From maura at eclipse.ncsc.mil Thu Aug 20 11:35:10 2015 Content-Type: multipart/mixed; boundary="===============0817180447158473893==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] grub.conf is not guaranteed to be in /boot/grub if the system is using EFI, so I added a test for its default location in /boot/efi/EFI/redhat Date: Tue, 10 Sep 2013 14:10:54 -0400 Message-ID: <522F60AE.3080503@eclipse.ncsc.mil> In-Reply-To: 522F6050.2080606@eclipse.ncsc.mil --===============0817180447158473893== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 09/10/2013 02:09 PM, Maura Dailey wrote: > On 09/10/2013 01:51 PM, Shawn Wells wrote: >> On 8/30/13 2:54 PM, Maura Dailey wrote: >>> + >> id=3D"object_file_group_owner_efi_grub_conf" version=3D"1"> >>> + /boot/efi/EFI/redhat >>> + grub.conf >>> + >> >> Please convert to filepath >> >>> +++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml >>> @@ -1,14 +1,16 @@ >>> >>> >> version=3D"1"> >>> >>> - File /boot/grub/grub.conf Owned By root User >>> + File grub.conf Owned By root User >>> >>> Red Hat Enterprise Linux 6 >>> >>> - The /boot/grub/grub.conf file should be owned by = >>> the root user. >>> + The grub.conf file should be owned by the root = >>> user. >> >> This may sound silly, but we shouldn't assume ISSE/ISSMs know where = >> grub.conf is. This should be modified akin to "While the standard = >> location for grub.conf is /boot/grub.conf, on EFI systems, check = >> /boot/efi/EFI/redhat/grub.conf" > > Hmm... Maybe something like "The grub.conf file should be owned by the = > root user. By default, this file is located at /boot/grub.conf or, for = > EFI systems, at /boot/efi/EFI/redhat/grub.conf"? > Sorry, /boot/grub/grub.conf. >> >>> + >> ref_url=3D"test_attestation" /> >>> + >> id=3D"object_file_user_owner_efi_grub_conf" version=3D"1"> >>> + /boot/efi/EFI/redhat >>> + grub.conf >>> + >>> + >> filepath vs filename >> _______________________________________________ >> scap-security-guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide --===============0817180447158473893==--