Use specific name in private key groups instead of gid

[ggbecker]

Description:

• Use specific name in private key groups instead of gid.

Rationale:

• This is an attempt to fix the following three issues:

#10594
#10593
#10592

There is a upstream test ongoing that will help us to identify if the problem was really solved since this looks like some rules are affecting others and unit tests won't help in this case.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key' differs.%0A--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key%0A+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key%0A@@ -1,7 +1,7 @@%0A # Remediation is applicable only in certain platforms%0A if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then%0A %0A-find /etc/ssh/ -maxdepth 1 -type f ! -gid 995 -regex '^.*_key$' -exec chgrp 995 {} \;%0A+find /etc/ssh/ -maxdepth 1 -type f ! -gid ssh_keys -regex '^.*_key$' -exec chgrp ssh_keys {} \;%0A %0A else%0A     >&2 echo 'Remediation is not applicable, nothing was done'%0A%0Aansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key' differs.%0A--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key%0A+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key%0A@@ -1,5 +1,5 @@%0A - name: Find /etc/ssh/ file(s) matching ^.*_key$%0A-  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -gid 995 -regex "^.*_key$"%0A+  command: find -H /etc/ssh/ -maxdepth 1 -type f ! -gid ssh_keys -regex "^.*_key$"%0A   register: files_found%0A   changed_when: false%0A   failed_when: false%0A@@ -17,7 +17,7 @@%0A - name: Ensure group owner on /etc/ssh/ file(s) matching ^.*_key$%0A   file:%0A     path: '{{ item }}'%0A-    group: '995'%0A+    group: ssh_keys%0A     state: file%0A   with_items:%0A   - '{{ files_found.stdout_lines }}'

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit 44cba45 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.5% (0.0% change).

View more on Code Climate.

[Mab879]

Looks good to me.

Waving the automatus issues as they pass locally.

[matejak]

A explanatory variable gid_is_name would fit perfectly here, and probably should be more robust - numbers are probably IDs, not numbers are definitely names. Moreover, I believe that the template code could propagate a boolean with the template.

[matejak]

This is a great PR, but it has changed the API of the template, I would rename the filegid key to gid_or_name, and enhance the Python template part to try to convert the gid_or_name to int, and if it succeeds, indicate that we have gid.
Anyway, this is handled in #10666