Add rule accounts_user_interactive_home_directory_on_separate_partition#14370
Conversation
vojtapolasek
requested review from
Mab879,
jan-cerny and
matusmarhefka
as code owners
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
Can you provide the STIG ref that you using for this?
I will note that this PR doesn't seem to add this rule to any profiles. While this might be intentional, the reason why I am bring this up is the review instructions seem to assume that this PR added it.
| <ind:textfilecontent54_object id="object_{{{ rule_id }}}_interactive_users" version="1"> | ||
| <ind:filepath>/etc/passwd</ind:filepath> | ||
| <ind:pattern operation="pattern match" | ||
| >^(?:(?!nobody|nfsnobody)[^:]*):(?:[^:]*:)[1-9]\d{3,}:(?:[^:]*:){2}([^:]+):(?!(?:/usr)?/sbin/nologin$|/bin/false$)[^:]*$</ind:pattern> |
There was a problem hiding this comment.
Should we include /usr/bin/false?
\d{3,} is doing some assuming of the min uid. This might be fine, but something to think about.
|
|
||
| . $SHARED/partition.sh | ||
|
|
||
| awk -F':' '{if ($3>={{{ uid_min }}} && $3!= {{{ nobody_uid }}}) print $1}' /etc/passwd \ |
There was a problem hiding this comment.
Should this use bash_remove_interactive_users_from_passwd_by_uid()?
|
/packit retest-failed |
|
Regarding the STIG ref, I did not include it here because after merging this PR, I wanted to add the new control into the PR #14375 . The PR updates the STIG references. I think that if I would add the STIG control in the PR which adds the rule, it would cause tests to fail. |
|
I updated the OVAL to skip users which have '.nologin.' as a shell. I also use macro in test scenarios now. |
|
/packit build |
|
/retest-required |
1 similar comment
|
/retest-required |
vojtapolasek
force-pushed
the
add_rule_home_dirs_on_separate_partition
branch
from
5faa8ad to
1ad1c01
Compare
|
/packit retest-all |
vojtapolasek
force-pushed
the
add_rule_home_dirs_on_separate_partition
branch
from
1ad1c01 to
51e35d7
Compare
|
Something is off, 9babdbf shouldn't be on this PR. |
|
/packit retest-failed |
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
Please review the commits on this branch.
vojtapolasek
force-pushed
the
add_rule_home_dirs_on_separate_partition
branch
from
51e35d7 to
663217e
Compare
2 participants
Description:
accounts_user_interactive_home_directory_on_separate_partitionthat checks whether all interactive user home directories reside on a file system partition separate from the root (/) partition. The rule hasmediumseverity, targets rhel8 (CCE-86459-5), and includes a custom OVAL check. No remediation is provided (check-only rule). The rule is added to theoperating-systemcomponent and applies to themachineplatform./etc/passwdand verifies each home directory matches a non-root mount point.Rationale:
Review Hints:
oval/shared.xmlcarefully, particularly the/etc/passwdpattern match and the mount point regex construction.# remediation = nonesince this is a check-only rule with no automated fix../build_product --datastream-only rhel8linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/rule.ymllinux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_on_separate_partition/oval/shared.xmltests/subdirectory