ComplianceAsCode / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://complianceascode.readthedocs.io/en/latest/
Other
2.22k stars 698 forks source link

Skip users with ID above UID MAX on accounts_user_interactive_home_directory_defined #12527

Closed Mab879 closed 2 weeks ago

Mab879 commented 1 month ago

Description:

To skip systemd dynamic users. Since accounts_user_interactive_home_directory_defined only works on local users this should be fine.

Since bash remediation accesses /etc/passwd directly and the systemd dynamic users do not show up in that file, the bash remediation was not updated.

Rationale:

Fix Ansible playbook failures.

github-actions[bot] commented 1 month ago

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment) Open in Gitpod

Fedora Testing Environment Open in Gitpod

Oracle Linux 8 Environment Open in Gitpod

github-actions[bot] commented 1 month ago

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff ```diff ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined' differs. --- xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined +++ xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined @@ -34,6 +34,7 @@ when: - item.value[2]|int >= 1000 - item.value[2]|int != 65534 + - item.value[2]|int < 61184 or item.value[2]|int > 65519 - not item.value[4] | regex_search('^\/\w*\/\w{1,}') tags: - CCE-84036-3 ```
Mab879 commented 2 weeks ago

/packit build

codeclimate[bot] commented 2 weeks ago

Code Climate has analyzed commit 708fc419 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

vojtapolasek commented 2 weeks ago

@Mab879 There is a failing Automatus test on SLE which seems valid.

Mab879 commented 2 weeks ago

@Mab879 There is a failing Automatus test on SLE which seems valid.

This isn't a new issue, it is also failing on master.

At least testing with OpenSUSE.

vojtapolasek commented 2 weeks ago

OK @Mab879 merging. Thank you.

vojtapolasek commented 2 weeks ago

/packit retest-failed