[PATCH] [RHEL/6, RHEL/7, shared] Replace rsyslog_files_permissions OVAL unknown test stub with actual check implementation
by Jan Lieskovsky
The proposed patch replaces rsyslog_files_permissions OVAL unknown test stub
with actual check implementation.
The check:
* first searches /etc/rsyslog.conf for (uncommented) presence of /var/log/*
log files paths and stores these paths into list,
* then selects just file objects (from all the system ones) having path matching
some of the selected ones,
* lastly compares (via file object state) if the permissions are 0600 or stronger.
The change has been tested on both, RHEL-6 & RHEL-7 & seems to work properly (=>
update the test_attestations, created links & moved the test to shared within
the patch proposal too).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
9 years, 9 months
[PATCH] Replace constants for profile value in XCCDF descriptions
by Rui Pedro Bernardino
The proposed patch replaces the constants found in XCCDF descriptions by the profile values.
Using this patch, generated guides and reports will reflect the profile specific values, eg, PASS_MIN_LEN description in rule accounts_password_minlen_login_defs will reflect profile's var_accounts_password_minlen_login_defs and not the default '14'.
Rui Bernardino (1):
Replaced profile dependent constants by references to profile values
RHEL/6/input/services/ssh.xml | 4 +-
RHEL/6/input/system/accounts/pam.xml | 36 ++++++++++----------
RHEL/6/input/system/accounts/physical.xml | 4 +-
.../accounts/restrictions/account_expiration.xml | 8 ++---
.../accounts/restrictions/password_expiration.xml | 15 ++++----
RHEL/6/input/system/accounts/session.xml | 20 +++++-----
RHEL/6/input/system/auditing.xml | 23 +++++-------
RHEL/6/input/system/permissions/execution.xml | 7 ++--
RHEL/6/input/system/selinux.xml | 12 +++---
9 files changed, 62 insertions(+), 67 deletions(-)
--
Rui Pedro Bernardino
CTE2
Aveiro
PT Inovação e Sistemas
9 years, 9 months
[PATCH 1/2] modified remediation text for disabling anacron
by David Smith
---
RHEL/6/input/services/cron.xml | 14 ++++++++------
1 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/RHEL/6/input/services/cron.xml b/RHEL/6/input/services/cron.xml
index 983d9ed..b859dc0 100644
--- a/RHEL/6/input/services/cron.xml
+++ b/RHEL/6/input/services/cron.xml
@@ -25,16 +25,18 @@ enabling the cron daemon is essential.
<Rule id="disable_anacron">
<title>Disable anacron Service</title>
-<description>The <tt>cronie-anacron</tt> package which provides anacron
-functionality is installed by default. To disable <tt>anacron</tt> support,
-run the following commands:
-<pre># yum install cronie-noanacron
-# yum erase cronie-anacron</pre>
+<description>The <tt>cronie-anacron</tt> package, which provides <tt>anacron</tt>
+functionality, is installed by default.
+<package-remove-macro package="cronie-anacron" />
+</description>
+<ocil><package-check-macro package="cronie-anacron" /></ocil>
+<rationale>
The <tt>anacron</tt> service provides <tt>cron</tt> functionality for systems
such as laptops and workstations that may be shut down during the normal times
that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this
additional functionality, <tt>anacron</tt> could needlessly increase the possible
-attack surface for an intruder.</description>
+attack surface for an intruder.
+</rationale>
<ref nist="CM-7" />
<ident cce="27158-5" />
</Rule>
--
1.7.1
9 years, 9 months
[Patch set #v2] [PATCH 0/2] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation.
by Jan Lieskovsky
From 32bbdecc7dda86f71f16cc8f0a47a02e959c717e Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov(a)redhat.com>
Date: Fri, 6 Jun 2014 14:09:33 +0200
Subject: [PATCH 0/2] Finish logrotate_rotate_all_files =>
ensure_logrotate_activated transition. Replace
ensure_logrotate_activated unknown test stub with actual OVAL check
implementation.
Based on promise in:
[1]
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-June/00...
the following patchset finishes the logrotate_rotate_all_files to
ensure_logrotate_activated
transition. The first patch [1/2] is identical with the original one from:
[2]
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-May/005...
But in addition to that one, the ensure_logrotate_activated.xml OVAL
check in [shared]
has been modified via patch [2/2] to properly honour the syntax /
behaviour of /etc/
logrotate.conf file (last rotate log setting uncommented option present
is actually the
honoured one).
Implement the test it was pretty challenging (considering the
possibilities OVAL language
brings to check complex configuration files). Needed to try couple of
alternatives, but
the one following seems to be working properly.
Note: When testing the change, be sure to comment out the
'test_cron_daily_logrotate_existence'
sub-test (or move /etc/cron.daily/logrotate file under temporary backup
with different
name) to actually see, how behaviour of
'test_logrotate_conf_daily_setting' OVAL check
changed (to actually see when making changes to /etc/logrotate.conf they
to have impact
on the final result of XCCDF rule scan).
Testing status: Proposed change has been tested on both (RHEL-6, RHEL-7)
products,
and works properly in all various cases of /etc/logrotate.conf config
file format, that might
occur (as far as I have tested & can tell).
The underlying regular expressions are pretty complex, but hopefully the
comments before /
around them will clarify the idea behind the test's work. Should there
be a need to clarify
some part of them, feel free to ask.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
Jan Lieskovsky (2):
[RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files =>
ensure_logrotate_activated transition. Replace
ensure_logrotate_activated unknown test stub with actual OVAL check
implementation.
[shared] Fix ensure_logrotate_activated OVAL check to properly handle
/etc/logrotate.conf format (last occurred rotate log
directive to be the by the check honoured one)
RHEL/6/input/checks/ensure_logrotate_activated.xml | 21 +------
RHEL/6/input/system/logging.xml | 2 +-
RHEL/7/input/checks/ensure_logrotate_activated.xml | 1 +
RHEL/7/input/system/logging.xml | 2 +-
shared/oval/ensure_logrotate_activated.xml | 72
++++++++++++++++++++++
5 files changed, 76 insertions(+), 22 deletions(-)
mode change 100644 => 120000
RHEL/6/input/checks/ensure_logrotate_activated.xml
create mode 120000 RHEL/7/input/checks/ensure_logrotate_activated.xml
create mode 100644 shared/oval/ensure_logrotate_activated.xml
--
1.8.3.1
9 years, 9 months
[PATCH] [*/utils/verify-references.py] Return non-zero status (to indicate failure) if some warning message was printed (some of the internal checks didn't pass)
by Jan Lieskovsky
Currently */utils/verify-references.py script(s) (thus make validate for that
product) always return zero (success) status regardless if some of the underlying
internal checks failed or not.
This is not good for subsequent automated processing e.g. via shell scripts.
Therefore if some of the verify-references.py check caused a warning to be
printed, return non-zero / 1 exit status to indicate failure (not to actually
need to parse the warning).
This is just cosmetic change which doesn't have impact if the RPM package will be
built successfully or not (make validate isn't part of the RPM package build),
but will simplify the testing / life for those actually running 'make validate'
after each commit for that product.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
9 years, 9 months
[Patch set #v2] [PATCH 2/2] [shared] Fix ensure_logrotate_activated OVAL check to properly handle /etc/logrotate.conf format (last occurred rotate log directive to be the by the check honoured one)
by Jan Lieskovsky
This patch modifies the behaviour of the original
ensure_logrotate_activated's
test_logrotate_conf_daily_setting sub-test it to:
* not just check if there's 'daily' setting present in /etc/logrotate.conf
(at least one uncommented occurrence of it),
* but also if it isn't followed by (uncommented) occurrence of some
of weekly / monthly / yearly rotate log directives, which have global
meaning (IOW aren't present in some of {} block sections).
Various possibilities / combinations of /etc/logrotate.conf file, that can
occur (wrt to multiple directives present) has been tested, and the check
seems to be working properly on both, RHEL-6 & RHEL-7 (more testing
appreciated of course).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
9 years, 9 months
[PATCH] Adapted 'no_files_unowned_by_user' to implement 'no_files_unowned_by_group' rules/checks
by Rui Pedro Bernardino
The proposed patch implements 'no_files_unowned_by_group' rule and check, based on 'no_files_unowned_by_user'.
Rui Bernardino (1):
Adapted 'no_files_unowned_by_user' to implement
'no_files_unowned_by_group' rules/checks
.../input/checks/file_permissions_ungroupowned.xml | 36 --------------------
RHEL/6/input/checks/no_files_unowned_by_user.xml | 4 +-
RHEL/6/input/system/permissions/files.xml | 2 +-
3 files changed, 3 insertions(+), 39 deletions(-) delete mode 100644 RHEL/6/input/checks/file_permissions_ungroupowned.xml
--
Rui Pedro Bernardino
CTE2
Aveiro
PT Inovação e Sistemas
9 years, 10 months
[PATCH] modified remediation text for disabling anacron
by David Smith
Signed-off-by: David Smith <dsmith(a)secure-innovations.net>
---
RHEL/6/input/services/cron.xml | 14 ++++++++------
1 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/RHEL/6/input/services/cron.xml b/RHEL/6/input/services/cron.xml
index 983d9ed..b859dc0 100644
--- a/RHEL/6/input/services/cron.xml
+++ b/RHEL/6/input/services/cron.xml
@@ -25,16 +25,18 @@ enabling the cron daemon is essential.
<Rule id="disable_anacron">
<title>Disable anacron Service</title>
-<description>The <tt>cronie-anacron</tt> package which provides anacron
-functionality is installed by default. To disable <tt>anacron</tt> support,
-run the following commands:
-<pre># yum install cronie-noanacron
-# yum erase cronie-anacron</pre>
+<description>The <tt>cronie-anacron</tt> package, which provides <tt>anacron</tt>
+functionality, is installed by default.
+<package-remove-macro package="cronie-anacron" />
+</description>
+<ocil><package-check-macro package="cronie-anacron" /></ocil>
+<rationale>
The <tt>anacron</tt> service provides <tt>cron</tt> functionality for systems
such as laptops and workstations that may be shut down during the normal times
that <tt>cron</tt> jobs are scheduled to run. On systems which do not require this
additional functionality, <tt>anacron</tt> could needlessly increase the possible
-attack surface for an intruder.</description>
+attack surface for an intruder.
+</rationale>
<ref nist="CM-7" />
<ident cce="27158-5" />
</Rule>
--
1.7.1
9 years, 10 months