_id }}}" version="1"> | ||
| {{{ oval_metadata("All files should be owned by a group") }}} |
There was a problem hiding this comment.
Suggested change
| {{{ oval_metadata("All files should be owned by a group") }}} | |
| {{{ oval_metadata("All files should be owned by a group") }}} |
While this is true, I don't think this is the best description for the rule.
|
Code Climate has analyzed commit af3c6e7 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.6% (0.0% change). View more on Code Climate. |
|
I have changed the comments. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The bootable containers and Image Mode Operating systems use
/usr/lib/groupprovided by thenss-altfilesRPM package as an alternative place to define user groups in the system.The rule
file_groupowner_etc_chrony_keysdidn't read the/usr/lib/group. As a result the rule failed in the after-deployment scan with the ANSSI BP28 High profile. This commit extends the check to read/usr/lib/group, which makes the rule pass in Image Mode.This change has been inspired by the code in rule
file_permissions_ungroupownedwhich already has been modified for Image Mode. The code that is same in OVALs in both rules has been extracted to a Jinja 2 macro to prevent code duplication and enable further reuse in future.