OpenSCAP/scap-security-guide — pull request #298 by iankko (2014-10-10 17:02:13+00:00)
Title: [bugfix] [RHEL/6] Use full path to sysctl executable for sysctl remediation scripts to prevent errors on RHEL-6 Server when attempting remediation

Today, when trying to perform remediation for the following sysctl rule ```Disable Kernel Parameter for Sending ICMP Redirects by Default``` on RHEL-6.5 Server [Red Hat Enterprise Linux Server release 6.5 (Santiago)] noticed the following behaviour:

```
# oscap xccdf eval --remediate --profile usgcb-rhel6-server_tailored --tailoring-file /root/usgcb_tailored.xml --oval-results --report /tmp/out ssg-rhel6-xccdf.xml
Title Disable Kernel Parameter for Sending ICMP Redirects by Default
Rule sysctl_net_ipv4_conf_default_send_redirects
Ident CCE-27001-7
Result fail

--- Starting Remediation ---
Title Disable Kernel Parameter for Sending ICMP Redirects by Default
Rule sysctl_net_ipv4_conf_default_send_redirects
Ident CCE-27001-7
Result error
```

Having openscap patched to be more verbose while trying the particular remediation (to see what's the reason for that error) retrieved the following:
```
# oscap xccdf eval --remediate --profile usgcb-rhel6-server_tailored --tailoring-file /root/usgcb_tailored.xml --oval-results --report /tmp/out ssg-rhel6-xccdf.xml
Title Disable Kernel Parameter for Sending ICMP Redirects by Default
Rule sysctl_net_ipv4_conf_default_send_redirects
Ident CCE-27001-7
Result fail

--- Starting Remediation ---
stdout_buf contains = /tmp/oscap.U86b04/fix-XXNuA7w2: line 4: sysctl: command not found

Title Disable Kernel Parameter for Sending ICMP Redirects by Default
Rule sysctl_net_ipv4_conf_default_send_redirects
Ident CCE-27001-7
Result error
```

As can be seen above oscap wasn't able to find the ```sysctl``` executable required by the remediation script:
[1] https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/fixes/bash/sysctl_net_ipv4_conf_default_send_redirects.sh#L4

so the runtime part of the remediation script wasn't executed => oscap after performing remediation & when checking again if the feature was corrected realized it wasn't corrected => returned error.

Strange thing is this happens only for some sysctl rules.

Therefore to prevent this behaviour from happening in the future modify RHEL-6 sysctl* remediation fixes to start using full path (prefix) to the ```sysctl``` executable, so it's ensured the child oscap remediate process always finds it (& performs also the runtime part of the remediation fix).

Note: If some of the sysctl_* remediation fixes is intended to be applied also for RHEL-7 product in the future, this should work there too, since there /sbin is just symlink to /usr/sbin (but the ```sysctl``` executable is at the same path).

Patch has been tested on RHEL-6 & works fine (remediation error doesn't occur anymore).

Please review.

Thank you, Jan.