ANSSI kickstart installations - some rules are not remediated

[mildas]

Description of problem:

During the ANSSI profile kickstart installations, there's a few rules that fail to be remediated:

• grub2_enable_iommu_force
• accounts_polyinstantiated_var_tmp
• accounts_polyinstantiated_tmp
• sudoers_no_root_target - doesn't come with a remediation
• sudoers_explicit_command_args - doesn't come with a remediation
• sudo_dedicated_group - doesn't come with a remediation

SCAP Security Guide Version:

b9def94

Operating System Version:

RHEL 7, RHEL 8

Steps to Reproduce:

1. Install RHEL 7.9 with the ANSSI DAT-BP28 (high) security policy selected

Actual Results:

Listed rules result in failed.

Expected Results:

Listed rules result in passed.

Additional Information/Debugging Steps:

• grub2_enable_iommu_force - no remediation available
• accounts_polyinstantiated_tmp - the rule is fixed by remediation but after restart the check fails again
• accounts_polyinstantiated_var_tmp - the rule is fixed by remediation but after restart the check fails again

[yuumasato]

The fail to remediate sudo_add_requitetty happens because an testing library comments any requiretty in the sudoers file.

[yuumasato]

About the polyinstantiated /tmp and /var/tmp, the remediation for these rules create a directory and set permissions and SELinux contexts.

1. The changes done by remediation in the installation environment don't persist on the installed environment.
2. After first boot, configuring polyinstantiation of /tmp and /var/tmp doesn't work. Every configuration is as it should be, ~but the feature is not functional. It seems that some operation done during installation persistently broke polyinstantiation.~

These issues do not manifest when remediation is applied on already installed system.

EDIT: After reapplying remediation the polyinstantiation feature is functional. I was testing it in a wrong way.

[mildas]

Removed commenting out of the requiretty line in sudoers file, installation works without problems, and sudo_add_requitetty passes. I have removed the rule from the list of failing rules.

[mildas]

mount_option_boot_* rules pass now. The problem was in missing options for boot partition in kickstart. Rules were removed from the list.

[mildas]

accounts_polyinstantiated_* needs to be remediated twice. grub2_enable_iommu_force passes now. Closing