RHBA-2022:8131 - Bug Fix Advisory

Topic

An update for scap-security-guide is now available for Red Hat Enterprise Linux 9.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x

Fixes

• BZ - 1998583 - openscap uses x86_64 audit syscall rules for all arches in OSPP profile
• BZ - 2058154 - Make rule audit_access_success in OSPP profile unenforcing
• BZ - 2060049 - The zipl_vsyscall_argument rule actually not needed
• BZ - 2060094 - Wrong permissions on /boot/grub2/grub.cfg file after HIPAA profile remediation and machine reboot
• BZ - 2070563 - Rebase SSG to the latest upstream version in RHEL 9.1
• BZ - 2073040 - login.defs PASS_MIN_LEN is unused
• BZ - 2081688 - Refresh of OSPP SCAP rules that disable core dumps
• BZ - 2081708 - Removal of some network sysctl-related rules from OSPP SCAP profile
• BZ - 2081719 - Removal of sysctl_fs_protected_* rules from OSPP profile
• BZ - 2081728 - Refresh of BPF-related SCAP rules in the OSPP profile
• BZ - 2083716 - Make sysctl_user_max_user_namespaces enforcing in the OSPP profile
• BZ - 2092799 - The require_singleuser_auth SCAP rule description is confusing
• BZ - 2092809 - Separate rule just for the GRUB_DISABLE_RECOVERY=true check
• BZ - 2092840 - New rule to check against systemd.debug-shell=1
• BZ - 2105016 - Remove *rsyslog* and *audispd-plugins* rules from the OSPP SCAP profile
• BZ - 2105278 - The sshd_enable_strictmodes rule is not needed in RHEL 9 OSPP SCAP profile
• BZ - 2108158 - Remove dnf-automatic_security_updates_only rule from the OSPP SCAP profile
• BZ - 2108167 - Remove three configure_*_crypto_policy rules from the OSPP SCAP profile
• BZ - 2108173 - Remove kerberos_disable_no_keytab rule from the OSPP SCAP profile
• BZ - 2108224 - Remove three package_*_installed rules from the OSPP SCAP profile
• BZ - 2108226 - Remove all package_*_removed rules from the OSPP SCAP profile
• BZ - 2108569 - remediation results in double crypto-policies include
• BZ - 2109984 - Remove four accounts_password_pam_* rules from the OSPP SCAP profile
• BZ - 2109992 - Remove accounts_max_concurrent_login_sessions from the OSPP SCAP profile
• BZ - 2109994 - Remove securetty_root_login_console_only from the OSPP SCAP profile
• BZ - 2110347 - Remove accounts_umask_etc_* rules from the OSPP SCAP profile
• BZ - 2110350 - Remove multiple partition_for_* and respective mount_option_* rules from the OSPP SCAP profile
• BZ - 2114979 - The new enable_authselect SCAP rule needs some tweaking
• BZ - 2117669 - Ensure that all rules that were once selected in a profile remain in the datastream within the product lifecycle

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index