Skip to content

Fix macro 'create_interactive_users_list_object' to also ignore users having /usr/sbin/nologin shell #13962

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Mab879 merged 1 commit into from
Oct 3, 2025
Merged

Fix macro 'create_interactive_users_list_object' to also ignore users having /usr/sbin/nologin shell #13962

Mab879 merged 1 commit into from
Oct 3, 2025

Conversation

@rmetrich
Copy link
Contributor

@rmetrich rmetrich commented Oct 1, 2025

Description:

The create_interactive_users_list_object macro doesn't exclude users having /usr/sbin/nologin as their shell.
On RHEL, users may get /sbin/nologin or /usr/sbin/nologin, depending on the package name, and for Dynamic Users, they seem to always get /usr/sbin/nologin.

Rationale:

See Red Hat issue RHEL-118647

Review Hints:

Reproducer on RHEL9 is:

  1. Install a system with STIG profile
  2. Start cockpit.socket unit and log into cockpit
  3. Execute a scan with xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_defined rule

Result is failure because of dynamic users having a different shell:

[root@vm-stig9 ~]# getent passwd 
[...]
cockpit-systemd-service:x:61789:61789:Dynamic User:/:/usr/sbin/nologin
cockpit-session-socket:x:63205:63205:Dynamic User:/:/usr/sbin/nologin
cockpit-wsinstance-https:x:63714:63714:Dynamic User:/:/usr/sbin/nologin
cockpit-wsinstance-socket:x:62764:62764:Dynamic User:/:/usr/sbin/nologin

@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Oct 1, 2025
@openshift-ci
Copy link

openshift-ci bot commented Oct 1, 2025

Hi @rmetrich. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@jan-cerny jan-cerny added the OVAL OVAL update. Related to the systems assessments. label Oct 2, 2025
@jan-cerny jan-cerny added this to the 0.1.79 milestone Oct 2, 2025
@Mab879 Mab879 self-assigned this Oct 3, 2025
Mab879
Mab879 approved these changes Oct 3, 2025
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!

@Mab879 Mab879 merged commit e0ca60f into ComplianceAsCode:master Oct 3, 2025
124 of 126 checks passed
@ggbecker ggbecker mentioned this pull request Oct 7, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mab879 Mab879 Mab879 approved these changes

Assignees

@Mab879 Mab879

Labels

needs-ok-to-test Used by openshift-ci bot. OVAL OVAL update. Related to the systems assessments.

Projects

None yet

Milestone

0.1.79

Development

Successfully merging this pull request may close these issues.

3 participants

@rmetrich @Mab879 @jan-cerny