{"action":"opened","issue":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/3210","repository_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/3210/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/3210/comments","events_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/3210/events","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/3210","id":352295972,"node_id":"MDU6SXNzdWUzNTIyOTU5NzI=","number":3210,"title":"xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading Result  fail even with latest rules and both entries in /etc/audit/audit.rules","user":{"login":"rshade","id":131337,"node_id":"MDQ6VXNlcjEzMTMzNw==","avatar_url":"https://avatars1.githubusercontent.com/u/131337?v=4","gravatar_id":"","url":"https://api.github.com/users/rshade","html_url":"https://github.com/rshade","followers_url":"https://api.github.com/users/rshade/followers","following_url":"https://api.github.com/users/rshade/following{/other_user}","gists_url":"https://api.github.com/users/rshade/gists{/gist_id}","starred_url":"https://api.github.com/users/rshade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rshade/subscriptions","organizations_url":"https://api.github.com/users/rshade/orgs","repos_url":"https://api.github.com/users/rshade/repos","events_url":"https://api.github.com/users/rshade/events{/privacy}","received_events_url":"https://api.github.com/users/rshade/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-20T21:04:33Z","updated_at":"2018-08-20T21:04:33Z","closed_at":null,"author_association":"NONE","body":"#### Description of problem:\r\nOn CentOS Linux release 7.5.1804 (Core), with openscap-1.2.17-1.el7 with scap-security-guide built from master as well as scap-security-guide-0.1.40-2.el7 I still get a failure on auditd rules. \r\n\r\n`oscap xccdf eval --fetch-remote-resources --profile standard --results-arf arf.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml`\r\n\r\n```\r\nTitle   Ensure auditd Collects Information on Kernel Module Loading and Unloading\r\nRule    xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading\r\nResult  fail\r\n```\r\n\r\n```\r\n grep modules /etc/audit/audit.rules\r\n-a always,exit -F arch=b32 -S init_module -S delete_module -k modules\r\n-a always,exit -F arch=b64 -S init_module -S delete_module -k modules\r\n-w /usr/sbin/insmod -p x -k modules\r\n-w /usr/sbin/rmmod -p x -k modules\r\n-w /usr/sbin/modprobe -p x -k modules\r\n```\r\n#### SCAP Security Guide Version:\r\nscap-security-guide-0.1.40-2.el7 & master\r\n\r\n#### Operating System Version:\r\nCentOS Linux release 7.5.1804\r\n\r\n#### Steps to Reproduce:\r\n\r\n1. Add repo: \r\n```\r\n[openscapmaint-openscap-latest]\r\nname=Copr repo for openscap-latest owned by openscapmaint\r\nbaseurl=https://copr-be.cloud.fedoraproject.org/results/openscapmaint/openscap-latest/epel-7-$basearch/\r\ntype=rpm-md\r\nskip_if_unavailable=True\r\ngpgcheck=1\r\ngpgkey=https://copr-be.cloud.fedoraproject.org/results/openscapmaint/openscap-latest/pubkey.gpg\r\nrepo_gpgcheck=0\r\nenabled=1\r\n```\r\n2. install scanner, and scap-security-guide\r\n3. oscap xccdf eval --fetch-remote-resources --profile standard --results-arf arf.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml\r\n4.\r\n\r\n#### Actual Results:\r\nFailure\r\n\r\n#### Expected Results:\r\nEverything to pass, this is the last rule to fix. \r\n\r\n#### Addition Information/Debugging Steps:\r\n\r\n\r\n"}}
{"actor":{"display_login":"rshade"}}