Make selinux context elevation for sudo more flexible #11224
Conversation
And add the right shebang to the tests as well.
As of OL7/RHEL7 STIG release for CY23Q4 no longer requires the group be wheel. Also add a test for this.
Mab879
added
Update Rule
|
Start a new ephemeral environment with changes proposed in this pull request: rhel7 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
Code Climate has analyzed commit 0ad34bc and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 57.0%. View more on Code Climate. |
jan-cerny
changed the title
There was a problem hiding this comment.
The CI fail on CentOS Stream 8 and 9 are caused by a fact that this rule is marked as only for RHEL 7 and OL 7 according to prodtype, therefore they aren't part of RHEL 8 or 9. The CI fail on SLE 15 is caused by a missing package during the container build, but the rule isn't part of sle15 product anyway so it doesn't matter.
The test scenarios pass when executed locally on a RHEL 7 virtual machine back end.
jcerny@fedora ~/work/git/scap-security-guide (pr/11224) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel7 --dontclean selinux_context_elevation_for_sudo
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-10-26-1321/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_selinux_context_elevation_for_sudo
INFO - Script conflicting_value.fail.sh using profile (all) OK
INFO - Script correct_value_multiple_files.pass.sh using profile (all) OK
INFO - Script correct_value_single_file.pass.sh using profile (all) OK
INFO - Script custom_group_name.pass.sh using profile (all) OK
INFO - Script missing_role.fail.sh using profile (all) OK
INFO - Script missing_type.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11224) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel7 --remediate-using ansible --dontclean selinux_context_elevation_for_sudo
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-10-26-1342/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_selinux_context_elevation_for_sudo
INFO - Script conflicting_value.fail.sh using profile (all) OK
INFO - Script correct_value_multiple_files.pass.sh using profile (all) OK
INFO - Script correct_value_single_file.pass.sh using profile (all) OK
INFO - Script custom_group_name.pass.sh using profile (all) OK
INFO - Script missing_role.fail.sh using profile (all) OK
INFO - Script missing_type.fail.sh using profile (all) OK
Thanks for adding this scenario.
Mab879
deleted the
make_selinux_context_elevation_for_sudo_more_flexaible
branch
Description:
Rationale:
Review Updates: