From shawn at redhat.com Thu Aug 20 11:36:58 2015 Content-Type: multipart/mixed; boundary="===============7936963574205104077==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [RHEL/6] Allow /boot/grub/grub.conf permissions to be stronger than 0600 Date: Sun, 11 May 2014 14:27:02 -0500 Message-ID: <536FCF06.9080302@redhat.com> In-Reply-To: 1312228722.12405842.1396524427459.JavaMail.zimbra@redhat.com --===============7936963574205104077== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 4/3/14, 6:27 AM, Jan Lieskovsky wrote: > When checking "Verify /boot/grub/grub.conf Permissions" rule, > allow the check to succeed also in case the underlying system > has stronger file permissions on /boot/grub/grub.conf file > than exactly 0600 (IOW instead of exact requirement of / for 0600 > permissions, make the 0600 mode the upper bound of the allowed > value / range). > > Please review. > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0001-RHEL-6-Allow-boot-grub-grub.conf-permissions-to-be-s.patch > > > From 1203661223621428e00271a236432540cde59ff6 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Thu, 3 Apr 2014 13:17:34 +0200 > Subject: [PATCH] [RHEL/6] Allow /boot/grub/grub.conf permissions to be > stronger than 0600 > > Signed-off-by: Jan Lieskovsky > --- > RHEL/6/input/checks/file_permissions_grub_conf.xml | 8 +++----- > 1 file changed, 3 insertions(+), 5 deletions(-) > > diff --git a/RHEL/6/input/checks/file_permissions_grub_conf.xml b/RHEL/6/= input/checks/file_permissions_grub_conf.xml > index 747f2d9..3347a8b 100644 > --- a/RHEL/6/input/checks/file_permissions_grub_conf.xml > +++ b/RHEL/6/input/checks/file_permissions_grub_conf.xml > @@ -1,11 +1,11 @@ > > - > + > > File /boot/grub/grub.conf Permissions > > Red Hat Enterprise Linux 6 > > - File permissions for /boot/grub/grub.conf should be s= et to 0600. > + File permissions for /boot/grub/grub.conf should be s= et to 0600 (or stronger). > > > > @@ -22,9 +22,7 @@ > grub.conf > > = > - > - true > - true > + > false > false > false > -- 1.8.3.1 This seems to be another patch that slipped through the cracks (GitHub, = here we come....). Perfectly sane - ack --===============7936963574205104077== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGJyPgogICAgPGRpdiBjbGFzcz0ibW96LWNp dGUtcHJlZml4Ij5PbiA0LzMvMTQsIDY6MjcgQU0sIEphbiBMaWVza292c2t5CiAgICAgIHdyb3Rl Ojxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKICAgICAgY2l0ZT0ibWlkOjEzMTIyMjg3 MjIuMTI0MDU4NDIuMTM5NjUyNDQyNzQ1OS5KYXZhTWFpbC56aW1icmFAcmVkaGF0LmNvbSIKICAg ICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0 cnVlIiBncmFwaGljYWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAt bW96LWZpeGVkOyBmb250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAg ICAgICAgPHByZSB3cmFwPSIiPldoZW4gY2hlY2tpbmcgIlZlcmlmeSAvYm9vdC9ncnViL2dydWIu Y29uZiBQZXJtaXNzaW9ucyIgcnVsZSwKYWxsb3cgdGhlIGNoZWNrIHRvIHN1Y2NlZWQgYWxzbyBp biBjYXNlIHRoZSB1bmRlcmx5aW5nIHN5c3RlbQpoYXMgc3Ryb25nZXIgZmlsZSBwZXJtaXNzaW9u cyBvbiAvYm9vdC9ncnViL2dydWIuY29uZiBmaWxlCnRoYW4gZXhhY3RseSAwNjAwIChJT1cgaW5z dGVhZCBvZiBleGFjdCByZXF1aXJlbWVudCBvZiAvIGZvciAwNjAwCnBlcm1pc3Npb25zLCBtYWtl IHRoZSAwNjAwIG1vZGUgdGhlIHVwcGVyIGJvdW5kIG9mIHRoZSBhbGxvd2VkCnZhbHVlIC8gcmFu Z2UpLgoKUGxlYXNlIHJldmlldy4KClRoYW5rIHlvdSAmYW1wOyZhbXA7IFJlZ2FyZHMsIEphbi4K LS0KSmFuIGlhbmtrbyBMaWVza292c2t5IC8gUmVkIEhhdCBTZWN1cml0eSBUZWNobm9sb2dpZXMg VGVhbTwvcHJlPgogICAgICA8L2Rpdj4KICAgICAgPGJyPgogICAgICA8ZmllbGRzZXQgY2xhc3M9 Im1pbWVBdHRhY2htZW50SGVhZGVyIj48bGVnZW5kCiAgICAgICAgICBjbGFzcz0ibWltZUF0dGFj aG1lbnRIZWFkZXJOYW1lIj4wMDAxLVJIRUwtNi1BbGxvdy1ib290LWdydWItZ3J1Yi5jb25mLXBl cm1pc3Npb25zLXRvLWJlLXMucGF0Y2g8L2xlZ2VuZD48L2ZpZWxkc2V0PgogICAgICA8YnI+CiAg ICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGljYWwtcXVv dGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNp emU6IDEycHg7IgogICAgICAgIGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgPHByZSB3cmFwPSIi PkZyb20gMTIwMzY2MTIyMzYyMTQyOGUwMDI3MWEyMzY0MzI1NDBjZGU1OWZmNiBNb24gU2VwIDE3 IDAwOjAwOjAwIDIwMDEKRnJvbTogSmFuIExpZXNrb3Zza3kgPGEgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86amxpZXNrb3ZA cmVkaGF0LmNvbSI+Jmx0O2psaWVza292QHJlZGhhdC5jb20mZ3Q7PC9hPgpEYXRlOiBUaHUsIDMg QXByIDIwMTQgMTM6MTc6MzQgKzAyMDAKU3ViamVjdDogW1BBVENIXSBbUkhFTC82XSBBbGxvdyAv Ym9vdC9ncnViL2dydWIuY29uZiBwZXJtaXNzaW9ucyB0byBiZQogc3Ryb25nZXIgdGhhbiAwNjAw CgpTaWduZWQtb2ZmLWJ5OiBKYW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUi IGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRo YXQuY29tIj4mbHQ7amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+Ci0tLQogUkhFTC82L2lucHV0 L2NoZWNrcy9maWxlX3Blcm1pc3Npb25zX2dydWJfY29uZi54bWwgfCA4ICsrKy0tLS0tCiAxIGZp bGUgY2hhbmdlZCwgMyBpbnNlcnRpb25zKCspLCA1IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBh L1JIRUwvNi9pbnB1dC9jaGVja3MvZmlsZV9wZXJtaXNzaW9uc19ncnViX2NvbmYueG1sIGIvUkhF TC82L2lucHV0L2NoZWNrcy9maWxlX3Blcm1pc3Npb25zX2dydWJfY29uZi54bWwKaW5kZXggNzQ3 ZjJkOS4uMzM0N2E4YiAxMDA2NDQKLS0tIGEvUkhFTC82L2lucHV0L2NoZWNrcy9maWxlX3Blcm1p c3Npb25zX2dydWJfY29uZi54bWwKKysrIGIvUkhFTC82L2lucHV0L2NoZWNrcy9maWxlX3Blcm1p c3Npb25zX2dydWJfY29uZi54bWwKQEAgLTEsMTEgKzEsMTEgQEAKICZsdDtkZWYtZ3JvdXAmZ3Q7 Ci0gICZsdDtkZWZpbml0aW9uIGNsYXNzPSJjb21wbGlhbmNlIiBpZD0iZmlsZV9wZXJtaXNzaW9u c19ncnViX2NvbmYiIHZlcnNpb249IjEiJmd0OworICAmbHQ7ZGVmaW5pdGlvbiBjbGFzcz0iY29t cGxpYW5jZSIgaWQ9ImZpbGVfcGVybWlzc2lvbnNfZ3J1Yl9jb25mIiB2ZXJzaW9uPSIyIiZndDsK ICAgICAmbHQ7bWV0YWRhdGEmZ3Q7CiAgICAgICAmbHQ7dGl0bGUmZ3Q7RmlsZSAvYm9vdC9ncnVi L2dydWIuY29uZiBQZXJtaXNzaW9ucyZsdDsvdGl0bGUmZ3Q7CiAgICAgICAmbHQ7YWZmZWN0ZWQg ZmFtaWx5PSJ1bml4IiZndDsKICAgICAgICAgJmx0O3BsYXRmb3JtJmd0O1JlZCBIYXQgRW50ZXJw cmlzZSBMaW51eCA2Jmx0Oy9wbGF0Zm9ybSZndDsKICAgICAgICZsdDsvYWZmZWN0ZWQmZ3Q7Ci0g ICAgICAmbHQ7ZGVzY3JpcHRpb24mZ3Q7RmlsZSBwZXJtaXNzaW9ucyBmb3IgL2Jvb3QvZ3J1Yi9n cnViLmNvbmYgc2hvdWxkIGJlIHNldCB0byAwNjAwLiZsdDsvZGVzY3JpcHRpb24mZ3Q7CisgICAg ICAmbHQ7ZGVzY3JpcHRpb24mZ3Q7RmlsZSBwZXJtaXNzaW9ucyBmb3IgL2Jvb3QvZ3J1Yi9ncnVi LmNvbmYgc2hvdWxkIGJlIHNldCB0byAwNjAwIChvciBzdHJvbmdlcikuJmx0Oy9kZXNjcmlwdGlv biZndDsKICAgICAmbHQ7L21ldGFkYXRhJmd0OwogICAgICZsdDtjcml0ZXJpYSZndDsKICAgICAg ICZsdDtjcml0ZXJpb24gdGVzdF9yZWY9InRlc3RfZmlsZV9wZXJtaXNzaW9uc19ncnViX2NvbmYi IC8mZ3Q7CkBAIC0yMiw5ICsyMiw3IEBACiAgICAgJmx0O3VuaXg6ZmlsZW5hbWUmZ3Q7Z3J1Yi5j b25mJmx0Oy91bml4OmZpbGVuYW1lJmd0OwogICAmbHQ7L3VuaXg6ZmlsZV9vYmplY3QmZ3Q7CiAK LSAgJmx0O3VuaXg6ZmlsZV9zdGF0ZSBpZD0ic3RhdGVfZmlsZV9wZXJtaXNzaW9uc19ncnViX2Nv bmYiIHZlcnNpb249IjEiJmd0OwotICAgICZsdDt1bml4OnVyZWFkIGRhdGF0eXBlPSJib29sZWFu IiZndDt0cnVlJmx0Oy91bml4OnVyZWFkJmd0OwotICAgICZsdDt1bml4OnV3cml0ZSBkYXRhdHlw ZT0iYm9vbGVhbiImZ3Q7dHJ1ZSZsdDsvdW5peDp1d3JpdGUmZ3Q7CisgICZsdDt1bml4OmZpbGVf c3RhdGUgaWQ9InN0YXRlX2ZpbGVfcGVybWlzc2lvbnNfZ3J1Yl9jb25mIiB2ZXJzaW9uPSIyIiZn dDsKICAgICAmbHQ7dW5peDp1ZXhlYyBkYXRhdHlwZT0iYm9vbGVhbiImZ3Q7ZmFsc2UmbHQ7L3Vu aXg6dWV4ZWMmZ3Q7CiAgICAgJmx0O3VuaXg6Z3JlYWQgZGF0YXR5cGU9ImJvb2xlYW4iJmd0O2Zh bHNlJmx0Oy91bml4OmdyZWFkJmd0OwogICAgICZsdDt1bml4Omd3cml0ZSBkYXRhdHlwZT0iYm9v bGVhbiImZ3Q7ZmFsc2UmbHQ7L3VuaXg6Z3dyaXRlJmd0Owo8ZGl2IGNsYXNzPSJtb3otdHh0LXNp ZyI+LS0gCjEuOC4zLjEKCjwvZGl2PjwvcHJlPgogICAgICA8L2Rpdj4KICAgIDwvYmxvY2txdW90 ZT4KICAgIDxicj4KICAgIDxicj4KICAgIFRoaXMgc2VlbXMgdG8gYmUgYW5vdGhlciBwYXRjaCB0 aGF0IHNsaXBwZWQgdGhyb3VnaCB0aGUgY3JhY2tzCiAgICAoR2l0SHViLCBoZXJlIHdlIGNvbWUu Li4uKS48YnI+CiAgICA8YnI+CiAgICBQZXJmZWN0bHkgc2FuZSAtIGFjazxicj4KICA8L2JvZHk+ CjwvaHRtbD4K --===============7936963574205104077==--