RHEL 7.4: Too many setuid bits removed

[duk3luk3]

When running against RHEL 7.4 beta, these files have their setuid bits removed:

• /usr/bin/su
• /usr/sbin/netreport
• /usr/libexec/openssh/ssh-keysign

This definitely breaks su. I don't know about the other files and if they should have setuid, but I suspect so.

I'll open a PR to add these files to the whitelist for RHEL 7.

As a workaround, add the files to the os_security_suid_sgid_whitelist var.

EDIT: I can't actually figure out how to apply the workaround - neither putting it into a group var nor in the playbook vars works... - I also don't know why it's acting as if os_security_suid_sgid_remove_from_unknown is set to true.

I am running ansibe 2.3.1.0, installed the role by doing git clone https://github.com/dev-sec/ansible-os-hardening.git dev-sec.os-hardening in /etc/ansible/roles, and this is my playbook:

- hosts: '*'
  roles:
    - dev-sec.os-hardening

[rndmh3ro]

Hey @duk3luk3, you're right about the su-binary, this should be fixed. Do you want to create a PR for this?

As for ssh-keysign: According to this mailinglist-entry, the binary is only used for host-based authentication, which should never be used (we also disable it in ssh-hardening). That's why it is in the blacklist.

as for netreport:

 netreport tells the network management scripts to send a SIGIO signal to the process which called netreport when any network interface status changes occur. 

So removing thew SGID from that binary is OK in my opinion.

[rndmh3ro]

fixed by #199