June 2013 - scap-security-guide - Fedora mailing-lists

scap-security-guide v0.1-12 released
by Shawn Wells 24 Oct '13

24 Oct '13

On 2-MAY the SSG v0.1-11 update was released, reflecting the inclusion of DISA FSO feedback on the (then) Draft RHEL6 STIG and several OVAL improvements. It was a huge milestone, driving us over 1,800 unique code commits! We've since had an additional 88 commits, largely around OVAL content cleanup and the rewrite of combinefixes.py to handle parameters for OpenSCAP remediation generation (thanks, Jeff!). User feedback also prompted us to fix the build system when compiling on Fedora 18+ and the upcoming RHEL release. SSG v0.1-12 has been released to the EPEL repository to reflect these recent bugfixes and enhancements. Download instructions available on the wiki: https://fedorahosted.org/scap-security-guide/wiki/downloads CHANGELOG: > $ git log --oneline --after={2013-05-02} --no-merges > fe2a0b6 Some corrections to the PAM cracklib guidance as follows: > corrected pam_cracklib.so line to include all discussed parame > 532aeb8 Modified the DoD banner check to accept either a newline or > space between each word, as the RHEL5 version does. This al > ded2ef4 Created remediation template: create_services_disabled.py - > Based off OVAL services file > a96cdc3 Added sysctl remediation scripts - Updated template to reflect > proper naming of sysctl scripts > c3355eb Added bash templates directory, added sample sysctl script - > Makefile based off OVAL, same usage - CVS files point to > f75ad8d Module is freevxfs, not freevsfs > cd940ef Fix build of OpenStack and RHEVM3 parts on Fedora 18+ > df19413 Fix build on Fedora 18+ and the upcoming RHEL release > 2ddbbb7 Subexpression datatype shall equal to the variable datatype > 4cd7650 Ok, to fix the "error" doing an evaluation for the various > umask checks, changed the following variables referenced in t > 5fa190d changed a typo var_acocunts_umask_bashrc => > var_accounts_umask_bashrc > 7d772db Update from deprecated rpmverify_* to rpmverifyfile_* checks > 2026606 made xccdf-addfixes insert all text and child nodes of a fix > d6703f4 rewrite of combinefixes.py to handle parameters for OpenSCAP > remedation generation > c13fafa incomplete support file for bash remediations * does at least > warn when undefined variable exists > f87d817 example remediation script which takes a parameter > 24f2c2e Removing deprecated recurse="files" behavior > f078b8f Removing deprecated recurse=files behavior. > b12d669 Replacing deprecated <ind:environmentvariable_...> tags with > <ind:environmentvariable58_...> tags > 5ed6dc2 Created OVAL for ensure_gpgcheck_never_disabled XCCDF rule > called nonexisting OVAL, created it. > 0d69487 Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 295184c Adding check for no_netrc_files > e1aede3 Adding check for pam_lastlog.so > 9c21556 additional copy editing > 3fd9f3f copy editing > 9db6e3d Renaming oval check no_rsh_trusted_host_files to > no_rsh_trust_files to match rule ID > 4109078 Adding check for no_netrc_files > 6f31c05 Adding check for pam_lastlog.so > 0e15e2d Adding check for disabling GNOME thumbnailers in gconf > d10f08e modified makefile to remove test attestation from prose guide > -- revised > 4f3ea5f corrections for typos in OVAL references > d50c71b removal of references to nonexistent OVAL for some NFS guidance > 980f686 refine verify-references to deal only with OVAL compliance > checks for OVAL > 6051ea6 removal of comments, reference to nonexistent OVAL > 8251580 removal or correction of misnamed or obsolete OVAL checks > 76e93ef removal of packages from check templates > 69f31e0 Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some m > c22ed9c Added backslash escapes to the warning texts to fix the RegEx, > replaced line breaks with newlines, and added some more f > c58ac2b Fixing indenting for external variable line. > 95d5a4b removal of unused OVAL checks > bcc1495 bugfixes for undisciplined renaming jaunt, missing OVAL references > 9a378b9 removal of unused OVAL checks > 3b82cf5 deletion of unused OVAL checks > 6a89088 removal of commented text, some redundant/unnecessary Rules > from Profiles > 9705192 deletion of unused/obsoleted OVAL checks (and commented out XCCDF) > 36a75ec deletion of unused OVAL checks > 48e9900 removal of unnecessary guidance from SSL section > 7682f9c removal of commented/obsolete text from logging section > a1f2d30 removal of commented text, invalid CCE from root logins guidance > 0a3577b update to NFS section (still perhaps incomplete) > 1a3d854 changed Dovecot Rule to Group as it is guidance and not a > compliance check > fb4a29b removal of commented/obsolete items for base services > 9a228d5 updates to the CCE verification script to be more informative > ff25fc9 cleanup of comments, unnecessary Rules in DNS (bind) service > 7a16cda Deleting duplicate check for disabling IPv6 > d9d1741 Minor typo, removing slash at end of description > 330258c added version info for RHEL, URL for project > f36ecf3 removed some now-obsolete advice from samba > 8d5ee52 added some clarifying text to the intro > 6c9f047 removing some unnecessary (for compliance-focus) text from cups > de705e9 Updated service_tftpd_disabled As reflected from update to > template file > 356405f Removed duplicate references to var_samba_private_directory > Updated OVAL to have unique IDs > 034b8b3 Removed duplicate references object_etc_skel_files Updated > OVAL to have unique names > d609d6b Removed duplicate var_ssh_config_directory references Updated > OVAL to have unique names > 8a7a3f3 Removed duplicate state_uid_root Updated OVAL to have unique names > e421d69 Modified template_OVAL_package_installed and > template_package_removed These files were causing build errors > regarding ob > 1ae4c30 Removed duplicate references to var_accounts_user_umask > Assigned unique identifiers > ea10f13 Removed duplicate references to object_lib_modules_files > Assigned unique identifiers > 882e341 Removed duplicate object_usr_lib64_files references Assigned > unique identifiers within OVAL > 9d89e61 Removed duplicate object_usr_lib64_dir references Assigned > unique identifiers in OVAL > 863aa19 Removed duplicate object_usr_lib_files references Assigned > unique identifiers to OVAL checks > 714c3c1 Removed duplicate object_usr_lib_dir Updated OVAL to have > unique names > dffd29b Removed duplicates of object_lib64_files Updated OVAL to have > unique names > bc6fbcd Removed duplicate object_lib64_dir Updated OVAL checks to have > unique names > fe089dc Removed duplicate object_lib_files Updated OVAL checks for > unique names > 7546f2e Removed duplicate object_lib_dir references Created unique > names in the OVAL templates > b376e27 Updated mount_option_* OVAL variable var_removable_partition > These OVAL files were using duplicate 'var_remove_partition > 7fae707 Updated template_permissions to place FILEID into strings > e31dc7b Updated state_gid_0 to reflect per check naming > 07380c0 Updated state_uid_0 names within OVAL Multiple OVAL checks > were using "state_uid_0" causing build errors. Updated so eve > f5b90ce Updated rpm_verify_hashes for OVAL 5.10 compliance The old > rpmverify_* is now depricated, updated check to rpmverifyfile > e3b5697 modified transform to only match test attestation > 02a19e2 transform designed to remove the 'tested by' information > a330ccf deleting files for imprecise and obsolete OVAL checks, manual > remediation > ca71cde simplification of Postfix service configuration > 14397cd Removing a newline to fix XHTML formatting > 7d1ab28 deletion of manual audit profile, OVAL for obsolete ldap > server checks > d7f3ca4 removed obsolete LDAP guidance, checks

1 1

intermittent failure of oval check, how to debug?
by Brian Millett 21 Aug '13

21 Aug '13

Ok, how do I go about debugging this: [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitshof67c.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsLT_H5A.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bits6eM3gu.xml OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:583] [root@deckard scap]# ./testcheck.py dir_perms_world_writable_sticky_bits.xml Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_sticky_bitsIWHsj4.xml Definition oval:scap-security-guide.testing:def:100: false The dir_perms_world_writable_sticky_bits test on ONE rhel6 machine is failing, but sometimes it does not. When I run an evaluation with the stig-rhel policy, I get OpenSCAP Error: Unable to receive a message from probe [oval_probe_ext.c:584] No definition with ID: oval:ssg:def:509 in result model. [oval_agent.c:182] -- Brian Millett "We are not through with the Centauri yet." -- [ G'Kar (to Jha'dur), "Deathwalker"]

3 5

Question about RHEL-06-000185
by Trevor Vaughan 11 Jul '13

11 Jul '13

All, I've been running in compliance with this rule for quite some time now and I'm noticing that the amount of noise that it produces is simply outrageous. The suggestion is: At a minimum the audit system should collect file permission changes for all users and root. Add the following to "/etc/audit/audit.rules": -a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 \ -k perm_mod If the system is 64 bit then also add the following: -a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 \ -k perm_mod And here is the output of a normal workstation over about a week of auditing and normal usage: Syscall Summary Report ========================== total syscall ========================== 24907 chmod 15870 chown 11169 rename 7409 open 6462 fchmod 5290 fchown 3687 umount2 1443 setsid 1166 fsetxattr 869 removexattr 456 adjtimex 360 fchmodat 337 lchown 211 setuid 69 mkdir 63 setsockopt 33 unlink 22 setxattr 20 clone 19 execve 7 fchownat 7 mount 7 creat 4 close 4 ioctl 3 symlink 2 mknod 1 rmdir 1 lsetxattr 1 clock_settime 1 capset So, I get why this can be useful. But I'm not so sure that it's useful to know that Pidgin dropped a new temp file every few minutes or that, each time I open a file (and write a temp file), that I did this as a normal user. I just can't see the practicality of going through those top three calls on a regular basis. I'm not necessarily suggesting that this type of thing be dropped but I'd like to understand how auditors won't fall into just ignoring them completely. Thoughts? Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information --

3 5

note for the USGCB tickets
by Jeffrey Blank 11 Jul '13

11 Jul '13

Shawn (et al), The ticketing system shows me you'd opened up a bunch of tickets to add a "New rule" for items which were in the old RHEL 5 USGCB profile. Okay, great, this helps with ensuring there is continuation of that profile/baseline with some consistency. A few notes: 1) I've been able to close some of the tickets as "fixed", providing explanation as to why. Some of them are being handled through other mechanisms for RHEL 6. 2) If anybody starts executing on the other tickets, the goal is NOT to add new rules as the ticket says, but rather to conduct investigation to see if the Rule is applicable to RHEL 6 in the same way it was applicable to RHEL 5. 3) In the ticket titles, there is some of the odd CCE language which talks about disabling/enabling things "as appropriate". That's fine as an identifier (and the RHEL 6 USGCB did use some of this language). However, this style of language, which is intended for neither a human nor a machine, should never appear in the project's XCCDF. (Just in case anybody gets any ideas.) Thanks, Jeff -- ___________________________ Jeffrey Blank 410-854-8675 Technology and Systems Analysis / Network Components NSA Information Assurance

5 10

Suggestion for RHEL-06-000198
by Trevor Vaughan 11 Jul '13

11 Jul '13

All, Currently the remediation text for RHEL-06-000198 reads as: At a minimum the audit system should collect the execution of privileged commands for all users and root. To find the relevant setuid programs: # find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null Then, for each setuid program on the system, add a line of the following form to "/etc/audit/audit.rules", where [SETUID_PROG_PATH] is the full path to each setuid program in the list: -a always,exit -F path=[SETUID_PROG_PATH] -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged I would like to suggest that this be changed to Add the following to audit.rules: -a always,exit -F arch=b64 -F euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F arch=b64 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec -a always,exit -F arch=b32 -F euid=0 -F uid!=0 -S execve -k suid-root-exec -a always,exit -F arch=b32 -F egid=0 -F gid!=0 -S execve -k sgid-root-exec >From my testing, this appears to catch the execution of all suid/sgit binaries without digging all over the system to figure out what they are. As an added bonus, you get to find out about binaries that pop onto your system for a brief period. Thanks, Trevor -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 tvaughan(a)onyxpoint.com -- This account not approved for unencrypted proprietary information --

4 5

BUMP [PATCH] a check and fix for pam_cracklib.so minclass=X
by Brian Millett 02 Jul '13

02 Jul '13

Currently, there is not a check to see for pam_cracklib.so minclass in /etc/pam.d/system-auth. This is a check and a fix for testing a password algorithm of minclass for cracklib in /etc/pam.d/system-auth (IE) pam_cracklib.so minclass=3 Brian Millett (1): A check and fix for minclass password checking option .../accounts_password_minclass_login_defs.xml | 43 ++++++++++++++++++++++ .../fixes/bash/password_require_minimun_class.sh | 6 +++ 2 files changed, 49 insertions(+) create mode 100644 RHEL6/input/checks/accounts_password_minclass_login_defs.xml create mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh -- 1.8.2.1

3 4

[PATCH 0/2] checks for faillock.sh accounts passwords
by Brian Millett 28 Jun '13

28 Jun '13

Added the checks for faillock unlock_tine and fail_interval as there was only the check for faillock deny. small change for the comment dealing with faillock deny default NOT being 5, but 3 Fixed (in my mind) a typo in RHEL6/input/system/accounts/pam.xml where the oval id for rule deny_password_attempts_fail_interval from accounts_passwords_pam_fail_interval to accounts_passwords_pam_faillock_fail_interval. This matches the oval id's for accounts_passwords_pam_faillock_deny and accounts_passwords_pam_faillock_unlock_time Brian Millett (2): Added the checks for accounts_passwords_pam_fail_interval and accounts_passwords_pam_faillock_unlock_time as there was only the check for accounts_passwords_pam_faillock_deny Fixed the oval id from accounts_passwords_pam_fail_interval to accounts_passwords_pam_faillock_fail_interval to be consistant. .../accounts_passwords_pam_fail_interval.xml | 49 ++++++++++++++++++++++ .../accounts_passwords_pam_faillock_deny.xml | 4 +- ...accounts_passwords_pam_faillock_unlock_time.xml | 49 ++++++++++++++++++++++ RHEL6/input/system/accounts/pam.xml | 2 +- 4 files changed, 101 insertions(+), 3 deletions(-) create mode 100644 RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml create mode 100644 RHEL6/input/checks/accounts_passwords_pam_faillock_unlock_time.xml -- 1.8.2.1

1 2

iptables
by Peter Vrabec 25 Jun '13

25 Jun '13

Hi list, I have seen "iptables and ip6tables" section of rhel6-guide.html recently and I have concerns about few recommendation. example: "Set Default iptables Policy for Incoming Packets" ---- To set the default policy to DROP (instead of ACCEPT) for the built-in INPUT chain which processes incoming packets, add or correct the following line in /etc/sysconfig/iptables: :INPUT DROP [0:0] In iptables the default policy is applied only after all the applicable rules in the table are examined for a match. Setting the default policy to DROP implements proper design for a firewall, i.e. any packets which are not explicitly permitted should not be accepted. --- This ^^^ is doable but it won't have any real effect since the last rule of a built-in INPUT chain is REJECT. Default DROP policy won't be applied. 5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Please note I'm not a firewall expert, I just want to raise awareness. Maybe I miss some important fact. Peter.

2 1

[PATCH] Some corrections to the PAM cracklib guidance...
by Maura Dailey 24 Jun '13

24 Jun '13

In addition to the changes I made (outlined just below), I noticed that there is no rule for the minlen parameter for cracklib. Should I add a new rule, modeled on its neighbors? I'm open to wording corrections. I noticed that the latest draft STIG is also incorrect with regards to maxrepeat (it shares identical wording). - Maura Dailey Maura Dailey (1): Some corrections to the PAM cracklib guidance as follows: corrected pam_cracklib.so line to include all discussed parameters and edited them to contain plausible values (ucredit was set to 0 for some reason), corrected maxrepeat description to match other rules (it incorrectly suggested that a brand new line be inserted, and also gave an incorrect line insertion location as it referred to lines that do not exist by default), and I added a suggestion to add cracklib line if one does not exist RHEL6/input/system/accounts/pam.xml | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-)

2 3

The OSCAP Anaconda addon project announcement
by Vratislav Podzimek 20 Jun '13

20 Jun '13

Hello everybody, I'd like to announce the start of the OSCAP Anaconda addon project. What has started as a part of my masters thesis will from now on be a standalone project. There is a Trac instance for the project [1] where bugs and RFEs can be filed, a Git repository [2] with the sources and a mailing list [3] where the discussions shall take place. For now, there is no official package, but that is expected to change for Fedora 20. [1] https://fedorahosted.org/oscap-anaconda-addon/wiki/WikiStart [2] https://git.fedorahosted.org/cgit/oscap-anaconda-addon.git [3] https://lists.fedorahosted.org/mailman/listinfo/oscap-anaconda-addon There has been practically no development since the last video preview I've recorded and published as I am preparing for my final exams (Mon Jun 24), but starting with the next week the progress will start again. -- Vratislav Podzimek Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic

1 0

[PATCH] DoD banner check (UNCLASSIFIED)
by Shaw, Ray V CTR USARMY RDECOM ARL (US) 14 Jun '13

14 Jun '13

Classification: UNCLASSIFIED Caveats: NONE Attached is a patch that modifies the DoD banner check to allow more whitespace flexibility (the intention is to allow newlines instead of spaces). The RHEL5 OVAL content does effectively the same thing, though it's written differently. This allows reasonable formatting of the text for 80-column displays (or GDM banners) so that mid-word wrapping does not occur. Also note that the RHEL5 STIG specifies: ..."USG interests- -not for your"... while the RHEL6 STIG specifies: ..."USG interests -- not for your"... So this may need further modification if the first one is correct; could we get clarification on that? [This very thing just came up during an inspection recently; they like it to be exactly right. I strongly suspect that the banner is supposed to be the same for both.] --Ray Classification: UNCLASSIFIED Caveats: NONE

2 1

Anyone at Summit?
by Shawn Wells 11 Jun '13

11 Jun '13

Anyone at Summit this week? Thought I'd ping the list and see if anyone wanted to meetup for drinks or dinner one of these nights. There's a session on Wednesday night where we'll be chatting through security and compliance, but thought an informal get together would be good too.

4 4

[PATCH] a check and fix for pam_cracklib.so minclass=X
by Brian Millett 10 Jun '13

10 Jun '13

A check and a fix for testing a password algorithm of minclass for cracklib in /etc/pam.d/system-auth pam_cracklib.so minclass=3 Brian Millett (1): A check and fix for minclass password checking option .../accounts_password_minclass_login_defs.xml | 43 ++++++++++++++++++++++ .../fixes/bash/password_require_minimun_class.sh | 6 +++ 2 files changed, 49 insertions(+) create mode 100644 RHEL6/input/checks/accounts_password_minclass_login_defs.xml create mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh -- 1.8.2.1

1 1

[PATCH] fix the accounts_umask_* checks to reference var_accounts_user_umask.
by Brian Millett 10 Jun '13

10 Jun '13

accounts_umask_* checks are referencing the wrong variables. Brian Millett (1): RHEL6/input/system/accounts/session.xml only references the variable "var_accounts_user_umask" so the checkes defined in RHEL6/input/checks/accounts_umask* error doing an evaluation. This patch is to have the RHEL6/input/checks/accounts_umask* reference the same variable referenced in RHEL6/input/system/accounts/session.xml RHEL6/input/checks/accounts_umask_bashrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_cshrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_etc_profile.xml | 4 ++-- RHEL6/input/checks/accounts_umask_login_defs.xml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) -- 1.8.2.1

2 2

[PATCH] OVAL cleanup to address validation errors
by David Smith 10 Jun '13

10 Jun '13

--- .../input/checks/file_ownership_var_log_audit.xml | 2 -- .../checks/file_permissions_unauthorized_sgid.xml | 1 - .../checks/file_permissions_unauthorized_suid.xml | 1 - ...ile_permissions_unauthorized_world_writable.xml | 1 - 4 files changed, 0 insertions(+), 5 deletions(-) diff --git a/RHEL6/input/checks/file_ownership_var_log_audit.xml b/RHEL6/input/checks/file_ownership_var_log_audit.xml index a6e5c19..bfadd48 100644 --- a/RHEL6/input/checks/file_ownership_var_log_audit.xml +++ b/RHEL6/input/checks/file_ownership_var_log_audit.xml @@ -14,11 +14,9 @@ </definition> <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_ownership_var_log_audit_directories" version="1"> <unix:object object_ref="object_ownership_var_log_audit_directories" /> - <unix:state state_ref="state_owner_not_root_root_var_log_audit" /> </unix:file_test> <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="test_ownership_var_log_audit_files" version="1"> <unix:object object_ref="object_ownership_var_log_audit_files" /> - <unix:state state_ref="state_owner_not_root_root_var_log_audit" /> </unix:file_test> <unix:file_object comment="/var/log/audit directories" id="object_ownership_var_log_audit_directories" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml index 5f10e5d..098143b 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_sgid.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_sgid" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_sgid" /> - <unix:state state_ref="state_file_permissions_unauthorized_sgid" /> </unix:file_test> <unix:file_object comment="files with sgid set" id="object_file_permissions_unauthorized_sgid" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml index 14beff4..07bb09f 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_suid.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_suid.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="/etc/skel files mode 0644" id="test_file_permissions_unauthorized_suid" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_suid" /> - <unix:state state_ref="state_file_permissions_unauthorized_suid" /> </unix:file_test> <unix:file_object comment="files with suid set" id="object_file_permissions_unauthorized_suid" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> diff --git a/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml b/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml index 74b2336..599ad98 100644 --- a/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml +++ b/RHEL6/input/checks/file_permissions_unauthorized_world_writable.xml @@ -17,7 +17,6 @@  <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="test_file_permissions_unauthorized_world_write" version="1"> <unix:object object_ref="object_file_permissions_unauthorized_world_write" /> - <unix:state state_ref="state_file_permissions_unauthorized_world_write" /> </unix:file_test> <unix:file_object comment="world writable" id="object_file_permissions_unauthorized_world_write" version="1"> <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" /> -- 1.7.1

1 0

[PATCH 5/5] Updated selinux_all_devicefiles_labeled
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 4/5] Removed unreferenced OVAL rsyslog_files_exist_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 3/5] Mapped OVAL file_permissions_unauthorized_world_writable to XCCDF world_writeable_files
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 2/5] Removing unreferenced OVAL file_ssh_host_keys_public_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 1/5] Removing unreferenced file_ssh_host_keys_private_permissions.xml
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 0/5] Various OVAL cleanups
by Shawn Wells 09 Jun '13

09 Jun '13

1 0

[PATCH 3/4] Created remediation template
by Shawn Wells 08 Jun '13

08 Jun '13

3 5

[PATCH 4/4] Created service_*_disabled remediation scripts
by Shawn Wells 08 Jun '13

08 Jun '13

3 3

[PATCH] Module is freevxfs, not freevsfs
by Maura Dailey 07 Jun '13

07 Jun '13

Tiny typo fix. - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/system/permissions/mounting.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/RHEL6/input/system/permissions/mounting.xml b/RHEL6/input/system/permissions/mounting.xml index 6180b48..897d45f 100644 --- a/RHEL6/input/system/permissions/mounting.xml +++ b/RHEL6/input/system/permissions/mounting.xml @@ -168,7 +168,7 @@ local system should be disabled.</rationale> <Rule id="disable_module_freevxfs"> <title>Disable Mounting of <tt>freevxfs</tt></title> <description> -<module-disable-macro module="freevsfs" /> +<module-disable-macro module="freevxfs" /> This effectively prevents usage of this uncommon filesystem. </description> <rationale>Linux kernel modules which implement filesystems that are not needed by the -- 1.7.1

2 1

[PATCH] Fix build of OpenStack and RHEVM3 parts on Fedora 18+
by Šimon Lukašík 06 Jun '13

06 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> --- OpenStack/Makefile | 3 ++- OpenStack/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ OpenStack/transforms/shorthand2xccdf.xslt | 3 --- RHEVM3/Makefile | 3 ++- RHEVM3/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ RHEVM3/transforms/shorthand2xccdf.xslt | 3 --- 6 files changed, 34 insertions(+), 8 deletions(-) create mode 100644 OpenStack/transforms/add_xccdf_namespace.xslt create mode 100644 RHEVM3/transforms/add_xccdf_namespace.xslt diff --git a/OpenStack/Makefile b/OpenStack/Makefile index f1c49b2..69280a1 100644 --- a/OpenStack/Makefile +++ b/OpenStack/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/openstack-shorthand.xml $(OUT)/openstack-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-openstack-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/openstack-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-openstack-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-openstack-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-openstack-xccdf-prerefs.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-openstack-xccdf.xml xsltproc -stringparam profile "stig-openstack-server" -o $(OUT)/unlinked-openstack-xccdf.xml \ diff --git a/OpenStack/transforms/add_xccdf_namespace.xslt b/OpenStack/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/OpenStack/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/OpenStack/transforms/shorthand2xccdf.xslt b/OpenStack/transforms/shorthand2xccdf.xslt index c25323d..ef6be4b 100644 --- a/OpenStack/transforms/shorthand2xccdf.xslt +++ b/OpenStack/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> diff --git a/RHEVM3/Makefile b/RHEVM3/Makefile index c5d1c29..9f523ed 100644 --- a/RHEVM3/Makefile +++ b/RHEVM3/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/rhevm3-shorthand.xml $(OUT)/rhevm3-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhevm3-shorthand.xml + xsltproc -o $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-noprofiles-rhevm3-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-rhevm3-xccdf-prerefs.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-noprofiles-rhevm3-xccdf.xml xsltproc -stringparam profile "stig-rhevm3-server" -o $(OUT)/unlinked-rhevm3-xccdf.xml \ diff --git a/RHEVM3/transforms/add_xccdf_namespace.xslt b/RHEVM3/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/RHEVM3/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/RHEVM3/transforms/shorthand2xccdf.xslt b/RHEVM3/transforms/shorthand2xccdf.xslt index aa50713..54a0d68 100644 --- a/RHEVM3/transforms/shorthand2xccdf.xslt +++ b/RHEVM3/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> -- 1.8.2.1

2 1

[PATCH] Fix build on Fedora 18+ and the upcoming RHEL release
by Šimon Lukašík 06 Jun '13

06 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> Previously, the xccdf namespace has been added to the shorthand document by <xsl:attribute>. Newer libxml releases are more strict and do not allow attributes named "xmlns". Which is explicitly forbiden by XSLT specification. http://www.w3.org/TR/xslt#creating-attributes Addressing: xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error --- RHEL6/Makefile | 3 ++- RHEL6/transforms/add_xccdf_namespace.xslt | 15 +++++++++++++++ RHEL6/transforms/shorthand2xccdf.xslt | 3 --- 3 files changed, 17 insertions(+), 4 deletions(-) create mode 100644 RHEL6/transforms/add_xccdf_namespace.xslt diff --git a/RHEL6/Makefile b/RHEL6/Makefile index 9214ce9..d34b127 100644 --- a/RHEL6/Makefile +++ b/RHEL6/Makefile @@ -14,7 +14,8 @@ shorthand-guide: xmllint --format --output $(OUT)/rhel6-shorthand.xml $(OUT)/rhel6-shorthand.xml shorthand2xccdf: shorthand-guide - xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml + xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml $(TRANS)/shorthand2xccdf.xslt $(OUT)/rhel6-shorthand.xml + xsltproc -o $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml $(TRANS)/add_xccdf_namespace.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-shorthand.xml xsltproc -stringparam profile "allprofiles" -o $(OUT)/unlinked-unresolved-rhel6-xccdf.xml \ $(TRANS)/xccdf-addprofiles.xslt $(OUT)/unlinked-unresolved-noprofiles-rhel6-xccdf.xml oscap xccdf resolve -o $(OUT)/unlinked-rhel6-xccdf.xml $(OUT)/unlinked-unresolved-rhel6-xccdf.xml diff --git a/RHEL6/transforms/add_xccdf_namespace.xslt b/RHEL6/transforms/add_xccdf_namespace.xslt new file mode 100644 index 0000000..3acd511 --- /dev/null +++ b/RHEL6/transforms/add_xccdf_namespace.xslt @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +  + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + + <xsl:template match="*[namespace-uri()='']"> + <xsl:element name="{local-name()}" namespace="http://checklists.nist.gov/xccdf/1.1"> + <xsl:apply-templates select="node()|@*" /> + </xsl:element> + </xsl:template> +</xsl:stylesheet> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt index 1a849e2..39f6741 100644 --- a/RHEL6/transforms/shorthand2xccdf.xslt +++ b/RHEL6/transforms/shorthand2xccdf.xslt @@ -16,9 +16,6 @@ exclude-result-prefixes="xccdf xhtml dc">  <xsl:template match="Benchmark"> <xsl:copy> - <xsl:attribute name="xmlns"> - <xsl:text>http://checklists.nist.gov/xccdf/1.1</xsl:text> - </xsl:attribute> <xsl:apply-templates select="@*|node()" /> </xsl:copy> </xsl:template> -- 1.8.2.1

2 1

[PATCH] Subexpression datatype shall equal to the variable datatype
by Šimon Lukašík 06 Jun '13

06 Jun '13

From: Simon Lukasik <slukasik(a)redhat.com> Default datatype is string. Addressing: $ make validate oval:ssg:var:2115 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2117 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2122 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2126 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2127 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2130 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2135 - inconsistent datatype between the variable and an associated var_ref oval:ssg:var:2139 - inconsistent datatype between the variable and an associated var_ref --- RHEL6/input/checks/accounts_disable_post_pw_expiration.xml | 2 +- RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml | 2 +- RHEL6/input/checks/accounts_maximum_age_login_defs.xml | 2 +- RHEL6/input/checks/accounts_minimum_age_login_defs.xml | 2 +- RHEL6/input/checks/accounts_password_minlen_login_defs.xml | 2 +- RHEL6/input/checks/accounts_password_warn_age_login_defs.xml | 2 +- RHEL6/input/checks/auditd_data_retention_max_log_file.xml | 2 +- RHEL6/input/checks/auditd_data_retention_num_logs.xml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml index b93ee63..429e9db 100644 --- a/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml +++ b/RHEL6/input/checks/accounts_disable_post_pw_expiration.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_default_useradd_inactive" version="1"> - <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" /> + <ind:subexpression operation="less than or equal" var_ref="var_account_disable_post_pw_expiration" datatype="int" /> </ind:textfilecontent54_state> <ind:textfilecontent54_state id="state_etc_default_useradd_inactive_nonnegative" version="1"> diff --git a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml index 53a9d13..eda8052 100644 --- a/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml +++ b/RHEL6/input/checks/accounts_max_concurrent_login_sessions.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_maxlogins" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" /> + <ind:subexpression operation="greater than or equal" var_ref="max_concurrent_login_sessions_value" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="maximum password age" datatype="int" id="max_concurrent_login_sessions_value" version="1" /> diff --git a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml index 0640a3e..090435a 100644 --- a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_password_max_age" version="1"> - <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" /> + <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="maximum password age" datatype="int" id="var_password_max_age" version="1" /> diff --git a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml index 21b02af..6de9779 100644 --- a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="minimum password age in days" datatype="int" id="var_password_min_age" version="1" /> diff --git a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml index 76d2132..4dd66c8 100644 --- a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml +++ b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml @@ -37,7 +37,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_password_min_len" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="password minimum length" datatype="int" id="var_password_min_len" version="1" /> diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml index ed4fb8f..7c153e7 100644 --- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml @@ -27,7 +27,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" /> + <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="password expiration warning age in days" datatype="int" id="var_password_warn_age" version="1" /> diff --git a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml index b8aba36..7087e7a 100644 --- a/RHEL6/input/checks/auditd_data_retention_max_log_file.xml +++ b/RHEL6/input/checks/auditd_data_retention_max_log_file.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" /> + <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="audit max_log_file settting" datatype="int" id="var_auditd_max_log_file" version="1" /> diff --git a/RHEL6/input/checks/auditd_data_retention_num_logs.xml b/RHEL6/input/checks/auditd_data_retention_num_logs.xml index ad2fc7e..b46e734 100644 --- a/RHEL6/input/checks/auditd_data_retention_num_logs.xml +++ b/RHEL6/input/checks/auditd_data_retention_num_logs.xml @@ -26,7 +26,7 @@ </ind:textfilecontent54_object> <ind:textfilecontent54_state id="state_auditd_data_retention_num_logs" version="1"> - <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" /> + <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" datatype="int" /> </ind:textfilecontent54_state> <external_variable comment="audit num_logs settting" datatype="int" id="var_auditd_num_logs" version="1" /> -- 1.8.2.1

2 1

[PATCH 0/4] support for insertion of parameters to support OpenSCAP remediation
by Jeffrey Blank 05 Jun '13

05 Jun '13

This is a step along the path toward support for remediation content development, but it is only one step. This patchset also cleans up some other code. It has not been tested, but it appears to emit "<sub>" elements in the manner OpenSCAP can process, so that parameters can be provided to remediation scripts. Documentation/instructions are still needed. It should be apparent from the example that scripts which use parameters will need to "source" a support file and also declare which environment variables they expect to have populated by XCCDF values (using the "populate" function). This patch is only to enable example remediation content, which may be suitable for testing. The SSG project/community will be ready for remediation content en masse when there is evidence of sufficient interest in the checking mechanisms, upon which any remediation effort would naturally depend. Jeffrey Blank (4): example remediation script which takes a parameter incomplete support file for bash remediations * does at least warn when undefined variable exists rewrite of combinefixes.py to handle parameters for OpenSCAP remedation generation made xccdf-addfixes insert all text and child nodes of a fix RHEL6/input/fixes/bash/set_system_login_banner.sh | 6 ++ RHEL6/input/fixes/bash/templates/support.sh | 9 ++ RHEL6/transforms/combinefixes.py | 97 +++++++++----------- RHEL6/transforms/xccdf-addfixes.xslt | 2 +- 4 files changed, 60 insertions(+), 54 deletions(-) create mode 100644 RHEL6/input/fixes/bash/set_system_login_banner.sh create mode 100644 RHEL6/input/fixes/bash/templates/support.sh

3 8

xsl:attribute: The attribute name 'xmlns' is not allowed.
by Brian Millett 05 Jun '13

05 Jun '13

Hello, I'm trying to get started with making the latest clone from the git repository and I get the following error: [bpm]$ git clone http://git.fedorahosted.org/git/scap-security-guide.gitscap-security-guide Cloning into 'scap-security-guide'... remote: Counting objects: 14016, done. remote: Compressing objects: 100% (5257/5257), done. remote: Total 14016 (delta 10574), reused 10664 (delta 7718) Receiving objects: 100% (14016/14016), 3.18 MiB | 2.17 MiB/s, done. Resolving deltas: 100% (10574/10574), done. [bpm]$ cd scap-security-guide/RHEL6/ [bpm]$ make all xsltproc -o output/rhel6-shorthand.xml input/guide.xslt input/guide.xml xmllint --format --output output/rhel6-shorthand.xml output/rhel6-shorthand.xml xsltproc -o output/unlinked-noprofiles-rhel6-xccdf.xml transforms/shorthand2xccdf.xslt output/rhel6-shorthand.xml compilation error: file transforms/shorthand2xccdf.xslt line 19 element attribute xsl:attribute: The attribute name 'xmlns' is not allowed. make: *** [shorthand2xccdf] Error 5 I've a fedora 18 , x86_64 installation. Any ideas? Thanks. -- Brian Millett "Shifts in paradigms often cause nose bleeds." Greg Glenn

4 6

[PATCH 0/4] Remediation Templates
by Shawn Wells 04 Jun '13

04 Jun '13

6 8

[PATCH] Update from deprecated rpmverify_* to rpmverifyfile_* checks
by Maura Dailey 04 Jun '13

04 Jun '13

Little patch to eliminate a deprecated family of checks and tests. I compared the results of testcheck.py against the current list of complaints that rpm -qVa outputs on our systems and everything seems to match up. I still can't get accounts_root_path_dirs_no_write.xml to work correctly (specifying a file or directory directly in place of parsing out PATH works, but trying to get it to use variables correctly is stumping me). - Maura Dailey Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil> --- RHEL6/input/checks/rpm_verify_permissions.xml | 42 ++++++++++++------------ 1 files changed, 21 insertions(+), 21 deletions(-) diff --git a/RHEL6/input/checks/rpm_verify_permissions.xml b/RHEL6/input/checks/rpm_verify_permissions.xml index cfb662e..d177dfb 100644 --- a/RHEL6/input/checks/rpm_verify_permissions.xml +++ b/RHEL6/input/checks/rpm_verify_permissions.xml @@ -16,40 +16,40 @@ <criterion test_ref="test_verify_all_rpms_mode" comment="mode of all files matches local rpm database" /> </criteria> </definition> - <linux:rpmverify_test check_existence="none_exist" id="test_verify_all_rpms_user_ownership" version="1" check="all" comment="user ownership of all files matches local rpm database"> + <linux:rpmverifyfile_test check_existence="none_exist" id="test_verify_all_rpms_user_ownership" version="1" check="all" comment="user ownership of all files matches local rpm database"> <linux:object object_ref="object_files_fail_user_ownership"/> - </linux:rpmverify_test> - <linux:rpmverify_test check_existence="none_exist" id="test_verify_all_rpms_group_ownership" version="1" check="all" comment="group ownership of all files matches local rpm database"> + </linux:rpmverifyfile_test> + <linux:rpmverifyfile_test check_existence="none_exist" id="test_verify_all_rpms_group_ownership" version="1" check="all" comment="group ownership of all files matches local rpm database"> <linux:object object_ref="object_files_fail_group_ownership"/> - </linux:rpmverify_test> - <linux:rpmverify_test check_existence="none_exist" id="test_verify_all_rpms_mode" version="1" check="all" comment="mode of all files matches local rpm database"> + </linux:rpmverifyfile_test> + <linux:rpmverifyfile_test check_existence="none_exist" id="test_verify_all_rpms_mode" version="1" check="all" comment="mode of all files matches local rpm database"> <linux:object object_ref="object_files_fail_mode"/> - </linux:rpmverify_test> - <linux:rpmverify_object id="object_files_fail_user_ownership" version="1" comment="rpm verify of all files"> - <linux:behaviors nodeps="true" nofiles="false" nodigest="true" noscripts="true" nosignature="true" nomd5="true"/> + </linux:rpmverifyfile_test> + <linux:rpmverifyfile_object id="object_files_fail_user_ownership" version="1" comment="rpm verify of all files"> + <linux:behaviors nomd5="true"/> <linux:name operation="pattern match">.*</linux:name> <linux:filepath operation="pattern match">.*</linux:filepath> <filter action="include">state_files_fail_user_ownership</filter> - </linux:rpmverify_object> - <linux:rpmverify_object id="object_files_fail_group_ownership" version="1" comment="rpm verify of all files"> - <linux:behaviors nodeps="true" nofiles="false" nodigest="true" noscripts="true" nosignature="true" nomd5="true"/> + </linux:rpmverifyfile_object> + <linux:rpmverifyfile_object id="object_files_fail_group_ownership" version="1" comment="rpm verify of all files"> + <linux:behaviors nomd5="true"/> <linux:name operation="pattern match">.*</linux:name> <linux:filepath operation="pattern match">.*</linux:filepath> <filter action="include">state_files_fail_group_ownership</filter> - </linux:rpmverify_object> - <linux:rpmverify_object id="object_files_fail_mode" version="1" comment="rpm verify of all files"> - <linux:behaviors nodeps="true" nofiles="false" nodigest="true" noscripts="true" nosignature="true" nomd5="true"/> + </linux:rpmverifyfile_object> + <linux:rpmverifyfile_object id="object_files_fail_mode" version="1" comment="rpm verify of all files"> + <linux:behaviors nomd5="true"/> <linux:name operation="pattern match">.*</linux:name> <linux:filepath operation="pattern match">.*</linux:filepath> <filter action="include">state_files_fail_mode</filter> - </linux:rpmverify_object> - <linux:rpmverify_state id="state_files_fail_user_ownership" version="1"> + </linux:rpmverifyfile_object> + <linux:rpmverifyfile_state id="state_files_fail_user_ownership" version="1"> <linux:ownership_differs>fail</linux:ownership_differs> - </linux:rpmverify_state> - <linux:rpmverify_state id="state_files_fail_group_ownership" version="1"> + </linux:rpmverifyfile_state> + <linux:rpmverifyfile_state id="state_files_fail_group_ownership" version="1"> <linux:group_differs>fail</linux:group_differs> - </linux:rpmverify_state> - <linux:rpmverify_state id="state_files_fail_mode" version="1"> + </linux:rpmverifyfile_state> + <linux:rpmverifyfile_state id="state_files_fail_mode" version="1"> <linux:mode_differs>fail</linux:mode_differs> - </linux:rpmverify_state> + </linux:rpmverifyfile_state> </def-group> -- 1.7.1

2 2

[PATCH] fix the accounts_umask_* checks to reference var_accounts_user_umask.
by Brian Millett 04 Jun '13

04 Jun '13

accounts_umask_* checks are referencing the wrong variables. Brian Millett (1): Ok, to fix the "error" doing an evaluation for the various umask checks, changed the following variables referenced in the checks RHEL6/input/checks/accounts_umask_bashrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_cshrc.xml | 4 ++-- RHEL6/input/checks/accounts_umask_etc_profile.xml | 4 ++-- RHEL6/input/checks/accounts_umask_login_defs.xml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) -- 1.8.2.1

1 1

question about fix-common code
by Jeffrey Blank 03 Jun '13

03 Jun '13

Francisco, Shawn, What was your thinking behind the common-fix elements? Please also see (shortly) my new patches for fix insertion. I've re-written the fix insertion stuff. So that people can "declare" their use of particular environment variables in bash (using a bash function). Then the reworked combinefixes.py will pick up on the declaration and assign an XCCDF <sub idref/> to that variable. <sub idref/> is how oscap supports inserting particular values inside a fix. For unit testing (still incomplete), the bash function "needs" should grab the right value from XCCDF and populate it accordingly. Do we still need the fix-common elements, to insert them into the XCCDF? I like to delete unused code. Jeff

3 3

[PATCH 1/4] Added bash templates directory, added sample sysctl script
by Shawn Wells 01 Jun '13

01 Jun '13

3 4

[PATCH 2/4] Added sysctl remediation scripts
by Shawn Wells 01 Jun '13

01 Jun '13

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide June 2013