5:24 p.m.
This is based on Shawn's earlier submission to the list.
I have little doubt that someone else could do this in a more
compact/comprehensible fashion (to the extent permitted by OVAL).
But this should work.
Jeffrey Blank (2):
OVAL check to find library files with permissions go+w
added link to new OVAL check for library perms
.../input/checks/file_permissions_library_dirs.xml | 153 ++++++++++++++++++++
RHEL6/input/system/permissions/files.xml | 1 +
2 files changed, 154 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml
5:24 p.m.
New subject: [PATCH 1/2] OVAL check to find library files with permissions go+w
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../input/checks/file_permissions_library_dirs.xml | 153 ++++++++++++++++++++
1 files changed, 153 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml
diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml
b/RHEL6/input/checks/file_permissions_library_dirs.xml
new file mode 100644
index 0000000..7e0a25a
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_library_dirs.xml
@@ -0,0 +1,153 @@
+<def-group>
+ <definition class="compliance"
id="file_permissions_library_dirs" version="1">
+ <metadata>
+ <title>Verify that Shared Library Files Have Restrictive
Permissions</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules,
and objects therein, are not group-writable
+ or world-writable.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion test_ref="test_perms_lib_dir" />
+ <criterion test_ref="test_perms_lib64_dir" />
+ <criterion test_ref="test_perms_usr_lib_dir" />
+ <criterion test_ref="test_perms_usr_lib64_dir" />
+ <criterion test_ref="test_perms_lib_modules_dir" />
+ <criterion test_ref="test_perms_lib_files" />
+ <criterion test_ref="test_perms_lib64_files" />
+ <criterion test_ref="test_perms_usr_lib_files" />
+ <criterion test_ref="test_perms_usr_lib64_files" />
+ <criterion test_ref="test_perms_lib_modules_files" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib directories go-w" id="test_perms_lib_dir"
version="1">
+ <unix:object object_ref="object_lib_dir" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib files go-w" id="test_perms_lib_files"
version="1">
+ <unix:object object_ref="object_lib_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib directories" id="object_lib_dir"
version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib files" id="object_lib_files"
version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib64 directories go-w" id="test_perms_lib64_dir"
version="1">
+ <unix:object object_ref="object_lib64_dir" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib64 files go-w" id="test_perms_lib64_files"
version="1">
+ <unix:object object_ref="object_lib64_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib64 directories"
id="object_lib64_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib64</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib64 files" id="object_lib64_files"
version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib64</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir"
version="1">
+ <unix:object object_ref="object_usr_lib_dir" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/usr/lib files go-w" id="test_perms_usr_lib_files"
version="1">
+ <unix:object object_ref="object_usr_lib_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/usr/lib directories"
id="object_usr_lib_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/usr/lib files"
id="object_usr_lib_files" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir"
version="1">
+ <unix:object object_ref="object_usr_lib64_dir" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files"
version="1">
+ <unix:object object_ref="object_usr_lib64_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/usr/lib64 directories"
id="object_usr_lib64_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib64</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/usr/lib64 files"
id="object_usr_lib64_files" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib64</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib/modules directories go-w"
id="test_perms_lib_modules_dir" version="1">
+ <unix:object object_ref="object_lib_modules_dir" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist"
comment="/lib/modules files go-w" id="test_perms_lib_modules_files"
version="1">
+ <unix:object object_ref="object_lib_modules_files" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib/modules directories"
id="object_lib_modules_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib/modules</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib/modules files"
id="object_lib_modules_files" version="1">
+ <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" max_depth="-1"
recurse_file_system="all" />
+ <unix:path operation="equals">/lib/modules</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ <filter action="exclude">state_symlink</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_symlink" version="1">
+ <unix:type operation="equals">symbolic link</unix:type>
+ </unix:file_state>
+
+ <unix:file_state id="state_perms_nogroupwrite_noworldwrite"
version="1" operator="OR">
+ <unix:gwrite datatype="boolean">true</unix:gwrite>
+ <unix:owrite datatype="boolean">true</unix:owrite>
+ </unix:file_state>
+</def-group>
--
1.7.1
5:24 p.m.
New subject: [PATCH 2/2] added link to new OVAL check for library perms
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/system/permissions/files.xml | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/system/permissions/files.xml
b/RHEL6/input/system/permissions/files.xml
index fc6d12b..890d687 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -216,6 +216,7 @@ runtime. Restrictive permissions are necessary to protect the
integrity of the s
</rationale>
<ref nist="AC-6" disa="1499"/>
<tested by="DS" on="20121026"/>
+<oval id="file_permissions_library_dirs" />
</Rule>
<Rule id="file_ownership_library_dirs" severity="medium">
--
1.7.1
6:17 p.m.
On 04/23/2013 06:24 PM, Jeffrey Blank wrote:
This is based on Shawn's earlier submission to the list.
I have little doubt that someone else could do this in a more
compact/comprehensible fashion (to the extent permitted by OVAL).
But this should work.
Jeffrey Blank (2):
OVAL check to find library files with permissions go+w
added link to new OVAL check for library perms
.../input/checks/file_permissions_library_dirs.xml | 153 ++++++++++++++++++++
RHEL6/input/system/permissions/files.xml | 1 +
2 files changed, 154 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
ACK to the set, I unit tested each criterion with testcheck.py.
- Maura Dailey
7:30 p.m.
On 4/23/13 7:17 PM, Maura Dailey wrote:
On 04/23/2013 06:24 PM, Jeffrey Blank wrote:
> This is based on Shawn's earlier submission to the list.
>
> I have little doubt that someone else could do this in a more
> compact/comprehensible fashion (to the extent permitted by OVAL).
>
> But this should work.
>
> Jeffrey Blank (2):
> OVAL check to find library files with permissions go+w
> added link to new OVAL check for library perms
>
> .../input/checks/file_permissions_library_dirs.xml | 153
> ++++++++++++++++++++
> RHEL6/input/system/permissions/files.xml | 1 +
> 2 files changed, 154 insertions(+), 0 deletions(-)
> create mode 100644
> RHEL6/input/checks/file_permissions_library_dirs.xml
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
ACK to the set, I unit tested each criterion with testcheck.py.
Based on the ACK, resolving ticket 395:
https://fedorahosted.org/scap-security-guide/ticket/395
4062
days inactive
4063
days old
scap-security-guide@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Jeffrey Blank -
Maura Dailey -
Shawn Wells