[PATCH] [Fedora] Add OVAL check for Verify that Shared Library Files Have Restrictive Permissions
by Jan Lieskovsky
This patch adds OVAL check for 'Verify that Shared Library Files Have Restrictive Permissions'
rule for Fedora.
It is a re-implementation / simplification against currently used RHEL-6 form:
[1] https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/inpu...
Instead of having dedicated tests for each of /lib, /lib64, /usr/lib && /usr/lib64
directories (and checking based on 'equals' operation), it uses just one test
for each of library permissions checks and files' permissions within those libraries
check (and checks based on 'pattern match' operation).
Passed basic sanity && regression testing.
Please review (especially in relation with existing RHEL-6 form if
we would like to use this proposal also for particular RHEL-6 OVAL check
in the future).
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
10 years, 4 months
[PATCH] fix for find command parameters in RHEL6/input/fixes/bash/file_permissions_library_dirs.sh
by Trayer, Jeb D CTR
A colleague found during testing, that the find command for checking/fixing group or world writeable files in library directories had the -perm flag set as -022 (all bits set) instead of /022 (any bits set). I updated RHEL6/input/fixes/bash/file_permissions_library_dirs.sh and generated this patch to update the fix content.
I can't push this patch so if its approved, so if someone that could, doesn't mind it's appreciated.
Thanks!
Jeb Trayer, CTR
Ace Info Solutions, Inc.
USCG Operations System Center
Jeb.D.Trayer(a)uscg.mil
Signed-off-by: Jeb Trayer <jeb.d.trayer(a)uscg.mil>
---
.../fixes/bash/file_permissions_library_dirs.sh | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh b/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh
index 263612f..7de0740 100644
--- a/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh
+++ b/RHEL6/input/fixes/bash/file_permissions_library_dirs.sh
@@ -1,4 +1,4 @@
DIRS="/lib /lib64 /usr/lib /usr/lib64"
for dirPath in $DIRS; do
- find $dirPath -perm -022 -type f -exec chmod go-w '{}' \;
+ find $dirPath -perm /022 -type f -exec chmod go-w '{}' \;
done
--
1.7.1
10 years, 4 months
Re: Fedora 'gitscap-security-guide' sponsor needed for jejohnso
by Shawn Wells
On 12/3/13, 9:55 AM, Jesse Johnson wrote:
> Hello all,
>
> My name is Jesse Johnson and I am a new member to scap security group. I'm a CISSP and a Navy verteran with nearly 5 years of DIACAP experience. I look forward to assisting the community in developing policy Red Hat and Fedora systems.
Welcome! There's an absurdly long list of open bugs, remediation scripts
are most welcome, and there's still OVAL signoff in the auditing
sections. Where you wanna begin? :)
10 years, 4 months