file_ownerships_var_log: handle systems without a syslog user

[israel-villar]

Description:

• Split the OVAL criteria of file_ownerships_var_log into two branches:
  • a dedicated syslog user exists → require owner root or syslog (unchanged behaviour);
  • no syslog user → require owner root only.
• The syslog uid local_variable is now only referenced in the branch where it is guaranteed to have a value. Definition version bumped to 2.

Rationale:

• On systems that use syslog-ng instead of rsyslog there is no dedicated syslog user, so the local_variable that reads its uid from /etc/passwd has no value.
• An OVAL state that references a variable with no values evaluates to error. As a result, on such a system any non-root-owned file under /var/log made the whole rule report error instead of a meaningful pass/fail.

Review Hints:

• OVAL-only change in file_ownerships_var_log/oval/shared.xml.
• ./build_product debian13 rhel9 ubuntu2404 sle15 --datastream, ctest and OVAL schema validation pass.
• Verified on a Debian 13 + syslog-ng host: the rule changes from error to a real fail/pass.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_file_ownerships_var_log' differs.
--- oval:ssg-file_ownerships_var_log:def:1
+++ oval:ssg-file_ownerships_var_log:def:1
@@ -1,2 +1,7 @@
+criteria OR
 criteria AND
+criterion oval:ssg-file_ownerships_var_log_test_syslog_user_present:tst:1
 criterion oval:ssg-test_file_ownership_var_log:tst:1
+criteria AND
+criterion oval:ssg-file_ownerships_var_log_test_syslog_user_absent:tst:1
+criterion oval:ssg-file_ownerships_var_log_test_file_ownership_var_log_root_only:tst:1

New data stream adds bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownerships_var_log'.

[jan-cerny]

Can you add a tests scenario covering the new no-syslog situation?

[israel-villar]

Added the test scenarios for the no-syslog-user case. Testing them also surfaced a bug in the bash remediation (it broke when there's no syslog user) and showed the remediation could apply to Debian too, so I fixed both.