search

ComplianceAsCode / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://complianceascode.readthedocs.io/en/latest/
Other
2.22k stars 698 forks source link

Fix file_permissions_unauthorized_sgid #12602

Closed jan-cerny closed 1 week ago

jan-cerny commented 1 week ago

Fix rule file_permissions_unauthorized_sgid for bootable containers. We will filter out the /sysroot directory from our scan because it contains only the physical root and not the real file system.

See: https://containers.github.io/bootc/filesystem-sysroot.html#sysroot-mount

github-actions[bot] commented 1 week ago

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment) Open in Gitpod

Fedora Testing Environment Open in Gitpod

Oracle Linux 8 Environment Open in Gitpod

codeclimate[bot] commented 1 week ago

Code Climate has analyzed commit 86b165ea and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

Mab879 commented 1 week ago

Automatus passes locally.

$ ./automatus.py rule --libvirt qemu:///system automatus_rhel9_4 --datastream ../build/ssg-rhel9-ds.xml --remediate-using bash file_permissions_unauthorized_sgid
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/mburket/Developer/github.com/ComplianceAsCode/content/tests/logs/rule-custom-2024-11-12-1231/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid
INFO - Script no_unpackaged_sgid.pass.sh using profile (all) OK
INFO - Script unpackaged_sgid.fail.sh using profile (all) OK