Remove untestable missing.pass.sh scenario for file_permissions_sshd_private_key - #15040
Merged
Mab879 merged 1 commit intoAug 25, 2026
Merged
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
The missing.pass.sh scenario for file_permissions_sshd_private_key was included accidentally in PR ComplianceAsCode#15015. It cannot be validated by Automatus: every backend (libvirt and container) scans the target over SSH via oscap-ssh, but the scenario's 'rm -f /etc/ssh/*' deletes the SSH host keys that transport depends on. Modern OpenSSH re-execs a fresh sshd per connection and reloads the host keys from disk, so the scan connection is reset (kex_exchange_identification: Connection reset by peer) before the rule can be evaluated. It also carried a '# remediation = none' directive, which is invalid for a .pass.sh test and was flagged by the test-scenario linter. The behavior it aimed to cover - no key files present means no offending keys, so the check passes - is already guaranteed by the OVAL check_existence="none_exist" semantics and needs no runtime scenario.
ggbecker
force-pushed
the
fix-missing-pass-remediation-none
branch
from
August 24, 2026 22:44
263aa7a to
c7b51f9
Compare
ggbecker
changed the title
ggbecker
marked this pull request as ready for review
August 24, 2026 22:46
ggbecker
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
August 24, 2026 22:46
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
ggbecker
added
do-not-merge/work-in-progress
|
@ggbecker: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Mab879
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Removes the
missing.pass.shtest scenario forfile_permissions_sshd_private_key.Rationale
The scenario was included accidentally in #15015 and cannot be validated by Automatus on any backend:
oscap-ssh.rm -f /etc/ssh/*deletes the SSH host keys that transport depends on.sshdper connection and reloads host keys from disk, so the scan connection is reset (kex_exchange_identification: read: Connection reset by peer) before the rule can be evaluated.It also carried a
# remediation = nonedirective, which is invalid for a.pass.shtest and was flagged by the test-scenario linter:The behavior the scenario aimed to cover — when no key files are present there are no offending keys, so the check passes — is already guaranteed by the OVAL
check_existence="none_exist"semantics and needs no runtime scenario.Verification
Reproduced the SSH-transport failure on a rhel9 libvirt VM (initial scan reset before evaluation) and confirmed that even surgical
*_key-only removal breaks new SSH connections, since sshd is the classicsshd.service(not socket-activated) yet OpenSSH still reloads host keys on each re-exec.