From jlieskov at redhat.com Thu Aug 20 11:35:54 2015 Content-Type: multipart/mixed; boundary="===============4291534070945126233==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [Fedora] Add OVAL check for Verify that Shared Library Files Have Restrictive Permissions Date: Thu, 05 Dec 2013 09:13:22 -0500 Message-ID: <154215290.12190432.1386252802818.JavaMail.root@redhat.com> In-Reply-To: 52A028CE.7080704@redhat.com --===============4291534070945126233== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Thursday, December 5, 2013 8:18:38 AM > Subject: Re: [PATCH] [Fedora] Add OVAL check for Verify that Shared Libra= ry Files Have Restrictive Permissions > = > On 12/4/13, 10:03 AM, Jan Lieskovsky wrote: > = > = > = > This patch adds OVAL check for 'Verify that Shared Library Files Have > Restrictive Permissions' > rule for Fedora. > = > It is a re-implementation / simplification against currently used RHEL-6 > form: > [1] > https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/in= put/checks/file_permissions_library_dirs.xml > Instead of having dedicated tests for each of /lib, /lib64, /usr/lib && > /usr/lib64 > directories (and checking based on 'equals' operation), it uses just one = test > for each of library permissions checks and files' permissions within those > libraries > check (and checks based on 'pattern match' operation). > = > Passed basic sanity && regression testing. > = > Please review (especially in relation with existing RHEL-6 form if > we would like to use this proposal also for particular RHEL-6 OVAL check > in the future). > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > 0001-Fedora-Add-OVAL-check-for-Verify-that-Shared-Library.patch > From 569de3bfcf8c65951b3b1c6ec4f59bd66511b367 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky Date: Wed, 4 Dec 2013 15:54:= 15 > +0100 > Subject: [PATCH] [Fedora] Add OVAL check for Verify that Shared Library F= iles > Have Restrictive Permissions > = > Signed-off-by: Jan Lieskovsky --- > .../input/checks/file_permissions_library_dirs.xml | 52 > ++++++++++++++++++++++ > Fedora/input/system/permissions/files.xml | 2 +- > Fedora/scap-security-guide.spec | 1 + > 3 files changed, 54 insertions(+), 1 deletion(-) > create mode 100644 Fedora/input/checks/file_permissions_library_dirs.xml > = > diff --git a/Fedora/input/checks/file_permissions_library_dirs.xml > b/Fedora/input/checks/file_permissions_library_dirs.xml > new file mode 100644 > index 0000000..cce15a5 > --- /dev/null > +++ b/Fedora/input/checks/file_permissions_library_dirs.xml > @@ -0,0 +1,52 @@ > + > + version=3D"1"> > + > + Verify that Shared Library Files Have Restrictive > Permissions > + > + Fedora 19 > + > + > + Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and > + objects therein, are not group-writable or world-writable. > + > + > + > + > + > + > + > + > + directories go-w" id=3D"test_perms_lib_dir" version=3D"1"> > + > + > + > + files go-w" id=3D"test_perms_lib_files" version=3D"1"> > + > + > + > + id=3D"object_file_permissions_lib_dir" version=3D"1"> > + > + match">^\/lib(|64)|^\/usr\/lib(|64) > + > + state_perms_nogroupwrite_noworldwrite > + perms_state_symlink > + > + > + id=3D"object_file_permissions_lib_files" version=3D"1"> > + > + match">^\/lib(|64)|^\/usr\/lib(|64) > + ^.*$ > + state_perms_nogroupwrite_noworldwrite > + perms_state_symlink > + > + > + operator=3D"OR"> > + true > + true > + > + > + > + symbolic link > + > + > + > diff --git a/Fedora/input/system/permissions/files.xml > b/Fedora/input/system/permissions/files.xml > index c15482c..a9bfd93 100644 > --- a/Fedora/input/system/permissions/files.xml > +++ b/Fedora/input/system/permissions/files.xml > @@ -30,7 +30,7 @@ runtime. Restrictive permissions are necessary to prote= ct > the integrity of the > system. > > > - > + > > = > > diff --git a/Fedora/scap-security-guide.spec > b/Fedora/scap-security-guide.spec > index cd3ff7e..356d024 100644 > --- a/Fedora/scap-security-guide.spec > +++ b/Fedora/scap-security-guide.spec > @@ -56,6 +56,7 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 > %{buildroot}%{_mandir}/en/man > %changelog > * Mon Dec 02 2013 Jan iankko Lieskovsky 0.1.4.rc= 9-1 > - Fix remediation for Disable Prelinking rule > +- OVAL check for Verify that Shared Library Files Have Restrictive > Permissions > = > * Fri Nov 29 2013 Jan iankko Lieskovsky 0.1.4.rc= 8-1 > - OVAL check and remediation for sshd's ClientAliveCountMax rule > -- > 1.8.3.1 > = > This is much cleaner. Ack to the code. > = > Should we start the scap-security-guide/shared/oval/ directory now, inste= ad > of placing within Fedora/input/checks/ directly? I will try to see what can be done (try to come with patch proposal having shared/oval directory) and start using it (we can return back to the current scheme [should there be some issues found later] anytime). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >=20 --===============4291534070945126233==--