Ensure That the GIDs Are Unique

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130387");
  script_version("2025-11-21T05:40:28+0000");
  script_tag(name:"last_modification", value:"2025-11-21 05:40:28 +0000 (Fri, 21 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:45:55 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Ensure That the GIDs Are Unique");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler_hce");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.1 Users: 2.1.10 Ensure That the GIDs Are Unique (Requirement)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.1 Users: 2.1.10 Ensure That the GIDs Are Unique (Requirement)");
  script_xref(name:"Policy", value:"HCE Linux (Huawei Cloud EulerOS): openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.1 Users: 2.1.10 Ensure That the GIDs Are Unique (Requirement)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 2. Secure Access: 2.1 Users: 2.1.10 Ensure That the GIDs Are Unique (Requirement)");

  script_tag(name:"summary", value:"The group IDs (GIDs) in /etc/group must be unique. In the Linux
system, user group permissions are determined based on GIDs. If multiple user groups use the same
GID, these user groups have the same permissions and can access each other's directories, leading
to unauthorized operations and information leakage.

If the administrator runs commands such as useradd or groupadd to add users or user groups,
duplicate GIDs typically do not exist. However, if the administrator directly modifies the
/etc/group file due to misoperations, faults may occur.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Ensure That the GIDs Are Unique";

solution = "Analyze the cause why a GID is repeatedly used, and then delete the user group where
the problem occurs. (Note: Before rectifying the fault, delete the users who belong to the user
group based on the actual scenario.)

# groupdel test1";

check_type = "SSH_Cmd";

action = 'Run the command in the terminal:
# cat /etc/group | grep -vE "^\\s*#" | awk -F ":" \'{a[\\$3]++}END{for(i in a){if(a[i]!=1){print i, a[i]}}}\'';

expected_value = 'The output should be empty';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

# ------------------------------------------------------------------
# CHECK : Verify command cat /etc/group | grep -vE "^\s*#" | awk -F ":" '{a[\$3]++}END{for(i in a){if(a[i]!=1){print i, a[i]}}}'
# ------------------------------------------------------------------

step_cmd = 'cat /etc/group | grep -vE "^\\s*#" | awk -F ":" \'{a[\\$3]++}END{for(i in a){if(a[i]!=1){print i, a[i]}}}\'';
actual_value = ssh_cmd(socket:sock, cmd:step_cmd, return_errors:TRUE, return_linux_errors_only:TRUE);

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the audit check. Please try again.";
}else if(!actual_value){
  compliant = "yes";
  comment = "Check passed";
}else{
  compliant = "no";
  comment = "Check failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);