From maura at eclipse.ncsc.mil Thu Aug 20 11:35:09 2015 Content-Type: multipart/mixed; boundary="===============2727902579444128115==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat Date: Tue, 10 Sep 2013 12:55:57 -0400 Message-ID: <522F4F1D.8070908@eclipse.ncsc.mil> In-Reply-To: 1377888894-14967-1-git-send-email-maura@eclipse.ncsc.mil --===============2727902579444128115== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable No one's ACKED/NACKED these. Also, Shawn committed a patch that tries to = template these checks, but templated checks won't work unless the system = is guaranteed not to be using EFI or unless the template can handle two = alternate file locations. - Maura Dailey On 08/30/2013 02:54 PM, Maura Dailey wrote: > There isn't any way to do this the clever way, following the symlink /etc= /grub.conf, so for now at least, I added a second path to check, the path f= or EFI in a default install. > > Signed-off-by: Maura Dailey > --- > RHEL6/input/checks/file_group_owner_grub_conf.xml | 18 ++++++++++++++= +--- > RHEL6/input/checks/file_user_owner_grub_conf.xml | 18 ++++++++++++++= +--- > 2 files changed, 30 insertions(+), 6 deletions(-) > > diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml b/RHEL6/in= put/checks/file_group_owner_grub_conf.xml > index 3fc076a..4856fdf 100644 > --- a/RHEL6/input/checks/file_group_owner_grub_conf.xml > +++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml > @@ -1,14 +1,16 @@ > > > > - File /boot/grub/grub.conf Owned By root Group > + File grub.conf Owned By root Group > > Red Hat Enterprise Linux 6 > > - The /boot/grub/grub.conf file should be owned by the = root group. > + The grub.conf file should be owned by the root group.= > + > > - > + > > + > > > = > @@ -17,11 +19,21 @@ > > > = > + > + > + > + > + > > /boot/grub > grub.conf > > = > + > + /boot/efi/EFI/redhat > + grub.conf > + > + > > 0 > > diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml b/RHEL6/inp= ut/checks/file_user_owner_grub_conf.xml > index 53d5e2f..290d883 100644 > --- a/RHEL6/input/checks/file_user_owner_grub_conf.xml > +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml > @@ -1,14 +1,16 @@ > > > > - File /boot/grub/grub.conf Owned By root User > + File grub.conf Owned By root User > > Red Hat Enterprise Linux 6 > > - The /boot/grub/grub.conf file should be owned by the = root user. > + The grub.conf file should be owned by the root user.<= /description> > + > > - > + > > + > > > = > @@ -17,11 +19,21 @@ > > > = > + > + > + > + > + > > /boot/grub > grub.conf > > = > + > + /boot/efi/EFI/redhat > + grub.conf > + > + > > 0 > --===============2727902579444128115==--