Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-135787

oscap fails on with error on "xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs" when having binary dot files

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-9.7
    • openscap
    • None
    • rhel-security-compliance
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      The rule xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs checks if any dot file executes programs that are world-writable.
      When having such world-writable program installed on the system, the rule may fail in error when some dot file contains binary data (e.g. because it's some authentication data):

      # oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs --profile profile_cis /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 
      --- Starting Evaluation ---
      
      Title   User Initialization Files Must Not Run World-Writable Programs
      Rule    xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs
      Ident   CCE-87451-1
      E: oscap: Function oscap_pcre_exec() failed to match a regular expression with return code -10 on string '�]F��YW1,G�����'.
      Result  error
      

      What is the impact of this issue to you?

      Can't scan the system properly

      Please provide the package NVR for which the bug is seen:

      openscap-1.3.12-1.el9_6.x86_64
      scap-security-guide-0.1.78-1.el9.noarc

      How reproducible is this bug?

      Always

      Steps to reproduce

      1. Create a dotfile in user's home with binary inside
        $ printf "\23\346]F\206\235YW1,G\265\247\264\300\301" > .dot_file
      2. Create a world-writable script on the system
        # echo -e "#!/bin/sh\necho HELLO" > /usr/local/bin/world_writable_script
        # chmod 757 /usr/local/bin/world_writable_script
        
      3. Scan the system
        oscap xccdf eval --rule xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs --profile profile_cis /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

      Expected results

      Result pass
      

      Actual results

      E: oscap: Function oscap_pcre_exec() failed to match a regular expression with return code -10 on string '�]F��YW1,G�����'.
      Result  error
      

              jcerny@redhat.com Jan Cerny
              rhn-support-rmetrich Renaud Métrich
              Jan Cerny Jan Cerny
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: