Review 71961 - this seems broken :) #129
Comments
|
Yes - I have a working copy of this on the high side - the issue is that 40_custom will actually based on the OpenSCAP recommendations want the user to be named "bootuser". The template for 01_users by default uses root and a variable to define the password. And example real /boot/grub2/grub.cfg might look like this (I took out part for brevity): #
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub2-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### BEGIN /etc/grub.d/00_header ###
.
.
.
.
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/00_tuned ###
set tuned_params=""
set tuned_initrd=""
### END /etc/grub.d/00_tuned ###
### BEGIN /etc/grub.d/01_users ###
if [ -f ${prefix}/user.cfg ]; then
source ${prefix}/user.cfg
if [ -n "${GRUB2_PASSWORD}" ]; then
set superusers="root"
export superusers
password_pbkdf2 root ${GRUB2_PASSWORD}
fi
fi
### END /etc/grub.d/01_users ###
.
.
.
.
.
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/20_ppc_terminfo ###
### END /etc/grub.d/20_ppc_terminfo ###
### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/40_custom ###
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
# V-71963 - Systems using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.
set superusers="bootuser"
# Password1234
password_pbkdf2 bootuser grub.pbkdf2.sha512.10000.8A72B2427C84D0ADAED74EF9D284EDFD70E6C40BCD40A9339321FFAD1170E2000D49443A624B394BEDFC543D51BFF9160974BBA64872FAF86E4A35B85A72673F.8B4D9C7DA7873B267341E6B1B0291DCE2F9BFCAE997D481B5905BFBF6C3F4FD474DF9AE5E93FBDC7B7FACF73329A86EDE1E57BE6AAC8441BF0F26B2E46BDDBFC
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg;
fi
### END /etc/grub.d/41_custom ###Then - /boot/grub2/user.cfg will look like: So - maybe the proposed V-71961 Test could look like: tag "fix_id": "F-78313r2_fix"
describe.one do
grub_superusers.each do |user|
describe file(grub_main_cfg) do
its('content') { should match %r{^\s*password_pbkdf2\s+#{user} } }
end
end
end
grub_user_boot_files.each do |user_cfg_file|
next if !file(user_cfg_file).exist?
describe file(user_cfg_file) do
its('content') { should match %r{^GRUB2_PASSWORD\=grub\.pbkdf2\.sha512} }
end
end |
|
It appears that V-71961 was updated back on Nov. 8, 2019 to accept only one user as input. At the time attributes were still in use and the attribute was updated to utilize only one user. Some time later attributes were migrated to inputs but the change for this datatype was not reflected there. The input for 'grub_superuser' is defined as an Array. The code tries to compare the string 'root' to the string-interpretation of the array '["root"]'. Changing the input datatype to string and setting to 'root' seems to generally fix the problem. I think the STIG is clear here in that the USER (singular) is to be "root". We don't want to allow for the input of a list of users. In fact, since the direction is so clear I'd say that it shouldn't take an input at all and 'root' should be hardcoded in the control. Otherwise, it appears to me that the actual code of the control is fairly solid. |
Removed 'grub_superuser' as an input. The STIG guidance is clear that this is the only allowable account so there is no reason to allow it to be tailored. Updated V-71961 to remove reference to the 'grub_superuser' input and hardcode "grub_superuser = 'root'". Signed-off-by: Lesley Kimmel <[email protected]>
Set the input 'grub_superuser' to type String with value 'root' in inspec.yml as this is what dependent controls expect. Signed-off-by: Lesley Kimmel <[email protected]>
Set the input 'grub_superuser' to type String with value 'root' in inspec.yml as this is what dependent controls expect. Signed-off-by: Lesley Kimmel <[email protected]> Co-authored-by: Lesley Kimmel <[email protected]> Co-authored-by: Trevor Vaughan <[email protected]>
× V-71961: Systems with a Basic Input/Output System (BIOS) must require
authentication upon booting into single-user and maintenance modes. (3 failed)
✔ There must be only one grub2 superuser, and it must have the value ["root"] length should cmp == 1
× There must be only one grub2 superuser, and it must have the value ["root"] first should cmp == ["root"]
The text was updated successfully, but these errors were encountered: