RHEL9 - `file_permissions_library_dirs` passes after remediation, but fails after next reboot

[mildas]

Description of problem:

In RHEL9 STIG without GUI, file_permissions_library_dirs fails after machine reboot.

SCAP Security Guide Version:

stabilization-v0.1.61 branch

Operating System Version:

RHEL 9

Steps to Reproduce:

1. python3 tests/test_suite.py profile --libvirt qemu:///system test_suite_vm --datastream /tmp/ssg-rhel9-ds.xml xccdf_org.ssgproject.content_profile_stig

Actual Results:

xccdf_org.ssgproject.content_rule_file_permissions_library_dirs - fail

Expected Results:

xccdf_org.ssgproject.content_rule_file_permissions_library_dirs - pass

Additional Information/Debugging Steps:

OVAL details:

Details

Testing mode of /lib/  oval:ssg-test_file_permissions_library_dirs_0:tst:1  true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/lib/polkit-1/polkit-agent-helper-1	regular	0	0	20416	rwsr-xr-x

Testing mode of /lib64/  oval:ssg-test_file_permissions_library_dirs_1:tst:1  false

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_1:obj:1 of type file_object

Path	Filename	Filter	Filter
^/lib64	^.*$	oval:ssg-state_file_permissions_library_dirs_1_mode_not_0755:ste:1	oval:ssg-exclude_symlinks__library_dirs:ste:1

Testing mode of /usr/lib/  oval:ssg-test_file_permissions_library_dirs_2:tst:1  true

Following items have been found on the system:

Path	Type	UID	GID	Size (B)	Permissions
/usr/lib/polkit-1/polkit-agent-helper-1	regular	0	0	20416	rwsr-xr-x

Testing mode of /usr/lib64/  oval:ssg-test_file_permissions_library_dirs_3:tst:1  false

No items have been found conforming to the following objects:

Object oval:ssg-object_file_permissions_library_dirs_3:obj:1 of type file_object

Path	Filename	Filter	Filter
^/usr/lib64	^.*$	oval:ssg-state_file_permissions_library_dirs_3_mode_not_0755:ste:1	oval:ssg-exclude_symlinks__library_dirs:ste:1

Check the OVAL results. It seems that polkit permissions are causing the failure.

[mildas]

It's problem only in STIG without GUI. I haven't seen the failure in STIG with GUI.

[marcusburghardt]

I tested a RHEL9 using scap-security-guide-0.1.57-5.el9.noarch and the file_permissions_library_dirs rule passed when the polkit package was installed and uninstalled.

Then I repeated the tests using the datastream from upstream (scap-security-guide-0.1.61). In this case, the file_permissions_library_dirs rule passed when the polkit packaged was not installed but failed after installing the polkit package.

Initially, no polkit package installed:

[root@localhost ~]# oscap xccdf eval --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results **/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml**
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  pass

[root@localhost ~]# oscap xccdf eval --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results **ssg-rhel9-ds.xml**
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  pass

After dnf install -y polkit:

root@localhost ~]# oscap xccdf eval --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  pass

[root@localhost ~]# oscap xccdf eval --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results ssg-rhel9-ds.xml
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  fail

Probably it was caught in the newer version due to #8404. Therefore, it looks expected considering the /usr/lib/polkit-1/polkit-agent-helper-1 permissions:
rwsr-xr-x. 1 root root 20K Aug 10 2021 /usr/lib/polkit-1/polkit-agent-helper-1

Then I remediated using the newer datastream, rebooted the system and the file_permissions_library_dirs rule passed again, as expected.

oscap xccdf eval --remediate --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results ssg-rhel9-ds.xml
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  fail

 --- Starting Remediation ---
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  fixed

After reboot:

[root@localhost ~]# oscap xccdf eval --profile stig --rule xccdf_org.ssgproject.content_rule_file_permissions_library_dirs --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results ssg-rhel9-ds.xml
Title   Verify that Shared Library Files Have Restrictive Permissions
Rule    xccdf_org.ssgproject.content_rule_file_permissions_library_dirs
Ident   CCE-83909-2
Result  pass

[root@localhost ~]# ls -lahtr /usr/lib/polkit-1/polkit-agent-helper-1   
-rwxr-xr-x. 1 root root 20K Aug 10  2021 /usr/lib/polkit-1/polkit-agent-helper-1

Considering these tests and the issue description, looks that polkit was installed or the datastream was changed between the two assessments. I couldn't reproduce the problem only rebooting the VM. : ( Could it be a test environment issue?

[mildas]

I don't think it is test environment issue. It seems as conflict of rules - file_permissions_library_dirs and rpm_verify_permission.
file_permissions_library_dirs expects 0755 or stricter permissions
rpm_verify_permission expects permissions as defined in rpm database - 4755

The rule that gets remediated last is pass in final scan. The first one will be fail because its permissions are overwritten.

[mildas]

I have reported the problem of conflicting rules in #8500 issue. Either one or another will fail, because their expectations are in conflict. Closing this one issue, because it is not specific enough