Skip to content

Remove rule configure_opensc_nss_db from RHEL8 product.#4779

Merged
yuumasato merged 1 commit intoComplianceAsCode:masterfrom
ggbecker:remove-configure_opensc_nss_db-from-rhel8
Aug 30, 2019
Merged

Remove rule configure_opensc_nss_db from RHEL8 product.#4779
yuumasato merged 1 commit intoComplianceAsCode:masterfrom
ggbecker:remove-configure_opensc_nss_db-from-rhel8

Conversation

@ggbecker
Copy link
Copy Markdown
Member

@ggbecker ggbecker commented Aug 30, 2019

Description:

  • Remove rule configure_opensc_nss_db from RHEL8 product. This PR is part of Fix remediation for rule configure_opensc_nss_db #4776, but I decided to make the RHEL8 rule removal separated as it can be part of release 0.1.46. This rule is failing on RHEL8 PCI-DSS. See sections Smart cards in Firefox browser or Thunderbird and Register third party PKCS #11 module to p11-kit on RHEL8 article: https://access.redhat.com/articles/4253861 which confirms that OpenSC is set by default on RHEL8

Rationale:

  • The rule is not applicable to RHEL8. OpenSC is set by default on RHEL8. Additionally RHEL8 does not contain pkcs11-switch tool.

The rule is not applicable to RHEL8. OpenSC is set by default on RHEL8.
@ggbecker ggbecker added Ansible Ansible remediation update. OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. Text labels Aug 30, 2019
@ggbecker ggbecker added this to the 0.1.46 milestone Aug 30, 2019
@yuumasato yuumasato self-assigned this Aug 30, 2019
@yuumasato
Copy link
Copy Markdown
Member

LGTM, thanks.

@yuumasato yuumasato merged commit bca4246 into ComplianceAsCode:master Aug 30, 2019
@ggbecker
Copy link
Copy Markdown
Member Author

Description:

* Remove rule configure_opensc_nss_db from RHEL8 product. This PR is part of #4776, but I decided to make the RHEL8 rule removal separated as it can be part of release 0.1.46. This rule is failing on RHEL8 PCI-DSS. See sections `Smart cards in Firefox browser or Thunderbird` and `Register third party PKCS #11 module to p11-kit` on RHEL8 article: https://access.redhat.com/articles/4253861 which confirms that OpenSC is set by default on RHEL8

I discovered a few things: OpenSC is set by default but it needs to be installed (opensc package). When you install opensc, it creates the file /usr/share/p11-kit/modules/opensc.module which contains the entry module: opensc-pkcs11.so and p11-kit knows how to load the library for the applications which will be using the library, e.g. nss (which is consumed by firefox/thunderbird)

We could change the approach of this rule to something like:

  • check if the /usr/share/p11-kit/modules/opensc.module which points to correct library, and the remediation would be installing opensc package.

@yuumasato any thoughts on that?

@yuumasato yuumasato mentioned this pull request Apr 1, 2020
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Ansible Ansible remediation update. Bash Bash remediation update. OVAL OVAL update. Related to the systems assessments.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants