File permissions library dirs shall act on files when 'file_regex' is set by yuumasato · Pull Request #8420 · ComplianceAsCode/content

yuumasato · 2022-03-24T18:25:37Z

Description:

Change the remediation of templates file_owner, file_groupowner and file_permission to act only on regular files when file_regex is set,
- Following the symlinks under /lib, lib64, /usr/lib and /usr/lib64 and making changes can have catastrophic consequences.

Rationale:

Fixes issues after applying remediation with file_permissions_library_dirs.
After File owners, groupowners, permissions should be able to recurse and file_regex #8404, rule file_permissions_library_dirs started to recursively navigate down the directory of trees, and it found symlinks to binaries installed in the system:

'/lib/.build-id/a4/67cb9c8fa7306d41b96a820b0178f3a9c66055' -> '../../../../usr/bin/passwd'
'/lib/.build-id/a4/8e8ae0d029dbbc1c1b0bb0fcea424860a6c412' -> '../../../../usr/bin/sudo'
'/lib/.build-id/a4/2c53d4543f5c0bb8db47d65e4b766d12f3b7bd' -> '../../../../usr/lib64/python3.9/lib-dynload/_lsprof.cpython-39-x86_64-linux-gnu.so'

This became visible when sudo command stopped working after remediation was applied:

[admin@localhost ~]# ls -lh /usr/bin/sudo
-rwxr-xr-x. 1 root root 182K Aug 26  2021 /usr/bin/sudo
....
[admin@localhost ~]# sudo ls
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

The remediations should remediate regular files. No symlinks or the files they are pointing to should be changed. There are symlinks in `/lib/.buid-id/' that point to installed binaries. For example (the IDs will vary): '/lib/.build-id/a4/67cb9c8fa7306d41b96a820b0178f3a9c66055' -> '../../../../usr/bin/passwd' '/lib/.build-id/a4/8e8ae0d029dbbc1c1b0bb0fcea424860a6c412' -> '../../../../usr/bin/sudo' '/lib/.build-id/a4/2c53d4543f5c0bb8db47d65e4b766d12f3b7bd' -> '../../../../usr/lib64/python3.9/lib-dynload/_lsprof.cpython-39-x86_64-linux-gnu.so'

github-actions · 2022-03-24T18:35:38Z

Start a new ephemeral environment with changes proposed in this pull request:

yuumasato · 2022-03-24T18:44:43Z

@dodys This reverts the chmod -h change, and changes the find command to return only regular files.

github-actions · 2022-03-24T18:57:03Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration' differs:
--- old datastream
+++ new datastream
@@ -1,18 +1,18 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q audit; then
 
-readarray -t files < <(find /etc/audit/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /etc/audit/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^audit(\.rules|d\.conf)$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^audit(\.rules|d\.conf)$'; then
+ chgrp 0 "$file"
 fi
 done
 
 
-readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*\.rules$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^.*\.rules$'; then
+ chgrp 0 "$file"
 fi
 done
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_audit_configuration' differs:
--- old datastream
+++ new datastream
@@ -1,17 +1,17 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q audit; then
 
-readarray -t files < <(find /etc/audit/ -maxdepth 1 ! -uid 0)
+readarray -t files < <(find /etc/audit/ -maxdepth 1 -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^audit(\.rules|d\.conf)$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^audit(\.rules|d\.conf)$'; then
+ chown 0 "$file"
 fi
 done
 
-readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1 ! -uid 0)
+readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1 -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*\.rules$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^.*\.rules$'; then
+ chown 0 "$file"
 fi
 done
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_etc_audit_rulesd' differs:
--- old datastream
+++ new datastream
@@ -1,9 +1,9 @@
 
 
 
-readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1)
+readarray -t files < <(find /etc/audit/rules.d/ -maxdepth 1 -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*rules$'; then
+ if basename "$file" | grep -qE '^.*rules$'; then
 chmod 0640 "$file"
 fi 
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_library_dirs' differs:
--- old datastream
+++ new datastream
@@ -1,30 +1,30 @@
 
 
 
-readarray -t files < <(find /lib/ ! -uid 0)
+readarray -t files < <(find /lib/ -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chown 0 "$file"
 fi
 done
 
-readarray -t files < <(find /lib64/ ! -uid 0)
+readarray -t files < <(find /lib64/ -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chown 0 "$file"
 fi
 done
 
-readarray -t files < <(find /usr/lib/ ! -uid 0)
+readarray -t files < <(find /usr/lib/ -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chown 0 "$file"
 fi
 done
 
-readarray -t files < <(find /usr/lib64/ ! -uid 0)
+readarray -t files < <(find /usr/lib64/ -type f ! -uid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chown -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chown 0 "$file"
 fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_library_dirs' differs:
--- old datastream
+++ new datastream
@@ -1,30 +1,30 @@
 
 
 
-readarray -t files < <(find /lib/ )
+readarray -t files < <(find /lib/ -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0755 "$file"
 fi 
 done
 
-readarray -t files < <(find /lib64/ )
+readarray -t files < <(find /lib64/ -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0755 "$file"
 fi 
 done
 
-readarray -t files < <(find /usr/lib/ )
+readarray -t files < <(find /usr/lib/ -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0755 "$file"
 fi 
 done
 
-readarray -t files < <(find /usr/lib64/ )
+readarray -t files < <(find /usr/lib64/ -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0755 "$file"
 fi 
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files' differs:
--- old datastream
+++ new datastream
@@ -1,33 +1,33 @@
 
 
 
-readarray -t files < <(find /lib/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /lib/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chgrp 0 "$file"
 fi
 done
 
 
-readarray -t files < <(find /lib64/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /lib64/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chgrp 0 "$file"
 fi
 done
 
 
-readarray -t files < <(find /usr/lib/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /usr/lib/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chgrp 0 "$file"
 fi
 done
 
 
-readarray -t files < <(find /usr/lib64/ -maxdepth 1 ! -gid 0)
+readarray -t files < <(find /usr/lib64/ -maxdepth 1 -type f ! -gid 0)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
- chgrp -h 0 "$file"
+ if basename "$file" | grep -qE '^.*$'; then
+ chgrp 0 "$file"
 fi
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_httpd_server_conf_d_files' differs:
--- old datastream
+++ new datastream
@@ -1,9 +1,9 @@
 
 
 
-readarray -t files < <(find /etc/httpd/conf.d/ -maxdepth 1)
+readarray -t files < <(find /etc/httpd/conf.d/ -maxdepth 1 -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0640 "$file"
 fi 
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_httpd_server_conf_files' differs:
--- old datastream
+++ new datastream
@@ -1,9 +1,9 @@
 
 
 
-readarray -t files < <(find /etc/httpd/conf/ -maxdepth 1)
+readarray -t files < <(find /etc/httpd/conf/ -maxdepth 1 -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*$'; then
+ if basename "$file" | grep -qE '^.*$'; then
 chmod 0640 "$file"
 fi 
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key' differs:
--- old datastream
+++ new datastream
@@ -1,9 +1,9 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-readarray -t files < <(find /etc/ssh/ -maxdepth 1)
+readarray -t files < <(find /etc/ssh/ -maxdepth 1 -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*_key$'; then
+ if basename "$file" | grep -qE '^.*_key$'; then
 chmod 0600 "$file"
 fi 
 done

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key' differs:
--- old datastream
+++ new datastream
@@ -1,9 +1,9 @@
 # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
-readarray -t files < <(find /etc/ssh/ -maxdepth 1)
+readarray -t files < <(find /etc/ssh/ -maxdepth 1 -type f)
 for file in "${files[@]}"; do
- if basename $file | grep -qE '^.*.pub$'; then
+ if basename "$file" | grep -qE '^.*.pub$'; then
 chmod 0644 "$file"
 fi 
 done

Mab879 · 2022-03-24T19:39:47Z

Looks like another push is needed to get GH Actions to run.

This test sets expectation on behavior of the rule. Symlinks are ignored, even when they have incompliant owner, and point to nowhere.

vojtapolasek

LGTM, thank you for quick fix

yuumasato added 2 commits March 24, 2022 19:10

Prevent breaking the paths with spaces

04027f3

yuumasato added the bugfix Fixes to reported bugs. label Mar 24, 2022

yuumasato added this to the 0.1.61 milestone Mar 24, 2022

yuumasato requested a review from ggbecker March 24, 2022 18:44

Update test scenario to align with OVAL behavior

c5feb75

This test sets expectation on behavior of the rule. Symlinks are ignored, even when they have incompliant owner, and point to nowhere.

yuumasato force-pushed the file_permissions_library_dirs_shall_act_on_files branch from dff39d1 to c5feb75 Compare March 25, 2022 08:21

vojtapolasek self-assigned this Mar 25, 2022

vojtapolasek approved these changes Mar 25, 2022

View reviewed changes

vojtapolasek merged commit a8bb925 into ComplianceAsCode:stabilization-v0.1.61 Mar 25, 2022

yuumasato deleted the file_permissions_library_dirs_shall_act_on_files branch March 25, 2022 09:43

This was referenced Mar 31, 2022

Make handling of symlinks in file_ownership_library_dirs and similar rules consistent #8412

Closed

file_owner, file_groupowner, file_permission changed to not follow symlinks #8466

Merged

yuumasato mentioned this pull request Jun 23, 2022

RHEL8: Fix rules breaking sudo command #9024

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

File permissions library dirs shall act on files when 'file_regex' is set#8420

File permissions library dirs shall act on files when 'file_regex' is set#8420
vojtapolasek merged 3 commits intoComplianceAsCode:stabilization-v0.1.61from
yuumasato:file_permissions_library_dirs_shall_act_on_files

yuumasato commented Mar 24, 2022

Uh oh!

github-actions Bot commented Mar 24, 2022 •

edited

Loading

Uh oh!

yuumasato commented Mar 24, 2022

Uh oh!

github-actions Bot commented Mar 24, 2022

Uh oh!

Mab879 commented Mar 24, 2022

Uh oh!

vojtapolasek left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

yuumasato commented Mar 24, 2022

Description:

Rationale:

Uh oh!

github-actions Bot commented Mar 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yuumasato commented Mar 24, 2022

Uh oh!

github-actions Bot commented Mar 24, 2022

Uh oh!

Mab879 commented Mar 24, 2022

Uh oh!

vojtapolasek left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Mar 24, 2022 •

edited

Loading