Fix remediations for file_permissions_audit_configuration_stig

[macko1]

Description:

• Fix the Ansible and Bash remediations for file_permissions_audit_configuration_stig so that /etc/audit/audit.rules and the other audit configuration files stay 0600 even after augenrules --load rewrites audit.rules back to 0640. A systemd dropin (ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules on auditd.service) is installed to restore the permission after every augenrules run.

Rationale:

• The previous remediation only ran a one-time chmod on the audit config files. augenrules resets /etc/audit/audit.rules to 0640 on every reload triggered by changes under /etc/audit/rules.d/, silently undoing the fix and leaving the system out of compliance again. The dropin makes the 0600 permission durable across reloads, and a matching warning was added to rule.yml to document the behavior.

Review Hints:

• Build: ./build_product rhel9
• Test with Automatus: python3 tests/automatus.py rule --libvirt qemu:///system <vm_name> file_permissions_audit_configuration_stig

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig'.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -7,6 +7,9 @@
 [description]:
 All audit configuration files permissions must be 600 or more restrictive.
 chmod 0600 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
+
+[warning]:
+augenrules --load resets permissions of /etc/audit/audit.rules to 0640, undoing remediation (0600). Fix: A systemd dropin for audit service is installed at /etc/systemd/system/auditd.service.d/permissions.confwith ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules. This dropin is necessary to restore 0600 permissions after augenrules runs and rewrites the /etc/audit/audit.rules file. systemd runs both commands in order, restoring 0600. Use service auditd restart to reload and apply the drop-in when remediating manually.
 
 [reference]:
 AU-12 b

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -1,9 +1,40 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
 
-find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+# Copied and modified from `file_permissions/bash.template` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
 
-find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*\.rules$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+find /etc/audit/ -maxdepth 1 -type f \
+    -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+find /etc/audit/rules.d/ -maxdepth 1 -type f -name '*.rules' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
+
+# Generate the dropin file content to restore 0600 on audit.rules after augenrules rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
+
+mkdir -p /etc/systemd/system/auditd.service.d
+chmod 0755 /etc/systemd/system/auditd.service.d
+
+cat > /etc/systemd/system/auditd.service.d/permissions.conf << 'EOF'
+[Service]
+ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+EOF
+chmod 0644 /etc/systemd/system/auditd.service.d/permissions.conf
+restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+
+systemctl daemon-reload
+# IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
+service auditd restart
+
+fi
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -12,13 +12,19 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/ file(s)
-  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*audit(\.rules|d\.conf)$"
-  register: files_found
-  changed_when: false
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Set /etc/audit/audit.rules
+    and /etc/audit/auditd.conf to 0600, owned by root
+  ansible.builtin.file:
+    path: '{{ item }}'
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop:
+  - /etc/audit/audit.rules
+  - /etc/audit/auditd.conf
   failed_when: false
-  check_mode: false
+  register: audit_config_perms
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -33,13 +39,14 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /etc/audit/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Find /etc/audit/rules.d/*.rules
+    files
+  ansible.builtin.find:
+    paths: /etc/audit/rules.d/
+    depth: 1
+    file_type: file
+    patterns: '*.rules'
+  register: rules_files
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -54,13 +61,16 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/rules.d/ file(s)
-  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*\.rules$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Set /etc/audit/rules.d/*.rules
+    files to 0600, owned by root
+  ansible.builtin.file:
+    path: '{{ item.path }}'
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop: '{{ rules_files.files }}'
+  register: rules_dir_perms
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -75,14 +85,44 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /etc/audit/rules.d/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Install
+    ExecStartPost dropin on auditd.service
+  block:
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Create
+      dropin directory /etc/systemd/system/auditd.service.d
+    ansible.builtin.file:
+      path: /etc/systemd/system/auditd.service.d
+      state: directory
+      mode: '0755'
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Install
+      /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.copy:
+      dest: /etc/systemd/system/auditd.service.d/permissions.conf
+      content: |
+        [Service]
+        ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+      mode: '0644'
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Restore
+      SELinux context on /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.command: restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+    changed_when: false
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Reload
+      systemd daemon to pick up permissions.conf
+    ansible.builtin.systemd:
+      daemon_reload: true
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Restart
+      auditd.service
+    ansible.builtin.command: service auditd restart
+    when:
+    - audit_config_perms.changed or rules_dir_perms.changed
   when:
+  - '"audit" in ansible_facts.packages'
+  - '"kernel-core" in ansible_facts.packages'
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
   tags:

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[Mab879]

You need to you use service to restart audit, it is special, see https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/security_hardening/auditing-the-system_security-hardening

[macko1]

I tried and it was failing, so I used the workaround from the solution.

[macko1]

It was failing with the error mentioned in the solution Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by dependency only (it is configured to refuse manual start/stop).

[macko1]

It was failing, because ansible.builtin.service seems to pick systemctl...

I will check what is the correct approach.

[macko1]

updated, PTAL

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

Requested changes made.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[openshift-ci]

@macko1: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	c719f9a	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.