require_singleuser_auth: rewrite rule to use systemd override mechanism

[vojtapolasek]

Description:

• rewrite OVAL, Bash, Ansible
• add test scenario

Rationale:

• the rule had several problems which made it fail often. Remediation was not consistent with the check at all, at least for Bash.
• Currently, the rule checks for the parameter in /usr/lib/systemd/systemúrescue.service and also for possible overrides in /etc/systemd/system/rescue.service.d/*.conf. Please see OVAL criteria for more details.
• Remediations both create files only in /etc/systemd/system/rescue.service.d.

Review Hints:

• Running Automatus scenarios should be enough.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth' differs.
--- oval:ssg-require_singleuser_auth:def:1
+++ oval:ssg-require_singleuser_auth:def:1
@@ -1,2 +1,6 @@
 criteria AND
-criterion oval:ssg-test_require_rescue_service:tst:1
+criteria OR
+criteria AND
+criterion oval:ssg-test_require_rescue_service_distro:tst:1
+criterion oval:ssg-test_rescue_service_not_overridden:tst:1
+criterion oval:ssg-test_require_rescue_service_override:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_singleuser_auth
+++ xccdf_org.ssgproject.content_rule_require_singleuser_auth
@@ -4,7 +4,7 @@
 found=false
 
 # set value in all files if they contain section or key
-for f in $(echo -n "/etc/systemd/system/rescue.service.d/10-oscap.conf"); do
+for f in $(echo -n "/etc/systemd/system/rescue.service.d/10-oscap.conf /etc/systemd/system/rescue.service.d/*.conf"); do
     if [ ! -e "$f" ]; then
         continue
     fi
@@ -12,14 +12,14 @@
     # find key in section and change value
     if grep -qzosP "[[:space:]]*\[Service\]([^\n\[]*\n+)+?[[:space:]]*ExecStart" "$f"; then
 
-            sed -i "s/ExecStart[^(\n)]*/ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue/" "$f"
+            sed -i "s/ExecStart[^(\n)]*/ExecStart=\nExecStart=-\/usr\/lib\/systemd\/systemd-sulogin-shell rescue/" "$f"
 
             found=true
 
     # find section and add key = value to it
     elif grep -qs "[[:space:]]*\[Service\]" "$f"; then
 
-            sed -i "/[[:space:]]*\[Service\]/a ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" "$f"
+            sed -i "/[[:space:]]*\[Service\]/a ExecStart=\nExecStart=-\/usr\/lib\/systemd\/systemd-sulogin-shell rescue" "$f"
 
             found=true
     fi
@@ -27,10 +27,10 @@
 
 # if section not in any file, append section with key = value to FIRST file in files parameter
 if ! $found ; then
-    file=$(echo "/etc/systemd/system/rescue.service.d/10-oscap.conf" | cut -f1 -d ' ')
+    file=$(echo "/etc/systemd/system/rescue.service.d/10-oscap.conf /etc/systemd/system/rescue.service.d/*.conf" | cut -f1 -d ' ')
     mkdir -p "$(dirname "$file")"
 
-    echo -e "[Service]\nExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" >> "$file"
+    echo -e "[Service]\nExecStart=\nExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" >> "$file"
 
 fi
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_require_singleuser_auth' differs.
--- xccdf_org.ssgproject.content_rule_require_singleuser_auth
+++ xccdf_org.ssgproject.content_rule_require_singleuser_auth
@@ -16,13 +16,13 @@
   - require_singleuser_auth
   - restrict_strategy
 
-- name: Require Authentication for Single User Mode - Require emergency user mode
-    password
-  community.general.ini_file:
-    path: /etc/systemd/system/rescue.service.d/10-oscap.conf
-    section: Service
-    option: ExecStart
-    value: -/usr/lib/systemd/systemd-sulogin-shell rescue
+- name: Require Authentication for Single User Mode - find files which already override
+    Execstart of rescue.service
+  ansible.builtin.find:
+    paths: /etc/systemd/system/rescue.service.d
+    patterns: '*.conf'
+    contains: ^\s*ExecStart=.*$
+  register: rescue_service_overrides_found
   when: '"kernel" in ansible_facts.packages'
   tags:
   - CCE-80855-0
@@ -38,3 +38,77 @@
   - no_reboot_needed
   - require_singleuser_auth
   - restrict_strategy
+
+- name: Require Authentication for Single User Mode - set files containing ExecStart
+    overrides as target
+  ansible.builtin.set_fact:
+    rescue_service_remediation_target_file: '{{ rescue_service_overrides_found.files
+      | map(attribute=''path'') | list }}'
+  when:
+  - '"kernel" in ansible_facts.packages'
+  - rescue_service_overrides_found.matched is defined and rescue_service_overrides_found.matched
+    > 0
+  tags:
+  - CCE-80855-0
+  - DISA-STIG-RHEL-08-010151
+  - NIST-800-171-3.1.1
+  - NIST-800-171-3.4.5
+  - NIST-800-53-AC-3
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-2
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - require_singleuser_auth
+  - restrict_strategy
+
+- name: Require Authentication for Single User Mode - set default target for rescue.service
+    override
+  ansible.builtin.set_fact:
+    rescue_service_remediation_target_file:
+    - /etc/systemd/system/rescue.service.d/10-oscap.conf
+  when:
+  - '"kernel" in ansible_facts.packages'
+  - rescue_service_overrides_found.matched is defined and rescue_service_overrides_found.matched
+    == 0
+  tags:
+  - CCE-80855-0
+  - DISA-STIG-RHEL-08-010151
+  - NIST-800-171-3.1.1
+  - NIST-800-171-3.4.5
+  - NIST-800-53-AC-3
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-2
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - require_singleuser_auth
+  - restrict_strategy
+
+- name: Require Authentication for Single User Mode - Require emergency user mode
+    password
+  community.general.ini_file:
+    path: '{{ item }}'
+    section: Service
+    option: ExecStart
+    values:
+    - ''
+    - -/usr/lib/systemd/systemd-sulogin-shell rescue
+  loop: '{{ rescue_service_remediation_target_file }}'
+  when: '"kernel" in ansible_facts.packages'
+  tags:
+  - CCE-80855-0
+  - DISA-STIG-RHEL-08-010151
+  - NIST-800-171-3.1.1
+  - NIST-800-171-3.4.5
+  - NIST-800-53-AC-3
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-2
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - require_singleuser_auth
+  - restrict_strategy

[codeclimate]

Code Climate has analyzed commit 984c685 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

[Mab879]

Waving Automatus findings as they are only test not found errors.