openscap - IBM Z (s390x) is not detected as a 64bit architecture

Solution In Progress - Updated -

Issue

  • Despite having "-a always,exit -F arch=b32 -S stime -k audit_time_rules" audit rule defined, openscap still fails xccdf_org.ssgproject.content_rule_audit_rules_time_stime rule on s390x

    # auditctl -l
    -a always,exit -F arch=b32 -S stime -F key=audit_time_rules
    
    # oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_C2S \
                       --rule xccdf_org.ssgproject.content_rule_audit_rules_time_stime \
                        /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
    Title   Record Attempts to Alter Time Through stime
    Rule    xccdf_org.ssgproject.content_rule_audit_rules_time_stime
    Ident   CCE-27299-7
    Result  fail
    

Environment

  • Red Hat Enterprise Linux (RHEL) 7 for System z (s390x)
  • Red Hat Enterprise Linux (RHEL) 8 for System z (s390x)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In