file_ownerships_var_log: handle systems without a syslog user - #15118
file_ownerships_var_log: handle systems without a syslog user#15118israel-villar wants to merge 1 commit into
Conversation
The OVAL read the syslog uid from /etc/passwd into a local_variable and compared every /var/log file's owner against it. On systems that use syslog-ng instead of rsyslog there is no 'syslog' user, so the variable had no value and any non-root-owned file made the whole check evaluate to 'error' instead of a real pass/fail. Split the criteria: when a dedicated syslog user exists, require owner root or syslog (unchanged); when it does not, require owner root only. The syslog uid variable is now only evaluated in the branch where it has a value. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015YN4ez6hrFpegisiLLo3zx
|
Hi @israel-villar. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_file_ownerships_var_log' differs.
--- oval:ssg-file_ownerships_var_log:def:1
+++ oval:ssg-file_ownerships_var_log:def:1
@@ -1,2 +1,7 @@
+criteria OR
criteria AND
+criterion oval:ssg-file_ownerships_var_log_test_syslog_user_present:tst:1
criterion oval:ssg-test_file_ownership_var_log:tst:1
+criteria AND
+criterion oval:ssg-file_ownerships_var_log_test_syslog_user_absent:tst:1
+criterion oval:ssg-file_ownerships_var_log_test_file_ownership_var_log_root_only:tst:1 |
1 participant
Description:
file_ownerships_var_loginto two branches:sysloguser exists → require ownerrootorsyslog(unchanged behaviour);sysloguser → require ownerrootonly.sysloguidlocal_variableis now only referenced in the branch where it is guaranteed to have a value. Definitionversionbumped to2.Rationale:
syslog-nginstead ofrsyslogthere is no dedicatedsysloguser, so thelocal_variablethat reads its uid from/etc/passwdhas no value.error. As a result, on such a system any non-root-owned file under/var/logmade the whole rule reporterrorinstead of a meaningfulpass/fail.Review Hints:
file_ownerships_var_log/oval/shared.xml../build_product debian13 rhel9 ubuntu2404 sle15 --datastream,ctestand OVAL schema validation pass.syslog-nghost: the rule changes fromerrorto a realfail/pass.