From 9a72c4cef2dd782e14f1534a52c45125671a828d Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Mon, 14 Nov 2022 15:23:32 +0100

Subject: [PATCH 2/4] Update remediation to skip .bash_profile file

This file can have the umask content but for a different purpose than

this rule intention. It was ignored in order to avoid changing the bash

history. Ansible and Bash were updated.

---

 .../accounts_umask_interactive_users/ansible/shared.yml       | 4 +++-

 .../accounts_umask_interactive_users/bash/shared.sh           | 4 +++-

 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/ansible/shared.yml

index 67064ac4a3b..3586ae69cbe 100644

--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/ansible/shared.yml

+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/ansible/shared.yml

@@ -9,6 +9,8 @@

     cmd: |

       for dir in $(awk -F':' '{ if ($3 >= {{{ uid_min }}} && $3 != 65534) print $6}' /etc/passwd); do

         for file in $(find $dir -maxdepth 1 -type f -name ".*"); do

-          sed -i 's/^\([\s]*umask\s*\)/#\1/g' $file

+          if [ "$(basename $file)" != ".bash_history" ]; then

+            sed -i 's/^\([\s]*umask\s*\)/#\1/g' $file

+          fi

         done

       done

diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/bash/shared.sh

index d5f803db313..f524ff01f9a 100644

--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/bash/shared.sh

+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/bash/shared.sh

@@ -6,6 +6,8 @@

 {{% call iterate_over_command_output("dir", "awk -F':' '{ if ($3 >= " ~ uid_min ~ " && $3 != 65534) print $6}' /etc/passwd") -%}}

 {{% call iterate_over_find_output("file", '$dir -maxdepth 1 -type f -name ".*"') -%}}

-sed -i 's/^\([\s]*umask\s*\)/#\1/g' "$file"

+if [ "$(basename $file)" != ".bash_history" ]; then

+    sed -i 's/^\([\s]*umask\s*\)/#\1/g' "$file"

+fi

 {{%- endcall %}}

 {{%- endcall %}}

From d0dcfc06b31d08cb42151463473ba0b211c54e6a Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Mon, 14 Nov 2022 15:26:04 +0100

Subject: [PATCH 3/4] Include test scenario to test .bash_history treatment

---

 .../tests/bash_history_ignored.pass.sh                       | 5 +++++

 1 file changed, 5 insertions(+)

 create mode 100644 linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/tests/bash_history_ignored.pass.sh

diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/tests/bash_history_ignored.pass.sh b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/tests/bash_history_ignored.pass.sh

new file mode 100644

index 00000000000..8eeffc233b2

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/tests/bash_history_ignored.pass.sh

@@ -0,0 +1,5 @@

+#!/bin/bash

+

+USER="cac_user"

+useradd -m $USER

+echo "umask 022" > /home/$USER/.bash_history

From c8dc63aad4fbe6df499192eda01d66e64bc8c9c3 Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Mon, 14 Nov 2022 15:27:26 +0100

Subject: [PATCH 4/4] Extend OVAL check to ignore .bash_history file

This rule targets user files where the umask can be changed. It is not the

case for .bash_history. In addition, it should be avoided to change the

.bash_history file by this rule remediations.

---

 .../accounts_umask_interactive_users/oval/shared.xml        | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml

index 42dbdbbae46..6f3eaa570d7 100644

--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml

+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/oval/shared.xml

@@ -29,8 +29,14 @@

     <ind:filename operation="pattern match">^\..*</ind:filename>

     <ind:pattern operation="pattern match">^[\s]*umask\s*</ind:pattern>

     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>

+    <filter action="exclude">state_accounts_umask_interactive_users_bash_history</filter>

   </ind:textfilecontent54_object>

+  

+    version="1">

+    <ind:filename operation="pattern match">^\.bash_history</ind:filename>

+  </ind:textfilecontent54_state>

+

                   check_existence="none_exist" version="1"