Error during evaluation of file_groupowner_var_log_syslog on RHEL 7

[jan-cerny]

Description of problem:

When we scan a RHEL 7 machine with the virtual (all) profile, we get an error message about evaluation of rule file_groupowner_var_log_syslog. This issue happened during downstream test /CoreOS/scap-security-guide/Sanity/smoke-scan on RHEL 7.

The same problem happens also when we scan an UBI 7 image using oscap-docker with the virtual (all) profile, we get an error message about evaluation of rule file_groupowner_var_log_syslog. This issue has happened during downstream test /CoreOS/scap-security-guide/Sanity/container-scanning on RHEL 7.

SCAP Security Guide Version:

current upstream master branch as of 2023-05-29 as of HEAD 47955e5

Operating System Version:

RHEL 7

Steps to Reproduce:

Locally:

1. oscap xccdf eval --oval-results --progress --report all.html --profile '(all)' /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

With UBI 7 and oscap-docker:

1. oscap-docker image registry.access.redhat.com/ubi7 xccdf eval --progress --benchmark-id xccdf_org.ssgproject.content_benchmark_RHEL-7 --profile "(all)" /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 1> output.stdout 2> output.stderr

Actual Results:

stderr contains error message:

E: oscap:     Failed to convert OVAL state to SEXP, id: oval:ssg-state_file_groupowner_var_log_syslog_gid_4_0:ste:1.

Expected Results:

no errors

Additional Information/Debugging Steps:

no

[vojtapolasek]

I believe it is caused by this commit:
44cba45
This commit treats all filegids which are not equal to 0 as group names. But here we set the filegid to 4 and we need to treat it as a gid, not a group name. I will fix that. Moreover, I will document the behavior, because currently it is not documented.
@ggbecker please confirm if I am going in the right way since you are author of the commit-

[ggbecker]

@vojtapolasek these are the pull requests:

#10622
#10552

[jan-cerny]

FTR I confirm this issue is present in current upstream stabilization-v0.1.68 branch as of 2023-06-02 as of HEAD b630293.