fixes in file_groupownership template

applications/openshift/master/file_groupowner_cni_conf/rule.yml

@@ -34,5 +34,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/etc/cni/net.d/.*$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_controller_manager_kubeconfig/rule.yml

@@ -42,5 +42,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/configmaps/controller-manager-kubeconfig/kubeconfig$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_etcd_data_dir/rule.yml

@@ -41,4 +41,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /var/lib/etcd/member/
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_etcd_data_files/rule.yml

@@ -41,5 +41,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/var/lib/etcd/member/wal/.*$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_etcd_member/rule.yml

@@ -43,5 +43,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/etc/kubernetes/static-pod-resources/etcd-pod-.*/etcd-pod.yaml$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_etcd_pki_cert_files/rule.yml

@@ -56,5 +56,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.crt$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_ip_allocations/rule.yml

@@ -35,5 +35,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/var/lib/cni/networks/openshift-sdn/.*$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_kube_apiserver/rule.yml

@@ -41,4 +41,4 @@ template:
     vars:
         filepath: "^/etc/kubernetes/static-pod-resources/kube-apiserver-pod-.*/kube-apiserver-pod.yaml$"
         filepath_is_regex: "true"
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_kube_controller_manager/rule.yml

@@ -41,4 +41,4 @@ template:
     vars:
         filepath: '^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$'
         filepath_is_regex: 'true'
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_kube_scheduler/rule.yml

@@ -40,5 +40,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/kube-scheduler-pod.yaml$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_kubeconfig/rule.yml

@@ -28,4 +28,4 @@ ocil: |-
 #    name: file_groupowner
 #    vars:
 #        filepath: /etc/kubernetes/kubeconfig
-#        filegid: '0'
+#        gid_or_name: '0'

applications/openshift/master/file_groupowner_master_admin_kubeconfigs/rule.yml

@@ -46,5 +46,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_multus_conf/rule.yml

@@ -34,5 +34,5 @@ template:
     name: file_groupowner
     vars:
         filepath: ^/var/run/multus/cni/net.d/.*$
-        filegid: '0'
+        gid_or_name: '0'
         filepath_is_regex: "true"

applications/openshift/master/file_groupowner_openshift_pki_cert_files/rule.yml

@@ -56,5 +56,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/tls\.crt$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_openshift_pki_key_files/rule.yml

@@ -56,5 +56,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_openshift_sdn_cniserver_config/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /var/run/openshift-sdn/cniserver/config.json
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_openvswitch/rule.yml

@@ -30,4 +30,4 @@ template:
     vars:
         filepath: /etc/openvswitch/
         file_regex: ^.*$
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_ovn_cni_server_sock/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /run/ovn-kubernetes/cni/ovn-cni-server.sock
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/master/file_groupowner_ovn_db_files/rule.yml

@@ -35,5 +35,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/var/lib/ovn/etc/*.db$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/master/file_groupowner_ovs_conf_db_lock_not_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/.conf.db.~lock~
-        filegid: 'hugetlbfs'
+        gid_or_name: 'hugetlbfs'

applications/openshift/master/file_groupowner_ovs_conf_db_lock_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/.conf.db.~lock~
-        filegid: 'hugetlbfs'
+        gid_or_name: 'hugetlbfs'

applications/openshift/master/file_groupowner_ovs_conf_db_not_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/conf.db
-        filegid: 'hugetlbfs'
+        gid_or_name: 'hugetlbfs'

applications/openshift/master/file_groupowner_ovs_conf_db_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/conf.db
-        filegid: openvswitch
+        gid_or_name: openvswitch

applications/openshift/master/file_groupowner_ovs_sys_id_conf_not_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/system-id.conf
-        filegid: 'hugetlbfs'
+        gid_or_name: 'hugetlbfs'

applications/openshift/master/file_groupowner_ovs_sys_id_conf_s390x/rule.yml

@@ -35,4 +35,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/openvswitch/system-id.conf
-        filegid: 'hugetlbfs'
+        gid_or_name: 'hugetlbfs'

applications/openshift/master/file_groupowner_scheduler_kubeconfig/rule.yml

@@ -42,5 +42,5 @@ template:
   name: file_groupowner
   vars:
     filepath: ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$
-    filegid: '0'
+    gid_or_name: '0'
     filepath_is_regex: "true"

applications/openshift/worker/file_groupowner_kubelet_conf/rule.yml

@@ -39,4 +39,4 @@ template:
     name: file_groupowner
     vars:
         filepath: {{{ kubeletconf_path }}}
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/worker/file_groupowner_worker_ca/rule.yml

@@ -33,4 +33,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/kubernetes/kubelet-ca.crt
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/worker/file_groupowner_worker_kubeconfig/rule.yml

@@ -33,4 +33,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /var/lib/kubelet/kubeconfig
-        filegid: '0'
+        gid_or_name: '0'

applications/openshift/worker/file_groupowner_worker_service/rule.yml

@@ -36,4 +36,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/systemd/system/kubelet.service
-        filegid: '0'
+        gid_or_name: '0'

docs/templates/template_reference.md

@@ -279,7 +279,10 @@
         subdirectories under the directory specified by **filepath**. Default
         value is `"false"`.
 
-    -   **filegid** - group ID (GID)
+    -   **gid_or_name** - group ID (GID) or a group name.
+        If the parameter is an integer, it is treated as group ID. If the
+        parameter is not an integer, it is treated as a group name and it is
+        converted to GID by reading /etc/group.
 
 -   Languages: Ansible, Bash, OVAL
 

linux_os/guide/services/cron_and_at/file_groupowner_cron_d/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/cron.d/
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/cron.daily/
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/file_groupowner_cron_hourly/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/cron.hourly/
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/file_groupowner_cron_monthly/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/cron.monthly/
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/file_groupowner_cron_weekly/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/cron.weekly/
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/file_groupowner_crontab/rule.yml

@@ -53,4 +53,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/crontab
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_at_allow/rule.yml

@@ -43,4 +43,4 @@ template:
     vars:
         filepath: /etc/at.allow
         missing_file_pass: 'true'
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_cron_allow/rule.yml

@@ -54,4 +54,4 @@ template:
     vars:
         filepath: /etc/cron.allow
         missing_file_pass: 'true'
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/obsolete/inetd_and_xinetd/file_groupowner_etc_hosts_allow/rule.yml

@@ -29,5 +29,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/hosts.allow
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/services/obsolete/inetd_and_xinetd/file_groupowner_etc_hosts_deny/rule.yml

@@ -29,5 +29,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/hosts.deny
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml

@@ -55,4 +55,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/ssh/sshd_config
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/services/ssh/file_groupownership_sshd_private_key/rule.yml

@@ -35,4 +35,4 @@ template:
             - /etc/ssh/
         file_regex:
             - ^.*_key$
-        filegid: '{{{ dedicated_ssh_groupname if dedicated_ssh_groupname else '0' }}}'
+        gid_or_name: '{{{ dedicated_ssh_groupname if dedicated_ssh_groupname else '0' }}}'

linux_os/guide/services/ssh/file_groupownership_sshd_private_key/tests/correct_groupowner.pass.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
 # platform = multi_platform_ol,multi_platform_rhel
 
+if ! grep -q ssh_keys /etc/group; then
+    groupadd ssh_keys
+fi
+
 FAKE_KEY=$(mktemp -p /etc/ssh/ XXXX_key)
 chgrp ssh_keys "$FAKE_KEY"

linux_os/guide/services/ssh/file_groupownership_sshd_private_key/tests/test_config.yml

@@ -0,0 +1,2 @@
+deny_templated_scenarios:
+    - missing_file_test.pass.sh

linux_os/guide/services/ssh/file_groupownership_sshd_pub_key/rule.yml

@@ -34,5 +34,5 @@ template:
             - /etc/ssh/
         file_regex:
             - ^.*\.pub$
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/services/ssh/file_groupownership_sshd_pub_key/tests/missing_file_test.pass.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+# platform = multi_platform_ol,multi_platform_rhel
+
+rm -f /etc/ssh/*.pub

linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue/rule.yml

@@ -43,4 +43,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/issue
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue_net/rule.yml

@@ -41,5 +41,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/issue.net
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_motd/rule.yml

@@ -43,5 +43,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/motd
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/system/accounts/accounts-session/file_groupownership_lastlog/rule.yml

@@ -32,4 +32,4 @@ template:
     name: file_groupowner
     vars:
         filepath: /usr/bin/lastlog
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/auditing/auditd_configure_rules/file_groupownership_audit_configuration/rule.yml

@@ -40,4 +40,4 @@ template:
         file_regex:
             - ^audit(\.rules|d\.conf)$
             - ^.*\.rules$
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_grub2_cfg/rule.yml

@@ -61,4 +61,4 @@ template:
     name: file_groupowner
     vars:
         filepath: {{{ grub2_boot_path }}}/grub.cfg
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_user_cfg/rule.yml

@@ -54,4 +54,4 @@ template:
     name: file_groupowner
     vars:
         filepath: {{{ grub2_boot_path }}}/user.cfg
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml

@@ -50,4 +50,4 @@ template:
     name: file_groupowner
     vars:
         filepath: {{{ grub2_uefi_boot_path }}}/grub.cfg
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_user_cfg/rule.yml

@@ -48,4 +48,4 @@ template:
     name: file_groupowner
     vars:
         filepath: {{{ grub2_uefi_boot_path }}}/user.cfg
-        filegid: '0'
+        gid_or_name: '0'

linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_group/rule.yml

@@ -47,5 +47,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/group-
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'

linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_gshadow/rule.yml

@@ -52,11 +52,11 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/gshadow-
-        filegid: '0'
-        filegid@debian10: '42'
-        filegid@debian11: '42'
-        filegid@ubuntu1604: '42'
-        filegid@ubuntu1804: '42'
-        filegid@ubuntu2004: '42'
-        filegid@ubuntu2204: '42'
+        gid_or_name: '0'
+        gid_or_name@debian10: '42'
+        gid_or_name@debian11: '42'
+        gid_or_name@ubuntu1604: '42'
+        gid_or_name@ubuntu1804: '42'
+        gid_or_name@ubuntu2004: '42'
+        gid_or_name@ubuntu2204: '42'
         missing_file_pass: 'true'

linux_os/guide/system/permissions/files/permissions_important_account_files/file_groupowner_backup_etc_passwd/rule.yml

@@ -47,5 +47,5 @@ template:
     name: file_groupowner
     vars:
         filepath: /etc/passwd-
-        filegid: '0'
+        gid_or_name: '0'
         missing_file_pass: 'true'