Support remote users in file_groupownership_home_directories rule

[ggbecker]

Description:

• Update file_groupownership_home_directories rule to support remote users (LDAP, SSSD, NIS) and align with STIG RHEL-09-411070 requirements.

Changes:

• OVAL: Switch from textfilecontent54_object to unix:password_object using create_interactive_users_list_object macro to support getpwent()
• OVAL: Filter all non-interactive shells: /sbin/nologin, /usr/sbin/nologin, /bin/false, /usr/bin/false (previously only filtered nologin shells)
• Bash: Use getent passwd instead of /etc/passwd to query all users
• Bash: Filter out all non-interactive shells
• Ansible: Filter out non-interactive shells using rejectattr
• Rule: Update description, OCIL, and fixtext to reference getent passwd and clarify remote user support
• Macro: Update create_interactive_users_list_object to exclude /bin/false and /usr/bin/false shells (affects all rules using this macro)

Rationale

• Align with: https://stigaview.com/products/rhel9/v2r9/RHEL-09-411070/

Review hints

• Run automatus with RHEL9 with the rule file_groupownership_home_directories

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -5,15 +5,19 @@
 All Interactive User Home Directories Must Be Group-Owned By The Primary Group
 
 [description]:
-Change the group owner of interactive users home directory to the
-group found in /etc/passwd. To change the group owner of
-interactive users home directory, use the following command:
+Change the group owner of interactive user home directories to the
+group found in getent passwd. To change the group owner of
+an interactive user's home directory, use the following command:
 $ sudo chgrp USER_GROUP /home/USER
         
 
 This rule ensures every home directory related to an interactive user is
-group-owned by an interactive user. It also ensures that interactive users
+group-owned by that user's primary group. It also ensures that interactive users
 are group-owners of one and only one home directory.
+
+Interactive users are those with a UID greater than or equal to 1000
+and a valid interactive shell (not /sbin/nologin, /usr/sbin/nologin,
+/bin/false, or /usr/bin/false).
 
 [warning]:
 Due to OVAL limitation, this rule can report a false negative in a

OCIL for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- ocil:ssg-file_groupownership_home_directories_ocil:questionnaire:1
+++ ocil:ssg-file_groupownership_home_directories_ocil:questionnaire:1
@@ -1,5 +1,9 @@
 To verify the assigned home directory of all interactive users is group-
-owned by that users primary GID, run the following command:
-# ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
+owned by that user's primary GID, run the following command:
+# ls -ld $(getent passwd | awk -F: '($3>=1000)&&($7 !~ /nologin/)&&($7 !~ /\/false$/){print $6}')
+
+This should return a list of home directories with group ownership matching each user's primary group.
+Using getent passwd instead of reading /etc/passwd directly ensures that remote users
+(LDAP, SSSD, NIS, etc.) are also checked.
       Is it the case that the group ownership is incorrect?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -1,2 +1,12 @@
 
-awk -F':' '{ if ($3 >= 1000 && $3 != 65534 && $6 != "/") system("chgrp -f " $4" "$6) }' /etc/passwd
+# Get interactive users using getent to support remote users (LDAP, SSSD, etc.)
+while IFS=: read -r _ _ uid gid _ home shell; do
+    # Filter interactive users: UID >= 1000, not nobody, has valid home dir, not nologin/false shell
+    if [ "$uid" -ge 1000 ] && [ "$uid" -ne 65534 ] && \
+       [ "$home" != "/" ] && \
+       [ "$shell" != "/sbin/nologin" ] && [ "$shell" != "/usr/sbin/nologin" ] && \
+       [ "$shell" != "/bin/false" ] && [ "$shell" != "/usr/bin/false" ]; then
+        # Arguments are properly quoted to prevent command injection
+        chgrp -f -- "$gid" "$home"
+    fi
+done < <(getent passwd)

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_home_directories' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
+++ xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
@@ -1,4 +1,4 @@
-- name: Get all local users from /etc/passwd
+- name: Get all users from getent to support remote users (LDAP, SSSD, etc.)
   ansible.builtin.getent:
     database: passwd
     split: ':'
@@ -12,9 +12,12 @@
   - no_reboot_needed
   - restrict_strategy
 
-- name: Create local_users variable from the getent output
+- name: Create interactive_users variable filtering out non-interactive shells
   ansible.builtin.set_fact:
-    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
+    interactive_users: '{{ ansible_facts.getent_passwd|dict2items|rejectattr("value.5",
+      "match", ".*/sbin/nologin$")|rejectattr("value.5", "match", ".*/usr/sbin/nologin$")|rejectattr("value.5",
+      "match", ".*/bin/false$")|rejectattr("value.5", "match", ".*/usr/bin/false$")|list
+      }}'
   tags:
   - CCE-83434-1
   - DISA-STIG-RHEL-08-010740
@@ -30,7 +33,7 @@
   ansible.builtin.stat:
     path: '{{ item.value[4] }}'
   register: path_exists
-  loop: '{{ local_users }}'
+  loop: '{{ interactive_users }}'
   when:
   - item.value[1]|int >= 1000
   - item.value[1]|int != 65534
@@ -45,12 +48,11 @@
   - no_reboot_needed
   - restrict_strategy
 
-- name: Ensure interactive local users are the group-owners of their respective home
-    directories
+- name: Ensure interactive users are the group-owners of their respective home directories
   ansible.builtin.file:
     path: '{{ item.0.value[4] }}'
     group: '{{ item.0.value[2] }}'
-  loop: '{{ local_users|zip(path_exists.results)|list }}'
+  loop: '{{ interactive_users|zip(path_exists.results)|list }}'
   when: item.1.stat is defined and item.1.stat.exists
   tags:
   - CCE-83434-1

[openshift-ci]

@ggbecker: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	9950f05	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	9950f05	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.