Stabilization: Fix remediations for file_permissions_audit_configuration_stig - #15019

[macko1]

Cherry pick from #15019

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig'.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -7,6 +7,9 @@
 [description]:
 All audit configuration files permissions must be 600 or more restrictive.
 chmod 0600 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
+
+[warning]:
+augenrules --load resets permissions of /etc/audit/audit.rules to 0640, undoing remediation (0600). Fix: A systemd dropin for audit service is installed at /etc/systemd/system/auditd.service.d/permissions.confwith ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules. This dropin is necessary to restore 0600 permissions after augenrules runs and rewrites the /etc/audit/audit.rules file. systemd runs both commands in order, restoring 0600. Use service auditd restart to reload and apply the drop-in when remediating manually.
 
 [reference]:
 AU-12 b

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -1,9 +1,40 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
 
-find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+# Copied and modified from `file_permissions/bash.template` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
 
-find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*\.rules$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+find /etc/audit/ -maxdepth 1 -type f \
+    -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+find /etc/audit/rules.d/ -maxdepth 1 -type f -name '*.rules' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
+
+# Generate the dropin file content to restore 0600 on audit.rules after augenrules rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
+
+mkdir -p /etc/systemd/system/auditd.service.d
+chmod 0755 /etc/systemd/system/auditd.service.d
+
+cat > /etc/systemd/system/auditd.service.d/permissions.conf << 'EOF'
+[Service]
+ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+EOF
+chmod 0644 /etc/systemd/system/auditd.service.d/permissions.conf
+restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+
+systemctl daemon-reload
+# IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
+service auditd restart
+
+fi
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -12,13 +12,19 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/ file(s)
-  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*audit(\.rules|d\.conf)$"
-  register: files_found
-  changed_when: false
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Set /etc/audit/audit.rules
+    and /etc/audit/auditd.conf to 0600, owned by root
+  ansible.builtin.file:
+    path: '{{ item }}'
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop:
+  - /etc/audit/audit.rules
+  - /etc/audit/auditd.conf
   failed_when: false
-  check_mode: false
+  register: audit_config_perms
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -33,13 +39,14 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /etc/audit/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Find /etc/audit/rules.d/*.rules
+    files
+  ansible.builtin.find:
+    paths: /etc/audit/rules.d/
+    depth: 1
+    file_type: file
+    patterns: '*.rules'
+  register: rules_files
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -54,13 +61,16 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/rules.d/ file(s)
-  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*\.rules$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Set /etc/audit/rules.d/*.rules
+    files to 0600, owned by root
+  ansible.builtin.file:
+    path: '{{ item.path }}'
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop: '{{ rules_files.files }}'
+  register: rules_dir_perms
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -75,14 +85,44 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /etc/audit/rules.d/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
+- name: Audit Configuration Files Permissions are 600 or More Restrictive - Install
+    ExecStartPost dropin on auditd.service
+  block:
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Create
+      dropin directory /etc/systemd/system/auditd.service.d
+    ansible.builtin.file:
+      path: /etc/systemd/system/auditd.service.d
+      state: directory
+      mode: '0755'
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Install
+      /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.copy:
+      dest: /etc/systemd/system/auditd.service.d/permissions.conf
+      content: |
+        [Service]
+        ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+      mode: '0644'
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Restore
+      SELinux context on /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.command: restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+    changed_when: false
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Reload
+      systemd daemon to pick up permissions.conf
+    ansible.builtin.systemd:
+      daemon_reload: true
+
+  - name: Audit Configuration Files Permissions are 600 or More Restrictive - Restart
+      auditd.service
+    ansible.builtin.command: service auditd restart
+    when:
+    - audit_config_perms.changed or rules_dir_perms.changed
   when:
+  - '"audit" in ansible_facts.packages'
+  - '"kernel-core" in ansible_facts.packages'
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
   tags:

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.