Use symbolic file mode for /etc/audit/auditd.conf

[jan-cerny]

Keeps permissions intact if they are already stricter than expected. Also, avoids the implicit conversion of the file mode from octal number (0640) to decimal number (416).

Fixes: failing rule file_permissions_audit_configuration_stig in contest tests /hardening/ansible/stig, /hardening/host-os/ansible/stig on RHEL 8.10, 9.2 and 9.9.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action
@@ -28,7 +28,7 @@
     regexp: ^\s*disk_error_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig
@@ -26,7 +26,7 @@
     regexp: ^\s*disk_error_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action
@@ -28,7 +28,7 @@
     regexp: ^\s*disk_full_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig
@@ -26,7 +26,7 @@
     regexp: ^\s*disk_full_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct
@@ -31,7 +31,7 @@
     line: action_mail_acct = {{ var_auditd_action_mail_acct }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action
@@ -33,7 +33,7 @@
     regexp: ^\s*admin_space_left_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_percentage
@@ -27,7 +27,7 @@
     regexp: ^\s*admin_space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_flush' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_flush
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_flush
@@ -25,7 +25,7 @@
     line: flush = {{ var_auditd_flush }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file
@@ -26,7 +26,7 @@
     line: max_log_file = {{ var_auditd_max_log_file }}
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action
@@ -29,7 +29,7 @@
     regexp: ^\s*max_log_file_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action_stig
@@ -27,7 +27,7 @@
     regexp: ^\s*max_log_file_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs
@@ -27,7 +27,7 @@
     regexp: ^\s*num_logs\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left
@@ -30,7 +30,7 @@
     regexp: ^\s*space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action
@@ -33,7 +33,7 @@
     regexp: ^\s*space_left_action\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage' differs.
--- xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage
+++ xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_percentage
@@ -29,7 +29,7 @@
     regexp: ^\s*space_left\s*=\s*.*$
     state: present
     create: true
-    mode: 416
+    mode: u-x,g-wx,o-rwx
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_freq' differs.
--- xccdf_org.ssgproject.content_rule_auditd_freq
+++ xccdf_org.ssgproject.content_rule_auditd_freq
@@ -24,7 +24,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -35,7 +35,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -44,7 +44,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*freq\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: freq = {{ var_auditd_freq }}
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_local_events' differs.
--- xccdf_org.ssgproject.content_rule_auditd_local_events
+++ xccdf_org.ssgproject.content_rule_auditd_local_events
@@ -20,7 +20,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -31,7 +31,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -40,7 +40,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*local_events\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: local_events = yes
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_log_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_log_format
+++ xccdf_org.ssgproject.content_rule_auditd_log_format
@@ -21,7 +21,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -32,7 +32,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -41,7 +41,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*log_format\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: log_format = ENRICHED
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_name_format' differs.
--- xccdf_org.ssgproject.content_rule_auditd_name_format
+++ xccdf_org.ssgproject.content_rule_auditd_name_format
@@ -49,6 +49,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -59,6 +60,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -67,6 +69,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*name_format\s*=\s*
+      mode: u-x,g-wx,o-rwx
       line: name_format = {{ auditd_name_format_split }}
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_overflow_action' differs.
--- xccdf_org.ssgproject.content_rule_auditd_overflow_action
+++ xccdf_org.ssgproject.content_rule_auditd_overflow_action
@@ -20,6 +20,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -30,6 +31,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -38,6 +40,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*overflow_action\s*=\s*
+      mode: u-x,g-wx,o-rwx
       line: overflow_action = syslog
       state: present
   when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_auditd_write_logs' differs.
--- xccdf_org.ssgproject.content_rule_auditd_write_logs
+++ xccdf_org.ssgproject.content_rule_auditd_write_logs
@@ -19,7 +19,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     check_mode: true
     changed_when: false
@@ -30,7 +30,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       state: absent
     when: dupes.found is defined and dupes.found > 1
 
@@ -39,7 +39,7 @@
       path: /etc/audit/auditd.conf
       create: true
       regexp: (?i)(?i)^\s*write_logs\s*=\s*
-      mode: '0640'
+      mode: u-x,g-wx,o-rwx
       line: write_logs = yes
       state: present
   when:

[openshift-ci]

@jan-cerny: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	3829ad7	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[macko1]

The update fixes failing xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig rule with removing the file modes instead of hardcoding them. I like that approach.

LGTM, just update the PR description to a more readable format,

#### Description:
- Changes `mode: 0640` to `mode: u-x,g-wx,o-rwx` in all ansible tasks targeting `/etc/audit/auditd.conf`.
- Eliminates the YAML 1.1 octal-to-decimal conversion for these files: the playbook renders `mode: 416` instead of `mode: 0640`, which is confusing but functionally equivalent.
  
#### Rationale:
- Before: `mode: 0640` overwrites existing permissions. If `/etc/audit/auditd.conf` already has `0600` or stricter, the task loosens it to `0640` and the `file_permissions_audit_configuration_stig` rule fails.

  
#### Review Hints:
- Tested in `/hardening/ansible/stig` and `/hardening/host-os/ansible/stig` on RHEL 8.10, 9.2, and 9.9.

or something similar

Thanks for the update1

[Mab879]

/packit rebuild-failed