Prevent file_ownership/groupownership_home_directories from chowning /

[ggbecker]

Description:

• Prevent file_ownership_home_directories and file_groupownership_home_directories from chowning /
  • A user whose /etc/passwd home-directory field is "/" (e.g. a systemd DynamicUser service account like chrony-wait, which uses "/" as a placeholder home and a nologin shell) falls inside the interactive UID range, causing these rules' remediation to chown/chgrp the root filesystem to that account. The OVAL check already excludes nologin/false-shell accounts and never flags this, so the corruption only shows up via other rules (e.g. rpm_verify_ownership) after an ansible-based remediation run. Add the same "home dir != /" guard already present in the sibling accounts_users_home_files_ownership/accounts_users_home_files_groupownership rules to both rules, for example.

Rationale:

• Fixes Rule rpm_verify_ownership fails in BSI profile on ppc64le architecture #14933

Review Hints

Since we are talking about a very specific architecture here, the best way to test this pull request is to run contest on EL 10 on either emulated ppc64le or online available systems and run the BSI profile verification with the ansible remediation aka /hardening/host-os/ansible/bsi

In my tests, the waiver started waiving a pass test as observed by the comment below.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -1,2 +1,2 @@
 
-awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd
+awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && $6 != "/") system("chgrp -f " $4" "$6) }' /etc/passwd

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -30,6 +30,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - file_groupownership_home_directories
   - low_complexity

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_ownership_home_directories
@@ -1,2 +1,2 @@
 
-awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chown -f " $3" "$6) }' /etc/passwd
+awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && $6 != "/") system("chown -f " $3" "$6) }' /etc/passwd

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_ownership_home_directories
@@ -30,6 +30,7 @@
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
+  - item.value[4] != "/"
   tags:
   - file_ownership_home_directories
   - low_complexity

[ggbecker]

Test results: 10.2@ppc64le pass /hardening/host-os/ansible/bsi rpm_verify_ownership waived pass

[openshift-ci]

@ggbecker: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	b7897d1	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.