Skip to content

[Ubuntu] Allow sys uid and empty user group - #13825

Merged
Mab879 merged 2 commits into
ComplianceAsCode:masterfrom
alanmcanonical:var_log_user
Sep 4, 2025
Merged

[Ubuntu] Allow sys uid and empty user group#13825
Mab879 merged 2 commits into
ComplianceAsCode:masterfrom
alanmcanonical:var_log_user

Conversation

@alanmcanonical

@alanmcanonical alanmcanonical commented Aug 26, 2025

Copy link
Copy Markdown
Contributor

Description:

ownership (check if any of the following satisfy):

  • owned by root or syslog
  • UID of file must be < UID_MIN

group-ownership (check if any of the following satisfy):

  • group-owned by root or adm
  • group of files must not have extra users
  • all uids whose primary group == group must be < UID_MIN

Rationale:

  • Align with cis v2 jammy benchmark complex bash audit script

@openshift-ci openshift-ci Bot added the needs-ok-to-test Used by openshift-ci bot. label Aug 26, 2025
@openshift-ci

openshift-ci Bot commented Aug 26, 2025

Copy link
Copy Markdown

Hi @alanmcanonical. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@alanmcanonical
alanmcanonical marked this pull request as draft August 26, 2025 17:30
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Aug 26, 2025
Signed-off-by: Alan Moore <alan.moore@canonical.com>
Signed-off-by: Alan Moore <alan.moore@canonical.com>
@alanmcanonical
alanmcanonical marked this pull request as ready for review September 1, 2025 10:14
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 1, 2025
@alanmcanonical alanmcanonical changed the title [Ubuntu] Allow both root and syslog uid [Ubuntu] Allow sys uid and empty user group Sep 2, 2025
@dodys dodys self-assigned this Sep 2, 2025
@dodys dodys added Ubuntu Ubuntu product related. CIS CIS Benchmark related. labels Sep 2, 2025
@dodys dodys added this to the 0.1.79 milestone Sep 2, 2025
@dodys
dodys requested a review from a team September 4, 2025 11:26

@dodys dodys left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@Mab879 Mab879 added the Update Rule Issues or pull requests related to Rules updates. label Sep 4, 2025
@Mab879
Mab879 merged commit cd02e4e into ComplianceAsCode:master Sep 4, 2025
121 of 122 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CIS CIS Benchmark related. needs-ok-to-test Used by openshift-ci bot. Ubuntu Ubuntu product related. Update Rule Issues or pull requests related to Rules updates.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants