Disable the abrt_upload_watch_anon_write SELinux Boolean

An XCCDF Rule

Description

By default, the SELinux boolean abrt_upload_watch_anon_write is enabled. This setting should be disabled as it allows the Automatic Bug Report Tool (ABRT) to modify public files used for public file transfer services. To disable the abrt_upload_watch_anon_write SELinux boolean, run the following command:

$ sudo setsebool -P abrt_upload_watch_anon_write off

ID: xccdf_org.ssgproject.content_rule_sebool_abrt_upload_watch_anon_write
Severity: Medium
References: 3.7.2
Updated: about 1 year ago

- name: Disable the abrt_upload_watch_anon_write SELinux Boolean - Ensure libsemanage-python
    Installed
  package:
    name: libsemanage-python
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_abrt_upload_watch_anon_write
- name: XCCDF Value var_abrt_upload_watch_anon_write # promote to variable
  set_fact:
    var_abrt_upload_watch_anon_write: !!str <xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" use="legacy"/>
  tags:
    - always

- name: Disable the abrt_upload_watch_anon_write SELinux Boolean - Set SELinux Boolean
    abrt_upload_watch_anon_write Accordingly
  seboolean:
    name: abrt_upload_watch_anon_write
    state: '{{ var_abrt_upload_watch_anon_write }}'
    persistent: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ansible_facts.selinux.status == 'enabled'
  tags:
  - NIST-800-171-3.7.2
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - sebool_abrt_upload_watch_anon_write

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "libsemanage-python" ; then
    yum install -y "libsemanage-python"
fi

if selinuxenabled; then

    var_abrt_upload_watch_anon_write='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" use="legacy"/>'

    setsebool -P abrt_upload_watch_anon_write $var_abrt_upload_watch_anon_write

else
    echo "Skipping remediation, SELinux is disabled";
    false
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Disable the abrt_upload_watch_anon_write SELinux Boolean

Description

Remediation - Ansible

Remediation - Shell Script