Disable the abrt_upload_watch_anon_write SELinux Boolean

An XCCDF Rule

Description

By default, the SELinux boolean abrt_upload_watch_anon_write is enabled. This setting should be disabled as it allows the Automatic Bug Report Tool (ABRT) to modify public files used for public file transfer services. To disable the abrt_upload_watch_anon_write SELinux boolean, run the following command:

$ sudo setsebool -P abrt_upload_watch_anon_write off

ID: xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write
Severity: Medium
References: 3.7.2
Updated: about 1 year ago

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "python3-libsemanage" ; then
    yum install -y "python3-libsemanage"
fi

if selinuxenabled; then

    var_abrt_upload_watch_anon_write='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" use="legacy"/>'

    setsebool -P abrt_upload_watch_anon_write $var_abrt_upload_watch_anon_write

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: Disable the abrt_upload_watch_anon_write SELinux Boolean - Ensure python3-libsemanage
    Installed
  package:
    name: python3-libsemanage
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_abrt_upload_watch_anon_write
- name: XCCDF Value var_abrt_upload_watch_anon_write # promote to variable
  set_fact:
    var_abrt_upload_watch_anon_write: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" use="legacy"/>
  tags:
    - always

- name: Disable the abrt_upload_watch_anon_write SELinux Boolean - Set SELinux Boolean
    abrt_upload_watch_anon_write Accordingly
  seboolean:
    name: abrt_upload_watch_anon_write
    state: '{{ var_abrt_upload_watch_anon_write }}'
    persistent: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_abrt_upload_watch_anon_write

Disable the abrt_upload_watch_anon_write SELinux Boolean

Description

Remediation - Shell Script

Remediation - Ansible