CIS Workstation L2 profile produces unexpected notapplicable results

[jan-cerny]

Description of problem:

During review of the productization test run we have found that in test /CoreOS/scap-security-guide/Sanity/ssg-kickstarts for CIS Workstation Level 2 (GUI) some rules return unexpected notapplicable results.

SCAP Security Guide Version:

current upstream master branch as of 2023-07-21 as of HEAD a96ccb9

Operating System Version:

RHEL 8

Steps to Reproduce:

1. performed kickstart installation of the cis_workstation_l2 profile and run a scan afterwards

Actual Results:

There are unexpected "notapplicable" results:
xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg - notapplicable
xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg - notapplicable
xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg - notapplicable
xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg - notapplicable
xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg - notapplicable
xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg - notapplicable
xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule - notapplicable
xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled - notapplicable

Expected Results:

No unexpected notapplicable results.

Additional Information/Debugging Steps:

No

[marcusburghardt]

Regarding the xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule - notapplicable this should be the relevant commit: 7172933
There is discussion related to this also in this PR: #10812

The other rules seem to be expected. Is the test VM in fact using uefi?

[teacup-on-rockingchair]

Regarding the xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule - notapplicable this should be the relevant commit: 7172933 There is discussion related to this also in this PR: #10812

The other rules seem to be expected. Is the test VM in fact using uefi?

I would argue that the set_ip6tables_default_rule is also normal to be not applicable if the system is using nftables or ufw and not using iptables as the platform limitation suggests not package[nftables] and not package[ufw] and package[iptables] what is the configuration on the system that you see those results regarding firewall modules?

[marcusburghardt]

I will analyze each case of this issue.

[mildas]

notapplicable results are not causing productization failure and thus it's not productization issue.

@marcusburghardt In case any of the notapplicable results is not expected, please create separate issue for every such rule. Then close this issue, to not discuss several different rules in one issue. That wouldn't be transparentj. Thank you

[marcusburghardt]

I confirmed all efi related rules are working as expected. They result as notapplicable when the system indeed does not use UEFI.

I manually tested the rule in a system using UEFI and it worked as expected:

sudo oscap xccdf eval --profile ospp --rule xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 
--- Starting Evaluation ---

Title   Verify the UEFI Boot Loader grub.cfg Group Ownership
Rule    xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg
Result  pass

From the description, now only these two rules are pending investigation:

• xccdf_org.ssgproject.content_rule_set_ip6tables_default_rule - notapplicable
• xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled - notapplicable

[marcusburghardt]

postfix_network_listening_disabled is also working as expected:

# rpm -q postfix
package postfix is not installed

# oscap xccdf eval --profile ospp --rule xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 
--- Starting Evaluation ---

Title   Disable Postfix Network Listening
Rule    xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled
Ident   CCE-82174-4
Result  notapplicable

# dnf install -y postfix
...

# oscap xccdf eval --profile ospp --rule xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled --results-arf /tmp/arf.xml --report /tmp/report.html --oval-results /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 

--- Starting Evaluation ---

Title   Disable Postfix Network Listening
Rule    xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled
Ident   CCE-82174-4
Result  pass

[marcusburghardt]

There are some issues with the ip6tables_default_rule rule and a new specific issue was created: #11054