From shawn at redhat.com Thu Aug 20 11:34:48 2015 Content-Type: multipart/mixed; boundary="===============5667497194382455057==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Existing check was screwed up (title was wrong, comments were wrong, etc.) and was easily replaced by a templated check Date: Tue, 20 Aug 2013 00:12:02 -0400 Message-ID: <5212EC92.8050704@redhat.com> In-Reply-To: 1376957478-4013-1-git-send-email-maura@eclipse.ncsc.mil --===============5667497194382455057== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/19/13 8:11 PM, Maura Dailey wrote: > I noticed that the name of the check didn't make any sense, delved in dee= per, and discovered that the correct check more closely met the templated s= ysctl checks. > > - Maura Dailey > > Signed-off-by: Maura Dailey > --- > .../checks/core_dump_suid_progs_limits_conf.xml | 30 -------------= ------- > RHEL6/input/checks/sysctl_fs_suid_dumpable.xml | 28 +++++++++++++= +++++ > RHEL6/input/checks/templates/sysctl_values.csv | 1 + > RHEL6/input/system/permissions/execution.xml | 2 +- > 4 files changed, 30 insertions(+), 31 deletions(-) > delete mode 100644 RHEL6/input/checks/core_dump_suid_progs_limits_conf.= xml > create mode 100644 RHEL6/input/checks/sysctl_fs_suid_dumpable.xml > > diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RH= EL6/input/checks/core_dump_suid_progs_limits_conf.xml > deleted file mode 100644 > index 066957a..0000000 > --- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml > +++ /dev/null > @@ -1,30 +0,0 @@ > - > - - version=3D"1"> > - > - Disable Core Dumps for setuid programs > - > - Red Hat Enterprise Linux 6 > - > - Core dumps for setuid programs should be > - disabled > - > - > - - test_ref=3D"test_core_dump_suid_progs_limits_conf" /> > - > - > - - comment=3D"Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=3D([\s]= *) expression in the /etc/sysctl.conf file" > - id=3D"test_core_dump_suid_progs_limits_conf" version=3D"2"> > - > - > - - version=3D"1"> > - /etc/security > - limits.conf > - > - ^fs.suid_dumpable\s+=3D\s+1$ > - 1 > - > - > diff --git a/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml b/RHEL6/input= /checks/sysctl_fs_suid_dumpable.xml > new file mode 100644 > index 0000000..e358366 > --- /dev/null > +++ b/RHEL6/input/checks/sysctl_fs_suid_dumpable.xml > @@ -0,0 +1,28 @@ > + > + > + > + > + Kernel Runtime Parameter "fs.suid_dumpable" Check > + > + Red Hat Enterprise Linux 6 > + > + The kernel runtime parameter "fs.suid_dumpable" shoul= d be set to "0". > + > + > + > + > + > + > + > + > + > + > + > + > + fs.suid_dumpable > + > + > + > + 0 > + > + > diff --git a/RHEL6/input/checks/templates/sysctl_values.csv b/RHEL6/input= /checks/templates/sysctl_values.csv > index ae38b46..b318c47 100644 > --- a/RHEL6/input/checks/templates/sysctl_values.csv > +++ b/RHEL6/input/checks/templates/sysctl_values.csv > @@ -17,3 +17,4 @@ net.ipv4.ip_forward,0 > net.ipv4.tcp_syncookies,1 > net.ipv6.conf.default.accept_redirects,0 > net.ipv6.conf.default.accept_ra,0 > +fs.suid_dumpable,0 > diff --git a/RHEL6/input/system/permissions/execution.xml b/RHEL6/input/s= ystem/permissions/execution.xml > index d742d60..86d2ea7 100644 > --- a/RHEL6/input/system/permissions/execution.xml > +++ b/RHEL6/input/system/permissions/execution.xml > @@ -101,7 +101,7 @@ user who initiated execution of the program. Disabli= ng the ability for any > setuid program to write a core file decreases the risk of unauthorized = access > of such data. > > - > + > > > Ack --===============5667497194382455057==--