Update Account Home Folder Rules

[Mab879]

Description:

The following now skip users with home folders defined as /.

• Macros
  • bash_restrict_permissions_home_directories
  • ansible_restrict_permissions_home_directories
• Rules
  • accounts_users_home_files_groupownership
  • accounts_users_home_files_ownership

Rationale:

Ensuring the scripts complete successfully with a user doesn't a proper home folder defined.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -1,5 +1,5 @@
 
-for user in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $1 }' /etc/passwd); do
+for user in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && $6 != "/") print $1 }' /etc/passwd); do
     home_dir=$(getent passwd $user | cut -d: -f6)
     group=$(getent passwd $user | cut -d: -f4)
     # Only update the group-ownership when necessary. This will avoid changing the inode timestamp

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_groupownership
@@ -34,6 +34,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - CCE-86534-5
   - DISA-STIG-RHEL-08-010741

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -1,5 +1,5 @@
 
-for user in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $1 }' /etc/passwd); do
+for user in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && $6 != "/") print $1 }' /etc/passwd); do
     home_dir=$(getent passwd $user | cut -d: -f6)
     # Only update the ownership when necessary. This will avoid changing the inode timestamp
     # when the owner is already defined as expected, therefore not impacting in possible integrity

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_ownership
@@ -32,6 +32,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - CCE-87040-2
   - accounts_users_home_files_ownership

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
@@ -1,5 +1,5 @@
 
-for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $6 }' /etc/passwd); do
+for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && "/" $6 != "/") print $6 }' /etc/passwd); do
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions' differs.
--- xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
+++ xccdf_org.ssgproject.content_rule_accounts_users_home_files_permissions
@@ -33,6 +33,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - CCE-85888-6
   - DISA-STIG-RHEL-08-010731

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_directories
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_directories
@@ -1,5 +1,5 @@
 
-for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $6 }' /etc/passwd); do
+for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && "/" $6 != "/") print $6 }' /etc/passwd); do
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_directories
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_directories
@@ -33,6 +33,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - CCE-84038-9
   - DISA-STIG-RHEL-08-010730

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_dirs' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
@@ -1,5 +1,5 @@
 
-for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534) print $6 }' /etc/passwd); do
+for home_dir in $(awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && "/" $6 != "/") print $6 }' /etc/passwd); do
     # Only update the permissions when necessary. This will avoid changing the inode timestamp when
     # the permission is already defined as expected, therefore not impacting in possible integrity
     # check systems that also check inodes timestamps.

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_home_dirs' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
+++ xccdf_org.ssgproject.content_rule_file_permissions_home_dirs
@@ -37,6 +37,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - CCE-84274-0
   - NIST-800-53-AC-6(1)

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12465
This image was built from commit: 7c6304c

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12465

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12465 make deploy-local

[codeclimate]

Code Climate has analyzed commit 7c6304c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

[jan-cerny]

Can we have a test scenario covering the / situation?