From shawn at redhat.com Thu Aug 20 11:35:10 2015 Content-Type: multipart/mixed; boundary="===============9125300495307989885==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat Date: Tue, 10 Sep 2013 14:16:49 -0400 Message-ID: <522F6211.7090901@redhat.com> In-Reply-To: 522F60AE.3080503@eclipse.ncsc.mil --===============9125300495307989885== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 9/10/13 2:10 PM, Maura Dailey wrote: > On 09/10/2013 02:09 PM, Maura Dailey wrote: >> On 09/10/2013 01:51 PM, Shawn Wells wrote: >>> On 8/30/13 2:54 PM, Maura Dailey wrote: >>>> + >>> id=3D"object_file_group_owner_efi_grub_conf" version=3D"1"> >>>> + /boot/efi/EFI/redhat >>>> + grub.conf >>>> + >>> >>> Please convert to filepath >>> >>>> +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml >>>> @@ -1,14 +1,16 @@ >>>> >>>> >>> version=3D"1"> >>>> >>>> - File /boot/grub/grub.conf Owned By root User >>>> + File grub.conf Owned By root User >>>> >>>> Red Hat Enterprise Linux 6 >>>> >>>> - The /boot/grub/grub.conf file should be owned = >>>> by the root user. >>>> + The grub.conf file should be owned by the root = >>>> user. >>> >>> This may sound silly, but we shouldn't assume ISSE/ISSMs know where = >>> grub.conf is. This should be modified akin to "While the standard = >>> location for grub.conf is /boot/grub.conf, on EFI systems, check = >>> /boot/efi/EFI/redhat/grub.conf" >> >> Hmm... Maybe something like "The grub.conf file should be owned by = >> the root user. By default, this file is located at /boot/grub.conf = >> or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf"? >> > Sorry, /boot/grub/grub.conf. Much better. Could you make the changes & resubmit for an ack? # >>>> + >>> ref_url=3D"test_attestation" /> >>>> + >>> id=3D"object_file_user_owner_efi_grub_conf" version=3D"1"> >>>> + /boot/efi/EFI/redhat >>>> + grub.conf >>>> + >>>> + >>> filepath vs filename >>> _______________________________________________ >>> scap-security-guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide -- = Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells --===============9125300495307989885==--