Tree - rpms/scap-security-guide

skyler / rpms / scap-security-guide

Forked from rpms/scap-security-guide 3 years ago
Source
Stats
Files

Commit: 3507633c6d54d009ca4665c25b0be75036e3ccf6
Blob Blame History Raw
From 4995c390a22020454be6625f2bd63c1a04302043 Mon Sep 17 00:00:00 2001
From: Gabe <redhatrises@gmail.com>
Date: Fri, 30 Aug 2019 11:15:22 -0600
Subject: [PATCH 1/5] Remove usage of the SHELL module or get rid of pipe usage

---
 .../no_direct_root_logins/ansible/shared.yml  | 10 ++++-----
 .../ansible/shared.yml                        | 22 +++++++++----------
 .../ansible/shared.yml                        |  4 +---
 .../template_ANSIBLE_service_disabled         | 14 +++++++-----
 4 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
index 9049733c64..e9a29a24d5 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml
@@ -3,13 +3,13 @@
 # strategy = restrict
 # complexity = low
 # disruption = low
-- name: Test for existence /etc/cron.allow
+- name: Test for existence of /etc/securetty
   stat:
     path: /etc/securetty
   register: securetty_empty
 
 - name: "Direct root Logins Not Allowed"
-  shell: echo > /etc/securetty
-  args:
-    warn: False
-  changed_when: securetty_empty.stat.size > 1
+  copy:
+    dest: /etc/securetty
+    content: ""
+  when: securetty_empty.stat.size > 1
diff --git a/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml
index 3ec812835f..cee947e8cc 100644
--- a/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml
+++ b/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml
@@ -3,27 +3,27 @@
 # strategy = restrict
 # complexity = low
 # disruption = medium
-- name: "Fail if user is not root"
+- name: "Print error message if user is not root"
   fail:
     msg: 'Root account required to read root $PATH'
   when: ansible_user != "root"
+  ignore_errors: true
 
 - name: "Get root paths which are not symbolic links"
-  shell: |
-    set -o pipefail
-    tr ":" "\n" <<< "$PATH" | xargs -I% find % -maxdepth 0 -type d
-  args:
-    warn: False
-    executable: /bin/bash
+  stat:
+    path: "{{ item }}"
   changed_when: False
   failed_when: False
   register: root_paths
+  with_items: "{{ ansible_env.PATH.split(':') }}"
   when: ansible_user == "root"
-  check_mode: no
 
 - name: "Disable writability to root directories"
   file:
-    path: "{{ item }}"
+    path: "{{ item.item }}"
     mode: "g-w,o-w"
-  with_items: "{{ root_paths.stdout_lines }}"
-  when: root_paths.stdout_lines is defined
+  with_items: "{{ root_paths.results }}"
+  when:
+    - root_paths.results is defined
+    - item.stat.exists
+    - not item.stat.islnk
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml
index 7f958e0af5..9a8f91020c 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml
@@ -5,9 +5,7 @@
 # disruption = low
 
 - name: Search for privileged commands
-  shell: |
-    set -o pipefail
-    find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null | cat
+  shell: find / -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null
   args:
     warn: False
     executable: /bin/bash
diff --git a/shared/templates/template_ANSIBLE_service_disabled b/shared/templates/template_ANSIBLE_service_disabled
index 69bf69aaea..07bb8fff0c 100644
--- a/shared/templates/template_ANSIBLE_service_disabled
+++ b/shared/templates/template_ANSIBLE_service_disabled
@@ -4,9 +4,10 @@
 # complexity = low
 # disruption = low
 {{%- if init_system == "systemd" %}}
-- name: "Unit Service Exists"
-  shell: systemctl list-unit-files | grep -q '^{{{ DAEMONNAME }}}.service'
+- name: "Unit Service Exists - {{{ DAEMONNAME }}}.service"
+  command: systemctl list-unit-files {{{ DAEMONNAME }}}.service
   register: service_file_exists
+  changed_when: False
   ignore_errors: True
 
 - name: Disable service {{{ SERVICENAME }}}
@@ -17,11 +18,12 @@
 {{%- if MASK_SERVICE %}}
     masked: "yes"
 {{%- endif %}}
-  when: service_file_exists.rc == 0
+  when: '"{{{ DAEMONNAME }}}.service" in service_file_exists.stdout_lines[1]'
 
-- name: "Unit Socket Exists"
-  shell: systemctl list-unit-files | grep -q '^{{{ DAEMONNAME }}}.socket'
+- name: "Unit Socket Exists - {{{ DAEMONNAME }}}.socket"
+  command: systemctl list-unit-files {{{ DAEMONNAME }}}.socket
   register: socket_file_exists
+  changed_when: False
   ignore_errors: True
 
 - name: Disable socket {{{ SERVICENAME }}}
@@ -32,7 +34,7 @@
 {{%- if MASK_SERVICE %}}
     masked: "yes"
 {{%- endif %}}
-  when: socket_file_exists.rc == 0
+  when: '"{{{ DAEMONNAME }}}.socket" in socket_file_exists.stdout_lines[1]'
 
 {{% elif init_system == "upstart" %}}
 - name: Stop {{{ SERVICENAME }}}

From e268f1e07192a5cf343b6ac36053553d1074bd3b Mon Sep 17 00:00:00 2001
From: Gabe <redhatrises@gmail.com>
Date: Fri, 30 Aug 2019 12:53:40 -0600
Subject: [PATCH 2/5] Use command and mount module instead of shell

- Fixes #4783
---
 .../ansible/shared.yml                        | 20 ++++++++-----------
 ...te_ANSIBLE_mount_option_remote_filesystems | 19 ++++++++----------
 2 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/ansible/shared.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/ansible/shared.yml
index 506c3dee31..6982ce293e 100644
--- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/ansible/shared.yml
+++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/ansible/shared.yml
@@ -5,20 +5,16 @@
 # disruption = medium
 
 - name: "Get nfs and nfs4 mount points, that don't have Kerberos security option"
-  shell: |
-    set -o pipefail
-    grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | grep -v "sec=krb5:krb5i:krb5p" | awk '{print $2}'
-  args:
-    warn: False
-    executable: /bin/bash
+  command: findmnt --fstab --types nfs,nfs4 -O nosec=krb5:krb5i:krb5p -n -o TARGET
   register: points_register
   check_mode: no
   changed_when: False
 
-- name: "Add Kerberos security to mount points"
-  shell: awk '$2=="{{ item }}"{$4=$4",sec=krb5:krb5i:krb5p"}1' /etc/fstab > fstab.tmp && mv fstab.tmp /etc/fstab
-  args:
-    warn: False
-  with_items:
-    - "{{ points_register.stdout_lines }}"
+- name: "Add Kerberos security to nfs and nfs4 mount points"
+  mount:
+    path: "{{ item.split()[0] }}"
+    src: "{{ item.split()[1] }}"
+    fstype: "{{ item.split()[2] }}"
+    state: mounted
+    opts: "{{ item.split()[3] }},sec=krb5:krb5i:krb5p"
   when: (points_register.stdout | length > 0)
diff --git a/shared/templates/template_ANSIBLE_mount_option_remote_filesystems b/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
index f89c1d7285..f3d6f02d82 100644
--- a/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
+++ b/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
@@ -5,19 +5,16 @@
 # disruption = medium
 
 - name: "Get nfs and nfs4 mount points, that don't have {{{ MOUNTOPTION }}}"
-  shell: |
-    set -o pipefail
-    grep -E "[[:space:]]nfs[4]?[[:space:]]" /etc/fstab | grep -v "{{{ MOUNTOPTION }}}" | awk '{print $2}'
-  args:
-    executable: /bin/bash
+  command: findmnt --fstab --types nfs,nfs4 -O no{{{ MOUNTOPTION }} -n
   register: points_register
   check_mode: no
   changed_when: False
 
-- name: "Add {{{ MOUNTOPTION }}} to mount points"
-  shell: awk '$2=="{{ item }}"{$4=$4",{{{ MOUNTOPTION }}}"}1' /etc/fstab > fstab.tmp && mv fstab.tmp /etc/fstab
-  args:
-    executable: /bin/bash
-  with_items:
-    - "{{ points_register.stdout_lines }}"
+- name: "Add {{{ MOUNTOPTION }}} to nfs and nfs4 mount points"
+  mount:
+    path: "{{ item.split()[0] }}"
+    src: "{{ item.split()[1] }}"
+    fstype: "{{ item.split()[2] }}"
+    state: mounted
+    opts: "{{ item.split()[3] }},{{{ MOUNTOPTION }}}"
   when: (points_register.stdout | length > 0)

From 189a8962ddfc35a516eb468f7df1b66a55d874a6 Mon Sep 17 00:00:00 2001
From: Gabe <redhatrises@gmail.com>
Date: Fri, 30 Aug 2019 15:18:02 -0600
Subject: [PATCH 3/5] Remove usage of shell module in gpgkey install Ansible
 snippet

---
 .../ansible/shared.yml                         | 18 +++++++++---------
 ...ate_ANSIBLE_mount_option_remote_filesystems |  2 +-
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
index 079020f8cd..91a98640ad 100644
--- a/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
+++ b/linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml
@@ -14,13 +14,9 @@
 - name: Read signatures in GPG key
   # According to /usr/share/doc/gnupg2/DETAILS fingerprints are in "fpr" record in field 10
   {{% if product == "rhel8" -%}}
-  shell: |
-    set -o pipefail
-    gpg --show-keys --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" | grep -A1 "^pub" | grep "^fpr" | cut -d ":" -f 10
+  command: gpg --show-keys --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
   {{%- else -%}}
-  shell: |
-    set -o pipefail
-    gpg --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" | grep "^fpr" | cut -d ":" -f 10
+  command: gpg --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
   {{%- endif %}}
   args:
     warn: False
@@ -29,9 +25,13 @@
   register: gpg_fingerprints
   check_mode: no
 
+- name: Set Fact - Installed GPG Fingerprints
+  set_fact:
+    gpg_installed_fingerprints: "{{ gpg_fingerprints.stdout | regex_findall('^pub.*\n(?:^fpr[:]*)([0-9A-Fa-f]*)', '\\1') | list }}"
+
 - name: Set Fact - Valid fingerprints
   set_fact:
-     gpg_valid_fingerprints: ("{{{ release_key_fingerprint }}}" "{{{ auxiliary_key_fingerprint }}}")
+    gpg_valid_fingerprints: ("{{{ release_key_fingerprint }}}" "{{{ auxiliary_key_fingerprint }}}")
 
 - name: Import RedHat GPG key
   rpm_key:
@@ -39,6 +39,6 @@
     key: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
   when:
    - gpg_key_directory_permission.stat.mode <= '0755'
-   - ( gpg_fingerprints.stdout_lines | difference(gpg_valid_fingerprints)) | length == 0
-   - gpg_fingerprints.stdout_lines | length > 0
+   - (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0
+   - gpg_installed_fingerprints | length > 0
    - ansible_distribution == "RedHat"
diff --git a/shared/templates/template_ANSIBLE_mount_option_remote_filesystems b/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
index f3d6f02d82..a58d7729ec 100644
--- a/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
+++ b/shared/templates/template_ANSIBLE_mount_option_remote_filesystems
@@ -5,7 +5,7 @@
 # disruption = medium
 
 - name: "Get nfs and nfs4 mount points, that don't have {{{ MOUNTOPTION }}}"
-  command: findmnt --fstab --types nfs,nfs4 -O no{{{ MOUNTOPTION }} -n
+  command: findmnt --fstab --types nfs,nfs4 -O no{{{ MOUNTOPTION }}} -n
   register: points_register
   check_mode: no
   changed_when: False

From 047c5d342860745dcc2f80a9f00d30cf25e76348 Mon Sep 17 00:00:00 2001
From: Gabe <redhatrises@gmail.com>
Date: Tue, 3 Sep 2019 14:18:54 -0600
Subject: [PATCH 4/5] Remove shell module usage for rpm verification tasks

- Fixes #4617
---
 .../rpm_verify_hashes/ansible/shared.yml      | 27 ++++++++++++-------
 .../rpm_verify_ownership/ansible/shared.yml   | 11 +++-----
 .../rpm_verify_permissions/ansible/shared.yml | 19 ++++++++-----
 3 files changed, 34 insertions(+), 23 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
index 2a38e43c3b..1ba29992ab 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
@@ -1,6 +1,6 @@
 # platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv
 # reboot = false
-# strategy = unknown
+# strategy = restrict
 # complexity = high
 # disruption = medium
 - name: "Set fact: Package manager reinstall command (dnf)"
@@ -14,21 +14,30 @@
   when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux")
 
 - name: "Read files with incorrect hash"
-  shell: |
-    set -o pipefail
-    rpm -Va | grep -E '^..5.* /(bin|sbin|lib|lib64|usr)/' | awk '{print $NF}'
+  command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser --nogroup --nomode --noconfig --noghost
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch files with incorrect hash using rpm module
-    executable: /bin/bash
   register: files_with_incorrect_hash
   changed_when: False
   failed_when: files_with_incorrect_hash.rc > 1
   when: (package_manager_reinstall_cmd is defined)
-  check_mode: no
+
+- name: Create list of packages
+  command: rpm -qf "{{ item }}"
+  args:
+    warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect hash using rpm module
+  with_items: "{{ files_with_incorrect_hash.stdout_lines | map('regex_findall', '^[.]+[5]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
+  register: list_of_packages
+  changed_when: False
+  when:
+    - files_with_incorrect_hash.stdout_lines is defined
+    - (files_with_incorrect_hash.stdout_lines | length > 0)
 
 - name: "Reinstall packages of files with incorrect hash"
-  shell: "{{ package_manager_reinstall_cmd }} $(rpm -qf '{{ item }}')"
+  command: "{{ package_manager_reinstall_cmd }} '{{ item }}'"
   args:
     warn: False # Ignore ANSIBLE0006, this task is flexible with regards to package manager
-  with_items: "{{ files_with_incorrect_hash.stdout_lines }}"
-  when: (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines | length > 0))
+  with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}"
+  when:
+    - files_with_incorrect_hash.stdout_lines is defined
+    - (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines | length > 0))
diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
index 9fd07f8da2..1d9720cb82 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
@@ -4,27 +4,24 @@
 # complexity = high
 # disruption = medium
 - name: "Read list of files with incorrect ownership"
-  shell: |
-    set -o pipefail
-    rpm -Va --nofiledigest | awk '{ if (substr($0,6,1)=="U" || substr($0,7,1)=="G") print $NF }'
+  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev --nocaps --nolinkto --nomode
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch files with incorrect ownership using rpm module
-    executable: /bin/bash
   register: files_with_incorrect_ownership
   failed_when: files_with_incorrect_ownership.rc > 1
   changed_when: False
-  check_mode: no
 
 - name: Create list of packages
   command: rpm -qf "{{ item }}"
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect ownership using rpm module
-  with_items: "{{ files_with_incorrect_ownership.stdout_lines | unique }}"
+  with_items: "{{ files_with_incorrect_ownership.stdout_lines | map('regex_findall', '^[.]+[U|G]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
   register: list_of_packages
+  changed_when: False
   when: (files_with_incorrect_ownership.stdout_lines | length > 0)
 
 - name: "Correct file ownership with RPM"
-  command: "rpm --quiet --setugids '{{ item }}'"
+  command: "rpm --setperms '{{ item }}'"
   args:
     warn: False # Ignore ANSIBLE0006, we can't correct ownership using rpm module
   with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}"
diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
index a22f03a987..149dbf9fb7 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
@@ -4,20 +4,25 @@
 # complexity = high
 # disruption = medium
 - name: "Read list of files with incorrect permissions"
-  shell: |
-    set -o pipefail
-    rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }'
+  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev --nocaps --nolinkto --nouser --nogroup
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch files with incorrect permissions using rpm module
-    executable: /bin/bash
   register: files_with_incorrect_permissions
   failed_when: files_with_incorrect_permissions.rc > 1
   changed_when: False
-  check_mode: no
+
+- name: Create list of packages
+  command: rpm -qf "{{ item }}"
+  args:
+    warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect permissions using rpm module
+  with_items: "{{ files_with_incorrect_permissions.stdout_lines | map('regex_findall', '^[.]+[M]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
+  register: list_of_packages
+  changed_when: False
+  when: (files_with_incorrect_permissions.stdout_lines | length > 0)
 
 - name: "Correct file permissions with RPM"
-  shell: "rpm --setperms $(rpm -qf '{{ item }}')"
+  command: "rpm --setperms '{{ item }}'"
   args:
     warn: False # Ignore ANSIBLE0006, we can't correct permissions using rpm module
-  with_items: "{{ files_with_incorrect_permissions.stdout_lines }}"
+  with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}"
   when: (files_with_incorrect_permissions.stdout_lines | length > 0)

From 83d241dceafb1b8d8829655b0cdeb44af1b01d2a Mon Sep 17 00:00:00 2001
From: Gabe <redhatrises@gmail.com>
Date: Fri, 6 Sep 2019 11:55:18 -0600
Subject: [PATCH 5/5] Fix regex and escape correctly

---
 .../rpm_verification/rpm_verify_hashes/ansible/shared.yml     | 2 +-
 .../rpm_verification/rpm_verify_ownership/ansible/shared.yml  | 4 ++--
 .../rpm_verify_permissions/ansible/shared.yml                 | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
index 1ba29992ab..0dc09339f4 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml
@@ -26,7 +26,7 @@
   command: rpm -qf "{{ item }}"
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect hash using rpm module
-  with_items: "{{ files_with_incorrect_hash.stdout_lines | map('regex_findall', '^[.]+[5]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
+  with_items: "{{ files_with_incorrect_hash.stdout_lines | map('regex_findall', '^[.]+[5]+.* (\\/.*)', '\\1') | map('join') | select('match', '(\\/.*)') | list | unique }}"
   register: list_of_packages
   changed_when: False
   when:
diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
index 1d9720cb82..d02508808c 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/ansible/shared.yml
@@ -15,13 +15,13 @@
   command: rpm -qf "{{ item }}"
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect ownership using rpm module
-  with_items: "{{ files_with_incorrect_ownership.stdout_lines | map('regex_findall', '^[.]+[U|G]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
+  with_items: "{{ files_with_incorrect_ownership.stdout_lines | map('regex_findall', '^[.]+[U|G]+.* (\\/.*)', '\\1') | map('join') | select('match', '(\\/.*)') | list | unique }}"
   register: list_of_packages
   changed_when: False
   when: (files_with_incorrect_ownership.stdout_lines | length > 0)
 
 - name: "Correct file ownership with RPM"
-  command: "rpm --setperms '{{ item }}'"
+  command: "rpm --quiet --setugids '{{ item }}'"
   args:
     warn: False # Ignore ANSIBLE0006, we can't correct ownership using rpm module
   with_items: "{{ list_of_packages.results | map(attribute='stdout_lines') | list | unique }}"
diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
index 149dbf9fb7..55a37a4235 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/ansible/shared.yml
@@ -15,7 +15,7 @@
   command: rpm -qf "{{ item }}"
   args:
     warn: False # Ignore ANSIBLE0006, we can't fetch packages with files with incorrect permissions using rpm module
-  with_items: "{{ files_with_incorrect_permissions.stdout_lines | map('regex_findall', '^[.]+[M]+.* (\/.*)', '\\1') | map('join') | select('match', '(\/.*)') | list | unique }}"
+  with_items: "{{ files_with_incorrect_permissions.stdout_lines | map('regex_findall', '^[.]+[M]+.* (\\/.*)', '\\1') | map('join') | select('match', '(\\/.*)') | list | unique }}"
   register: list_of_packages
   changed_when: False
   when: (files_with_incorrect_permissions.stdout_lines | length > 0)
skyler / rpms / scap-security-guide

Source Code

Files
