Review rpm_verify_hashes rule

[marcusburghardt]

Description:

This PR extract the commits related to rpm_verify_hashes from #11319

It:

• Updates the rule description and includes a warning about performance in some specific scenarios
• Improve the OVAL readability
• Optimize the Ansible remediation by removing unnecessary task
• Include condition in Bash remediation to make it more robust.

Rationale:

Better description, remediation and awareness of possible performance issues in the rule.

Review Hints:

Automatus tests should be enough

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_hashes'.
--- xccdf_org.ssgproject.content_rule_rpm_verify_hashes
+++ xccdf_org.ssgproject.content_rule_rpm_verify_hashes
@@ -3,26 +3,33 @@
 Verify File Hashes with RPM
 
 [description]:
-Without cryptographic integrity protections, system
-executables and files can be altered by unauthorized users without
-detection.
-The RPM package management system can check the hashes of
-installed software packages, including many that are important to system
-security.
-To verify that the cryptographic hash of system files and commands matches vendor
-values, run the following command to list which files on the system
-have hashes that differ from what is expected by the RPM database:
+Without cryptographic integrity protections, system executables and files can be altered by
+unauthorized users without detection. The RPM package management system can check the hashes
+of installed software packages, including many that are important to system security.
+
+To verify that the cryptographic hash of system files and commands matches vendor values, run
+the following command to list which files on the system have hashes that differ from what is
+expected by the RPM database:
 $ rpm -Va --noconfig | grep '^..5'
-A "c" in the second column indicates that a file is a configuration file, which
-may appropriately be expected to change. If the file was not expected to
-change, investigate the cause of the change using audit logs or other means.
-The package can then be reinstalled to restore the file.
-Run the following command to determine which package owns the file:
+
+If the file was not expected to change, investigate the cause of the change using audit logs
+or other means. The package can then be reinstalled to restore the file. Run the following
+command to determine which package owns the file:
 $ rpm -qf FILENAME
+
 The package can be reinstalled from a yum repository using the command:
 $ sudo yum reinstall PACKAGENAME
+
 Alternatively, the package can be reinstalled from trusted media using the command:
 $ sudo rpm -Uvh PACKAGENAME
+
+[warning]:
+This rule can take a long time to perform the check and might consume a considerable
+amount of resources depending on the number of packages present on the system. It is not a
+problem in most cases, but especially systems with a large number of installed packages
+can be affected.
+
+See https://access.redhat.com/articles/6999111.
 
 [reference]:
 11

OVAL for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_hashes' differs.
--- oval:ssg-rpm_verify_hashes:def:1
+++ oval:ssg-rpm_verify_hashes:def:1
@@ -1,2 +1,2 @@
 criteria AND
-criterion oval:ssg-test_files_fail_md5_hash:tst:1
+criterion oval:ssg-test_rpm_verify_hashes:tst:1

OCIL for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_hashes' differs.
--- ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1
+++ ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1
@@ -1,5 +1,5 @@
-The following command will list which files on the system
-have file hashes different from what is expected by the RPM database.
-$ rpm -Va --noconfig | awk '$1 ~ /..5/ && $2 != "c"'
+The following command will list which files on the system have file hashes different from what
+is expected by the RPM database.
+$ rpm -Va --noconfig | awk '$1 ~ /..5/'
       Is it the case that there is output?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_hashes' differs.
--- xccdf_org.ssgproject.content_rule_rpm_verify_hashes
+++ xccdf_org.ssgproject.content_rule_rpm_verify_hashes
@@ -2,8 +2,11 @@
 # Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
 files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"
 
-# From files names get package names and change newline to space, because rpm writes each package to new line
-packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
+if [ -n "$files_with_incorrect_hash" ]; then
+    # From files names get package names and change newline to space, because rpm writes each package to new line
+    packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"
 
-
-yum reinstall -y $packages_to_reinstall
+    
+    yum reinstall -y $packages_to_reinstall
+    
+fi

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rpm_verify_hashes' differs.
--- xccdf_org.ssgproject.content_rule_rpm_verify_hashes
+++ xccdf_org.ssgproject.content_rule_rpm_verify_hashes
@@ -1,32 +1,7 @@
-- name: 'Set fact: Package manager reinstall command (dnf)'
-  set_fact:
-    package_manager_reinstall_cmd: dnf reinstall -y
-  when: ansible_distribution == "Fedora"
-  tags:
-  - CCE-80857-6
-  - CJIS-5.10.4.1
-  - NIST-800-171-3.3.8
-  - NIST-800-171-3.4.1
-  - NIST-800-53-AU-9(3)
-  - NIST-800-53-CM-6(c)
-  - NIST-800-53-CM-6(d)
-  - NIST-800-53-SI-7
-  - NIST-800-53-SI-7(1)
-  - NIST-800-53-SI-7(6)
-  - PCI-DSS-Req-11.5
-  - PCI-DSSv4-11.5.2
-  - high_complexity
-  - high_severity
-  - medium_disruption
-  - no_reboot_needed
-  - restrict_strategy
-  - rpm_verify_hashes
-
-- name: 'Set fact: Package manager reinstall command (yum)'
+- name: 'Set fact: Package manager reinstall command'
   set_fact:
     package_manager_reinstall_cmd: yum reinstall -y
-  when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution
-    == "OracleLinux")
+  when: ansible_distribution in [ "Fedora", "RedHat", "CentOS", "OracleLinux" ]
   tags:
   - CCE-80857-6
   - CJIS-5.10.4.1

[jan-cerny]

Overall it looks good to me, it's a clever change reusing the filter.

The CI fail of Automatus on SLE15 is OK because there is an offending file.

But, the CI fail of Automatus on Fedora is caused by a hole in the test scenario linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/tests/bad_document.fail.sh. I think it's worth fixing. Can you take look at the Fedora fail?

When executed locally, all tests are passing correctly.

jcerny@fedora ~/work/git/scap-security-guide (pr/11332) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible rpm_verify_hashes
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-04-1330/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rpm_verify_hashes
INFO - Script bad_document.fail.sh using profile (all) OK
INFO - Script fresh_system.pass.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11332) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9  rpm_verify_hashes
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-04-1333/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_rpm_verify_hashes
INFO - Script bad_document.fail.sh using profile (all) OK
INFO - Script fresh_system.pass.sh using profile (all) OK

[jan-cerny]

@marcusburghardt It didn't help. I have download the artifact from the Automatus Fedora job and the prescripts log still shows a peculiar message:

ssh -o Port=36279 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@localhost cd /root/ssgts/rpm_verify_hashes; SHARED=/root/ssgts/shared bash -x bad_document.fail.sh
STDERR: Warning: Permanently added '[localhost]:36279' (ECDSA) to the list of known hosts.
++ find /usr/share/doc -name TODO -o -name README
++ head -n 1
+ todo_file=
+ echo ' '
bad_document.fail.sh: line 7: $todo_file: ambiguous redirect

it looks like the variable is still empty.

Any suggestions?

[marcusburghardt]

@marcusburghardt It didn't help. I have download the artifact from the Automatus Fedora job and the prescripts log still shows a peculiar message:

ssh -o Port=36279 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@localhost cd /root/ssgts/rpm_verify_hashes; SHARED=/root/ssgts/shared bash -x bad_document.fail.sh
STDERR: Warning: Permanently added '[localhost]:36279' (ECDSA) to the list of known hosts.
++ find /usr/share/doc -name TODO -o -name README
++ head -n 1
+ todo_file=
+ echo ' '
bad_document.fail.sh: line 7: $todo_file: ambiguous redirect

it looks like the variable is still empty.

Any suggestions?

I would like to avoid installing packages but I think this will be necessary for this test case. Let me try one here.

[marcusburghardt]

@marcusburghardt It didn't help. I have download the artifact from the Automatus Fedora job and the prescripts log still shows a peculiar message:

ssh -o Port=36279 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@localhost cd /root/ssgts/rpm_verify_hashes; SHARED=/root/ssgts/shared bash -x bad_document.fail.sh
STDERR: Warning: Permanently added '[localhost]:36279' (ECDSA) to the list of known hosts.
++ find /usr/share/doc -name TODO -o -name README
++ head -n 1
+ todo_file=
+ echo ' '
bad_document.fail.sh: line 7: $todo_file: ambiguous redirect

it looks like the variable is still empty.
Any suggestions?

I would like to avoid installing packages but I think this will be necessary for this test case. Let me try one here.

It didn't work. I will try to reproduce it locally and find a way to make this test scenario more robust.

[marcusburghardt]

It should be ok now @jan-cerny

[jan-cerny]

/packit build

[jan-cerny]

/packit reset

[jan-cerny]

/packit build

[codeclimate]

Code Climate has analyzed commit 50f8a8a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

[jan-cerny]

/packit retest-failed