Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve rule file_permissions_ungroupowned for use in bootable containers #12584

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Improve rule file_permissions_ungroupowned for use in bootable containers #12584

wants to merge 4 commits into from
+52 −5

Commits on Nov 7, 2024

  1. Exclude the /sysroot directory 

    In systems based on bootable container images the `/sysroot`
directory contains the filesystem of the image which should be
excluded from the scanned files check.
    @jan-cerny
    jan-cerny committed Nov 7, 2024
    Configuration menu
    Copy the full SHA
    a388032 View commit details
    Browse the repository at this point in the history

  2. Add support for /usr/lib/group 

    If the `nss-altfiles` are installed and `/etc/nsswitch.conf` is
configured to use `nss-altfiles`, the users group can be defined
als in `/usr/lib/group` next to `/etc/group`. The `/usr/lib/group`
is a valid source of group definitions and therefore needs to
be consulted during the check if nsswitch is configured to use
this file. The `nss-altfiles` is often used in bootable containers
base images.
    @jan-cerny
    jan-cerny committed Nov 7, 2024
    Configuration menu
    Copy the full SHA
    3eca0f2 View commit details
    Browse the repository at this point in the history

  3. Add new test scenarios 

    Add new Automatus test scenarios for rule file_permissions_ungroupowned
that cover recent changes - exclusion of /sysroot and addition
of /usr/lib/group as second source of group data.
    @jan-cerny
    jan-cerny committed Nov 7, 2024
    Configuration menu
    Copy the full SHA
    fb9b869 View commit details
    Browse the repository at this point in the history

  4. Update rule description 

    Reflects the recent change that the check now considers /usr/lib/group
in addition.
    @jan-cerny
    jan-cerny committed Nov 7, 2024
    Configuration menu
    Copy the full SHA
    6a30452 View commit details
    Browse the repository at this point in the history