{"action":"opened","issue":{"url":"https://api.github.com/repos/dev-sec/linux-baseline/issues/104","repository_url":"https://api.github.com/repos/dev-sec/linux-baseline","labels_url":"https://api.github.com/repos/dev-sec/linux-baseline/issues/104/labels{/name}","comments_url":"https://api.github.com/repos/dev-sec/linux-baseline/issues/104/comments","events_url":"https://api.github.com/repos/dev-sec/linux-baseline/issues/104/events","html_url":"https://github.com/dev-sec/linux-baseline/issues/104","id":369595453,"node_id":"MDU6SXNzdWUzNjk1OTU0NTM=","number":104,"title":"os-11 fails on vanilla Ubuntu 16.04/18.04","user":{"login":"IceBear2k","id":4847450,"node_id":"MDQ6VXNlcjQ4NDc0NTA=","avatar_url":"https://avatars0.githubusercontent.com/u/4847450?v=4","gravatar_id":"","url":"https://api.github.com/users/IceBear2k","html_url":"https://github.com/IceBear2k","followers_url":"https://api.github.com/users/IceBear2k/followers","following_url":"https://api.github.com/users/IceBear2k/following{/other_user}","gists_url":"https://api.github.com/users/IceBear2k/gists{/gist_id}","starred_url":"https://api.github.com/users/IceBear2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IceBear2k/subscriptions","organizations_url":"https://api.github.com/users/IceBear2k/orgs","repos_url":"https://api.github.com/users/IceBear2k/repos","events_url":"https://api.github.com/users/IceBear2k/events{/privacy}","received_events_url":"https://api.github.com/users/IceBear2k/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-12T15:15:16Z","updated_at":"2018-10-12T15:15:16Z","closed_at":null,"author_association":"NONE","body":"# os-11 fails on vanilla Ubuntu 16.04/18.04\r\n\r\nTested with [ansible-os-hardening](https://github.com/dev-sec/ansible-os-hardening)\r\n\r\n## Expected behavior:\r\n\r\nos-11 should succeed on vanilla Ubuntu 16.04/18.04 (at least after running ansible-os-hardening)\r\n\r\n## Actual behavior:\r\n\r\nos-11 fails due to group permission\r\n\r\n```\r\n×  os-11: Protect log-directory (1 failed)\r\n✔  File /var/log should be directory\r\n✔  File /var/log should be owned by \"root\"\r\n×  File /var/log should be grouped into \"syslog\"\r\nexpected `File /var/log.grouped_into?(\"syslog\")` to return true, got false\r\n```\r\n\r\n## Details\r\n\r\nThe package `rsyslog` is not installed by default on Ubuntu 16.04 or 18.04 resulting in `/var/log` being grouped into `root` instead of `syslog`. For Ubuntu 14.04 it was still the default, therefore it is working correctly there.\r\n\r\n```\r\n$ docker run -it ubuntu:14.04 ls -ld /var/log\r\ndrwxrwxr-x 5 root syslog 4096 Aug  7 06:18 /var/log\r\n$ docker run -it ubuntu:16.04 ls -ld /var/log\r\ndrwxr-xr-x 4 root root 4096 Aug  8 02:03 /var/log\r\n$ docker run -it ubuntu:18.04 ls -ld /var/log\r\ndrwxr-xr-x 3 root root 4096 Aug 21 21:12 /var/log\r\n```\r\n\r\nUsing Kitchen on ansible-os-hardening succeeds because the used Docker images by rndmh3ro include rsyslog: https://github.com/rndmh3ro/docker-ansible/blob/master/ubuntu1604-ansible-latest/Dockerfile#L9\r\n\r\n## Suggested fix\r\n\r\nhttps://github.com/dev-sec/linux-baseline/blob/master/controls/os_spec.rb#L21 should only apply to 14.04 and use `root` otherwise (this will break compatibility with rndmh3ro Docker images and rsyslog installations)\r\n\r\nOR\r\n\r\nCheck whether `/var/log` is owned by either `root` or `syslog` (this will keep compatibility with rndmh3ro Docker images and rsyslog installations)"}}
{"actor":{"display_login":"IceBear2k"}}