OpenSCAP/scap-security-guide — pull request #342 by iankko (2014-11-30 11:02:22+00:00)
Title: [BugFix] [Enhancement] [RHEL/6, RHEL/7] Fix OVAL check & add remediation for ensure_redhat_gpgkey_installed_rule

The bugfix part of this PR:
---------------------------------
The current version of OVAL check for ensure_redhat_gpgkey_installed rule contains 'any_exist' in the two (sub)tests. But 'any_exist' means the corresponding (sub)test will pass when zero or more objects of the desired feature exist on the system:

https://oval.mitre.org/language/version5.6/ovalresults/documentation/oval-common-schema.html#ExistenceEnumeration

Subsequently this means the current check will pass also in case the relevant required key isn't installed / imported on the system. Therefore change the ```check_existence``` value to ```at_least_one_exists``` in both subtests to ensure the following ```AND``` will pass only in case both of the required keys are installed.

Also update test attestation for both of RHEL-6 & RHEL-7 (& do some other cosmetic changes - like replace tabs for spaces the beginning whitespace to be uniform across the check).

The enhancement part of this PR:
-------------------------------------------
Adds remediation script for ensure_redhat_gpgkey_installed rule for both RHEL-6 & RHEL-7. The remediation script is allowed to fail (IOW is a bit different from other remediation scripts) in the case the integrity of the GPG key to be imported was altered (since we obviously don't want to import MiTM attacker modified key).

Thus the remediation script performs the following sanity checks:
* check if the permissions of /etc/pki/rpm-gpg directory are 0755 or stronger (this check by itself isn't sufficient since perms could be minute ago more permissive & it was possible to change the key),
* if they are, verify the CRC checksum of the key file with gpg. If there is an CRC error, the key was probably modified => do nothing in that case. Otherwise (no CRC error), obtain GPG fingerprints from the key file,
* if directory perms are safe, there wasn't a CRC error & GPG fingerprints from the key file matches those listed at:

https://access.redhat.com/security/team/key

then we accept the key file & import it.

Testing report:
------------------
Proposed change has been tested on both of RHEL/6 & RHEL/7 & works fine (as expected).

Please review.

Thank you, Jan.