Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-39970

Various problems in the aide configuration file

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • aide-0.19.2-3.el10
    • Yes
    • Moderate
    • rhel-security-special-projects
    • ssg_security
    • 7
    • 1
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Rebase
    • Hide
      Version: 0.19.2
      List of highlights:
      1. Security Updates: Fixed two security bugs (CVE-2025-54389 and CVE-2025-54409)
      2. Major Library Change: Switched the underlying cryptographic library from libmhash to libnettle
      3. Backwards incompatible changes: the configuration options database, summarize_changes, and grouped have been removed and replaced with new names (database_in, report_summarize_changes, and report_grouped).
      4. Default Configuration Update: The default aide.conf file has been updated with many improvements, including new file attributes and adjusted default rules. See aide.conf(5) for more details.

      All detailed changes, including numerous smaller bug fixes and improvements, can be found in the documentation file at /usr/share/doc/aide/NEWS.
      Show
      Version: 0.19.2 List of highlights: 1. Security Updates: Fixed two security bugs (CVE-2025-54389 and CVE-2025-54409) 2. Major Library Change: Switched the underlying cryptographic library from libmhash to libnettle 3. Backwards incompatible changes: the configuration options database, summarize_changes, and grouped have been removed and replaced with new names (database_in, report_summarize_changes, and report_grouped). 4. Default Configuration Update: The default aide.conf file has been updated with many improvements, including new file attributes and adjusted default rules. See aide.conf(5) for more details. All detailed changes, including numerous smaller bug fixes and improvements, can be found in the documentation file at /usr/share/doc/aide/NEWS.
    • Proposed
    • None

      What were you trying to do that didn't work?

      Various issues in aide.conf where some part's shouldn't be here based on previous releases.

      Please provide the package NVR for which bug is seen:

      aide-0.18.6-5.el10.x86_64

      How reproducible:

      Always, run test scenario on RHEL-10 with selected package.

      Steps to reproduce

      1. git clone https://github.com/RedHat-SP-Security/aide-tests.git 
      2. in working dir $ tmt --context distro=rhel-10.0 run plan --default -vvv prepare discover -h fmf -t /Regression/Check-no-weird-lines-in-etc-aide-conf -vv provision -h connect --guest IP -u USER -p PASSWORD execute --how tmt --interactive login  finish

      Expected results

      :: [ 11:45:04 ] :: [ LOG ] :: Files from tcpwrappers package, which is deprecated and removed
      :: [ 11:45:04 ] :: [ PASS ] :: File '/etc/aide.conf' should not contain '/etc/hosts\.'
      :: [ 11:45:04 ] :: [ LOG ] :: Mysterious file. What is 'and-httpd'?
      :: [ 11:45:04 ] :: [ PASS ] :: File '/etc/aide.conf' should not contain 'and-'
      :: [ 11:45:04 ] :: [ LOG ] :: Check for duplicities in /etc/aide.conf
      :: [ 11:45:04 ] :: [ PASS ] :: Command 'grep -e '/' -e '!' /etc/aide.conf | cut -d ' ' -f 1 | sort | uniq -d | tee aide_conf_duplicities' (Expected 0, got 0)
      :: [ 11:45:04 ] :: [ LOG ] :: No duplicate lines in /etc/aide.conf
      :: [ 11:45:17 ] :: [ PASS ] :: Get all system files (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ PASS ] :: Count of possible system files (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ PASS ] :: Get all paths from aide config file (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ PASS ] :: Sanitaze aide config paths - remove paths that are not part of 'repoquery -al' (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ PASS ] :: Command 'mv aide_config_paths_2 aide_config_paths' (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ PASS ] :: Count of paths in aide config (Expected 0, got 0)
      :: [ 11:45:17 ] :: [ LOG ] :: Check presence of each line in aide_config_paths in system_files

      Actual results

       

      :: [ 11:08:54 ] :: [ LOG ] :: Files from tcpwrappers package, which is deprecated and removed
      :: [ 11:08:54 ] :: [ FAIL ] :: File '/etc/aide.conf' should not contain '/etc/hosts\.'
      :: [ 11:08:54 ] :: [ LOG ] :: Mysterious file. What is 'and-httpd'?
      :: [ 11:08:54 ] :: [ FAIL ] :: File '/etc/aide.conf' should not contain 'and-'
      :: [ 11:08:54 ] :: [ LOG ] :: Check for duplicities in /etc/aide.conf
      :: [ 11:08:54 ] :: [ BEGIN ] :: Running 'grep -e '/' -e '!' /etc/aide.conf | cut -d ' ' -f 1 | sort | uniq -d | tee aide_conf_duplicities'
      /etc/login.defs
      /etc/securetty
      :: [ 11:08:54 ] :: [ PASS ] :: Command 'grep -e '/' -e '!' /etc/aide.conf | cut -d ' ' -f 1 | sort | uniq -d | tee aide_conf_duplicities' (Expected 0, got 0)
      :: [ 11:08:54 ] :: [ FAIL ] :: Find duplicities in /etc/aide.conf
      :: [ 11:08:54 ] :: [ BEGIN ] :: Running 'cat aide_conf_duplicities'
      /etc/login.defs
      /etc/securetty
      :: [ 11:08:54 ] :: [ PASS ] :: Command 'cat aide_conf_duplicities' (Expected 0, got 0)
      egrep: warning: egrep is obsolescent; using grep -E
      :: [ 11:08:54 ] :: [ INFO ] :: Sending aide_conf_duplicities as aide_conf_duplicities
      File '/tmp/tmp.7RiE9f36yg/aide_conf_duplicities' stored to '/var/ARTIFACTS/work-general5ghbqq28/Plans/general/execute/data/guest/default-0/Upstream_aide_tests/Regression/Check-no-weird-lines-in-etc-aide-conf-1/data'.
      :: [ 11:08:55 ] :: [ BEGIN ] :: Get all system files :: actually running 'repoquery -al > system_files 2> /dev/null'
      :: [ 11:09:01 ] :: [ PASS ] :: Get all system files (Expected 0, got 0)
      :: [ 11:09:01 ] :: [ BEGIN ] :: Count of possible system files :: actually running 'wc -l system_files'
      2078947 system_files
      :: [ 11:09:01 ] :: [ PASS ] :: Count of possible system files (Expected 0, got 0)
      :: [ 11:09:01 ] :: [ BEGIN ] :: Get all paths from aide config file :: actually running 'grep -e '/' -e '!' /etc/aide.conf | cut -d ' ' -f 1 > aide_config_paths'
      :: [ 11:09:02 ] :: [ PASS ] :: Get all paths from aide config file (Expected 0, got 0)
      :: [ 11:09:02 ] :: [ BEGIN ] :: Sanitaze aide config paths - remove paths that are not part of 'repoquery -al' :: actually running 'cat aide_config_paths | tr -d '!$~*' | grep -v -e '/etc/tmux.conf' -e '/etc/hosts.allow' -e '/etc/hosts.deny' -e '/etc/resolv.conf' -e '/var/log/faillog' -e '/var/log/aide.log' -e '/var/run/utmp' -e '/etc/ld.so.preload' -e '/etc/at.allow' -e '/etc/cron.allow' -e '/var/spool/cron/root' -e '/etc/aliases.db' -e '/etc/named.iscdlv.key' -e '/var/log/and-httpd' -e '/root/.xauth' -e '/etc/xinetd.conf' -e '/etc/xinetd.d' -e '/etc/securetty' > aide_config_paths_2'
      :: [ 11:09:02 ] :: [ PASS ] :: Sanitaze aide config paths - remove paths that are not part of 'repoquery -al' (Expected 0, got 0)
      :: [ 11:09:02 ] :: [ BEGIN ] :: Running 'mv aide_config_paths_2 aide_config_paths'
      :: [ 11:09:02 ] :: [ PASS ] :: Command 'mv aide_config_paths_2 aide_config_paths' (Expected 0, got 0)
      :: [ 11:09:02 ] :: [ BEGIN ] :: Count of paths in aide config :: actually running 'wc -l aide_config_paths'
      77 aide_config_paths
      :: [ 11:09:02 ] :: [ PASS ] :: Count of paths in aide config (Expected 0, got 0)
      :: [ 11:09:02 ] :: [ LOG ] :: Check presence of each line in aide_config_paths in system_files
      :: [ 11:09:02 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/nscd.conf'
      :: [ 11:09:02 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/yumex.conf'
      :: [ 11:09:02 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/yumex.profiles.conf'
      :: [ 11:09:03 ] :: [ FAIL ] :: File 'system_files' should contain '/usr/sbin/stunnel'
      :: [ 11:09:03 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/cron.monthly/'
      :: [ 11:09:03 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/cron.weekly/'
      :: [ 11:09:04 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/grub/'
      :: [ 11:09:04 ] :: [ FAIL ] :: File 'system_files' should contain '/etc/modprobe.conf'

      LOGS:
      https://artifacts.osci.redhat.com/testing-farm/b9e11f6a-7a76-412a-b069-c5aeb14ada6d/work-general5ghbqq28/Plans/general/execute/data/guest/default-0/Upstream_aide_tests/Regression/Check-no-weird-lines-in-etc-aide-conf-1/output.txt 

              rh-ee-alakatos Attila Lakatos
              pkoncity2 Patrik Končitý
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: