RHEL7 - `file_*_home_directories` rules fail due to `/var/lib/nfs/`

[mildas]

Description of problem:

file_groupownership_home_directories, file_ownership_home_directories, and file_permissions_home_directories fails due to wrong permissions on /var/lib/nfs/ directory. The directory should not be checked at all.

SCAP Security Guide Version:

stabilization-v0.1.61 branch

Operating System Version:

RHEL 7

Steps to Reproduce:

1. python3 tests/test_suite.py profile --libvirt qemu:///system test_suite_vm --datastream /tmp/ssg-rhel7-ds.xml xccdf_org.ssgproject.content_profile_stig_gui

Actual Results:

file_*_home_directories fail

Expected Results:

file_*_home_directories pass

Additional Information/Debugging Steps:

Fix should be similar to #8393 that fixed accounts_users_home_files_* rules.

[mildas]

@ggbecker In RHEL 7 STIG, there are:

• accounts_users_home_files_groupownership
• accounts_users_home_files_ownership
• accounts_users_home_files_permissions

and

• file_groupownership_home_directories
• file_ownership_home_directories
• file_permissions_home_directories

First talks about "All users ...", the second about "All interactive users ...".
Doesn't the first rule set include the second rule set? Or is it expected to have both groups there?

[ggbecker]

@ggbecker In RHEL 7 STIG, there are:

* `accounts_users_home_files_groupownership`

* `accounts_users_home_files_ownership`

* `accounts_users_home_files_permissions`

and

* `file_groupownership_home_directories`

* `file_ownership_home_directories`

* `file_permissions_home_directories`

First talks about "All users ...", the second about "All interactive users ...". Doesn't the first rule set include the second rule set? Or is it expected to have both groups there?

These two groups do distinct things, one ensures that the home directory has right permissions/ownership. The other one ensures that all files and directories within a home directory have right permissions/ownership.

The all users vs all interactive users thing is basically talking about the same set of users if I'm not mistaken.

Does that answer your question?

[mildas]

Yes, it answers it. Thank you.

Fixed by #8426