Ubuntu 24.04: Implement rule 5.4.2.2 Ensure root is the only GID 0 account #12777
Conversation
|
Hi @alanmcanonical. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
dodys
added
Ubuntu
| <criterion comment="tests that the root account's gid is equal to 0" test_ref="test_{{{rule_id}}}" /> | ||
| {{% if 'ubuntu' in product %}} | ||
| <criterion comment="no other users have primary group ID 0" test_ref="test_{{{rule_id}}}_no_other_gid_0" /> |
There was a problem hiding this comment.
Please add a fail test for this condition
| </criteria> | ||
| </definition> | ||
|
|
||
| <ind:textfilecontent54_test id="test_{{{rule_id}}}" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" version="1"> | ||
| <ind:textfilecontent54_test id="test_{{{rule_id}}}" check="all" comment="test that there are no accounts with GID 0 except root in the /etc/passwd file" version="1"> |
There was a problem hiding this comment.
Can you rewrite this comment please, it's misleading. This test only looks at the root user and checks if GID is equal to 0.
alanmcanonical
force-pushed
the
ubt24_5422
branch
from
552b504 to
2e33bfa
Compare
Minor comment changes Add a note in Ubuntu control file
Add check none_exist
Avoid -o flag since it's used with -u flag
alanmcanonical
force-pushed
the
ubt24_5422
branch
from
2e33bfa to
0ff7fd3
Compare
|
Code Climate has analyzed commit 0ff7fd3 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.8% (0.0% change). View more on Code Climate. |
Description:
Rationale: