Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1803

Openscap rule "Ensure All Files Are Owned by a User" does not consider/honor AD/sssd users

    • rhel-sst-security-compliance
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None
    • None
    • If docs needed, set a value
    • None

      Description of problem:
      While using the openscap policy "CIS Red Hat Enterprise Linux 8 Benchmark for Level1-Server" for the system, it fails for the rule "Ensure All Files Are Owned by a User" for the file which have AD/sssd user. Which means the it does not consider or are aware for file with AD/sssd user and shows them as orphans.
      Even as per the rule, running the below command does not show any files which are not owned by user,


      1. df --local -P | awk {'if (NR!=1) print $6'}

        | sudo xargs -I '{}' find '{}' -xdev -nouser

      2. find PARTITION -xdev -nouser

        This happens with both openscap scan done by console.redhat.com and Red Hat Satellite

      Version-Release number of selected component (if applicable):
      Openscap
      scap-security-guide

      How reproducible:

      Steps to Reproduce:
      1. Attach the systems to policy "CIS Red Hat Enterprise Linux 8 Benchmark for Level1-Server"
      2. The system should have files owned by AD/sssd user
      3. Run the scap on the system

      Actual results:
      The rule does not consider files owned by AD/sssd user and fails for rule "Ensure All Files Are Owned by a User"

      Expected results:
      The rule should consider files owned by AD/sssd user and should not fail for the rule "Ensure All Files Are Owned by a User"

      Additional info:

              vpolasek@redhat.com Vojtech Polasek
              rhn-support-achadha Arvinder Singh Chadha
              Vojtech Polasek Vojtech Polasek
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: