CMP-4619: Fix-OpenSCAP rules for /etc/shadow return ERROR on RHCOS 10

[taimurhafeez]

Description:

• Two OVAL rules (no_empty_passwords_etc_shadow, no_legacy_plus_entries_etc_shadow) that check /etc/shadow return ERROR on RHCOS 10 because the textfilecontent54 probe cannot read the file — /etc/shadow has 0000 permissions on RHEL 10.
• This PR switches both rules from ind:textfilecontent54 (direct file I/O) to unix:shadow (C library shadow API via getspent()), which does not require direct file read access.
• This pattern is already used by other shadow rules in this repo (no_password_auth_for_systemaccounts, accounts_password_all_shadowed_sha512, accounts_password_last_change_is_in_past).
• Backwards compatible — unix:shadow probe is available on all supported platforms (RHEL 8/9/10).

Rationale:

• On RHEL 10 / RHCOS 10, /etc/shadow has 0000 permissions. The OpenSCAP textfilecontent54 probe opens the file directly and fails with "No space left on device" when it cannot access it, returning ERROR instead of evaluating the rule.
• The unix:shadow probe reads shadow entries through the getspent() C library API, bypassing file permissions entirely. It is the correct way to access shadow data and is already used by other rules in the same profile.
• Fixes CMP-4619

Review Hints:

Verified on OCP 5.0.0-0.nightly-2026-08-21-033959 (RHCOS 10.2, 3 masters + 3 workers) with CO 1.9.2.

To verify manually on a node: oc debug node/<name> -- chroot /host bash -c 'awk -F: "!length(\$2) {print \$1}" /etc/shadow && grep "^\+" /etc/shadow' — empty output confirms compliance.

Co-authored with Claude

[Mab879]

These rules are shared by RHEL and I'm getting Automatus failures so we need investigate that before merging.

[yuumasato]

@Mab879 Where do you see the failures?

[yuumasato]

@taimurhafeez OCP 4.22 has RHCOS 9 and it has the same permissions as RHCOS 10 and the rule works:

$ oc debug node/ip-10-0-109-187.ec2.internal
Temporary namespace openshift-debug-h97zp is created for debugging node...
Starting pod/ip-10-0-109-187ec2internal-debug-5sn4g ...
To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`.
Pod IP: 10.0.109.187
If you don't see a command prompt, try pressing enter.
sh-5.1# chroot /host
sh-5.1# ls -lh /etc/shadow
----------. 1 root root 873 Aug 25 21:58 /etc/shadow
sh-5.1#
sh-5.1# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.8 (Plow)
sh-5.1#
sh-5.1#

Tried with CO 1.9.2 content, and your PR:

oc get ccr | grep empty-
rhcos4-moderate-master-no-empty-passwords                                                                    FAIL     high
rhcos4-moderate-worker-no-empty-passwords                                                                    FAIL     high
upstream-rhcos4-moderate-master-no-empty-passwords                                                           FAIL     high
upstream-rhcos4-moderate-worker-no-empty-passwords                                                           FAIL     high

[taimurhafeez]

/test e2e-aws-openshift-platform-compliance

[Mab879]

@Mab879 Where do you see the failures?

On locally ran Automatus tests.

[openshift-ci]

@taimurhafeez: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	4887de6	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[yuumasato]

@taimurhafeez OCP 4.22 has RHCOS 9 and it has the same permissions as RHCOS 10 and the rule works:

Sorry, I was testing the wrong rules.

oc get ccr
NAME                                                                       STATUS   SEVERITY
tp-shadow-rules-master-accounts-password-last-change-is-in-past            PASS     medium
tp-shadow-rules-master-accounts-password-set-max-life-root                 FAIL     medium
tp-shadow-rules-master-no-empty-passwords                                  PASS     high
tp-shadow-rules-master-no-empty-passwords-etc-shadow                       ERROR    high
tp-shadow-rules-master-no-legacy-plus-entries-etc-shadow                   ERROR    medium
tp-shadow-rules-worker-accounts-password-last-change-is-in-past            PASS     medium
tp-shadow-rules-worker-accounts-password-set-max-life-root                 FAIL     medium
tp-shadow-rules-worker-no-empty-passwords                                  PASS     high
tp-shadow-rules-worker-no-empty-passwords-etc-shadow                       ERROR    high
tp-shadow-rules-worker-no-legacy-plus-entries-etc-shadow                   ERROR    medium
tp-upstream-shadow-rules-master-accounts-password-last-change-is-in-past   PASS     medium
tp-upstream-shadow-rules-master-accounts-password-set-max-life-root        FAIL     medium
tp-upstream-shadow-rules-master-no-empty-passwords                         PASS     high
tp-upstream-shadow-rules-master-no-empty-passwords-etc-shadow              PASS     high
tp-upstream-shadow-rules-master-no-legacy-plus-entries-etc-shadow          PASS     medium
tp-upstream-shadow-rules-worker-accounts-password-last-change-is-in-past   PASS     medium
tp-upstream-shadow-rules-worker-accounts-password-set-max-life-root        FAIL     medium
tp-upstream-shadow-rules-worker-no-empty-passwords                         PASS     high
tp-upstream-shadow-rules-worker-no-empty-passwords-etc-shadow              PASS     high
tp-upstream-shadow-rules-worker-no-legacy-plus-entries-etc-shadow          PASS     medium

The fix works for RHCOS 10.

The error I saw is no longer happening, dismissing my review.