DRAFT: fix remediations for file_permissions_audit_configuration_stig

[macko1]

Description:

• Description here. Replace this text. Don't use the italics format!

Rationale:

• Rationale here. Replace this text. Don't use the italics format!

• Fixes # Issue number here (e.g. Updating sysctl XCCDF naming #26) or remove this line if no issue exists.

Review Hints:

• Review hints here. Replace this text. Don't use the italics format!

• Use this optional section to give any relevant information which could help the reviewer to more quickly and assertively understand and test the changes.

• Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig'.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -7,6 +7,9 @@
 [description]:
 All audit configuration files permissions must be 600 or more restrictive.
 chmod 0600 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*
+
+[warning]:
+augenrules --load resets permissions of /etc/audit/audit.rules to 0640, undoing remediation (0600). Fix: A systemd dropin for audit service is installed at /etc/systemd/system/auditd.service.d/permissions.confwith ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules. This dropin is necessary to restore 0600 permissions after augenrules runs and rewrites the /etc/audit/audit.rules file. systemd runs both commands in order, restoring 0600. Use service auditd restart to reload and apply the drop-in when remediating manually.
 
 [reference]:
 AU-12 b

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -1,9 +1,37 @@
 # Remediation is applicable only in certain platforms
 if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
 
-find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+# Copied and modified from `file_permissions/bash.template` template
+#
+# Sets mode 0600 and ownership root:root on all audit config files.
+# Installs an auditd.service dropin to restore 0600 on audit.rules after augenrules
+# rewrites it to 0640 when /etc/audit/rules.d/ content changes (RHEL 8/9 only, not containers).
 
-find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type f -regextype posix-extended -regex '^.*\.rules$' -exec chmod u-xs,g-xwrs,o-xwrt {} \;
+find /etc/audit/ -maxdepth 1 -type f \
+    -regextype posix-extended -regex '^.*audit(\.rules|d\.conf)$' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+find /etc/audit/rules.d/ -maxdepth 1 -type f -name '*.rules' \
+    -exec chmod 0600 {} \; \
+    -exec chown root:root {} \;
+
+if rpm --quiet -q audit && rpm --quiet -q kernel-core; then
+
+mkdir -p /etc/systemd/system/auditd.service.d
+chmod 0755 /etc/systemd/system/auditd.service.d
+
+cat > /etc/systemd/system/auditd.service.d/permissions.conf << 'EOF'
+[Service]
+ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+EOF
+chmod 0644 /etc/systemd/system/auditd.service.d/permissions.conf
+restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+
+systemctl daemon-reload
+service restart auditd # IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
+
+fi
 
 else
     >&2 echo 'Remediation is not applicable, nothing was done'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
+++ xccdf_org.ssgproject.content_rule_file_permissions_audit_configuration_stig
@@ -12,13 +12,17 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/ file(s)
-  ansible.builtin.command: find -P /etc/audit/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*audit(\.rules|d\.conf)$"
-  register: files_found
-  changed_when: false
+- name: Set /etc/audit/audit.rules and /etc/audit/auditd.conf to 0600, owned by root
+  ansible.builtin.file:
+    path: '{{ item }}'
+    mode: '0600'
+    owner: root
+    group: root
+    state: file
+  loop:
+  - /etc/audit/audit.rules
+  - /etc/audit/auditd.conf
   failed_when: false
-  check_mode: false
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -33,13 +37,15 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /etc/audit/ file(s)
+- name: Set /etc/audit/rules.d/*.rules files to 0600, owned by root
   ansible.builtin.file:
     path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
+    mode: '0600'
+    owner: root
+    group: root
     state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
+  with_fileglob:
+  - /etc/audit/rules.d/*.rules
   when:
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
@@ -54,14 +60,38 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /etc/audit/rules.d/ file(s)
-  ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*\.rules$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Install ExecStartPost dropin on auditd.service
+  block:
+
+  - name: Create dropin directory /etc/systemd/system/auditd.service.d
+    ansible.builtin.file:
+      path: /etc/systemd/system/auditd.service.d
+      state: directory
+      mode: '0755'
+
+  - name: Install /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.copy:
+      dest: /etc/systemd/system/auditd.service.d/permissions.conf
+      content: |
+        [Service]
+        ExecStartPost=/usr/bin/chmod 0600 /etc/audit/audit.rules
+      mode: '0644'
+
+  - name: Restore SELinux context on /etc/systemd/system/auditd.service.d/permissions.conf
+    ansible.builtin.command: restorecon /etc/systemd/system/auditd.service.d/permissions.conf
+    changed_when: false
+
+  - name: Reload systemd daemon to pick up permissions.conf
+    ansible.builtin.systemd:
+      daemon_reload: true
+
+  - name: Restart auditd.service
+    ansible.builtin.service:
+      name: auditd.service
+      state: restarted
   when:
+  - '"audit" in ansible_facts.packages'
+  - '"kernel-core" in ansible_facts.packages'
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
   tags:
@@ -74,24 +104,3 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-
-- name: Set permissions for /etc/audit/rules.d/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xwrs,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when:
-  - '"audit" in ansible_facts.packages'
-  - '"kernel-core" in ansible_facts.packages'
-  tags:
-  - CCE-89815-5
-  - DISA-STIG-RHEL-08-030610
-  - NIST-800-53-AU-12 b
-  - configure_strategy
-  - file_permissions_audit_configuration_stig
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.