Open marcofortina opened 4 months ago
The database
message is just a warning and we are not yet planning to move to database_in
now as this is not backwards compatible and the warning doesn't prevent from aide to work.
Regarding the fail, have you tried to use the bash remediation?
The
database
message is just a warning and we are not yet planning to move todatabase_in
now as this is not backwards compatible and the warning doesn't prevent from aide to work.Regarding the fail, have you tried to use the bash remediation?
Yes of course I used successfully the bash remediation. My issue is only to truck a wrong check for database=
on Ubuntu 22.04 instead of the new database_in=
showing a false error where workaround was not applied.
Is not possible to use <% if "ubuntu2204" in product %>
for this rule as fix?
not really a priority for us now, since database
is still supported on 22.04
adding the checks would be required on bash, ansible, oval and rule.yml
not really a priority for us now, since
database
is still supported on 22.04 adding the checks would be required on bash, ansible, oval and rule.yml
and a reminder that you would still need to keep compatibility to database
as people might not have migrated to the new item.
Debian also suffers the same as expected.
Description of problem:
Check for rule
xccdf_org.ssgproject.content_rule_aide_build_database
fails on Ubuntu 22.04.SCAP Security Guide Version:
master branch
Operating System Version:
Ubuntu 22.04 LTS
Steps to Reproduce:
apt install aide aide-common
aideinit && mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level2_server --rule xccdf_org.ssgproject.content_rule_aide_build_database ssg-ubuntu2204-ds.xml
Actual Results:
Expected Results:
Additional Information/Debugging Steps:
On Ubuntu 22.04 database definition keyword in the
/etc/aide/aide.conf
file was changed fromdatabase=file:/var/lib/aide/aide.db
todatabase_in=file:/var/lib/aide/aide.db
.Adding
database=file:/var/lib/aide/aide.db
in the/etc/aide/aide.conf
as workaround gives this warning: