From shawn at redhat.com Thu Aug 20 11:36:19 2015 Content-Type: multipart/mixed; boundary="===============3635749052587299201==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: fix CCE-27032-2 no_files_unowned_by_user.xml Date: Wed, 22 Jan 2014 21:56:47 -0500 Message-ID: <52E084EF.20806@redhat.com> In-Reply-To: 1387381521.2799.1408.camel@osc145 --===============3635749052587299201== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 12/18/13, 10:45 AM, Rodney L. Mercer wrote: > Based on comments and recommendations from the following thread, I've > submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml > https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/00= 3627.html > > This only checks /etc/passwd and not any other authorization databases. > > > 8<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001 > From: Rodney Mercer > Date: Wed, 18 Dec 2013 15:01:25 +0000 > Subject: [PATCH] Modified no_files_unowned_by_user.xml > modified completely broken no_files_unowned_by_user.xml to properly > check all files on the system to make sure that they are owned by a user > that resides in /etc/passwd. > > --- > RHEL6/input/checks/no_files_unowned_by_user.xml | 51 > ++++++++++++---------- > 1 files changed, 28 insertions(+), 23 deletions(-) > > diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml > b/RHEL6/input/checks/no_files_unowned_by_user.xml > index a73183a..f3f1276 100644 > --- a/RHEL6/input/checks/no_files_unowned_by_user.xml > +++ b/RHEL6/input/checks/no_files_unowned_by_user.xml > @@ -1,38 +1,43 @@ > > - - id=3D"no_files_unowned_by_user" version=3D"1"> > + version=3D"1"> > > Find files unowned by a user > > Red Hat Enterprise Linux 6 > > - All files should be owned by a > - user > + All files should be owned by a user > + ref_url=3D"test_attestation" /> > > > - by a user" > - negate=3D"true" > - test_ref=3D"test_20050" /> > + by a user" test_ref=3D"no_files_unowned_by_user_test" /> > > > - xmlns:unix=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" > - check=3D"all" comment=3D"files with no user owner" > - id=3D"test_20050" version=3D"1"> > - > - This will enumerate all files on local > - partitions > - > - > - > - > - - id=3D"state_20050" version=3D"1"> > - 0 > + > + version=3D"1"> > + var_ref=3D"file_permissions_unowned_userid_list" datatype=3D"int" /> > > - - id=3D"obj_20022" version=3D"1"> > - recurse_file_system=3D"local" /> > + > + comment=3D"List of valid user ids" datatype=3D"int" version=3D"1"> > + object_ref=3D"file_permissions_unowned_userid_list_object" /> > + > + > + id=3D"file_permissions_unowned_userid_list_object" version=3D"1"> > + /etc/passwd > + match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$ > + datatype=3D"int">1 > + > + > + id=3D"file_permissions_unowned_object" version=3D"1"> > + recurse_direction=3D"down" recurse_file_system=3D"local" /> > / > .* > + action=3D"exclude">file_permissions_unowned_userid_list_match > > + > + xmlns:unix=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" > + check=3D"all" check_existence=3D"none_exist" comment=3D"Check user ids= on > all files on the system" > + id=3D"no_files_unowned_by_user_test" version=3D"1"> > + > + > > + > -- 1.7.1 Works on my machine. Ack. --===============3635749052587299201== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMi8xOC8xMywgMTA6NDUgQU0sIFJvZG5leSBMLiBNZXJjZXIKICAgICAgd3JvdGU6PGJy PgogICAgPC9kaXY+CiAgICA8YmxvY2txdW90ZSBjaXRlPSJtaWQ6MTM4NzM4MTUyMS4yNzk5LjE0 MDguY2FtZWxAb3NjMTQ1IiB0eXBlPSJjaXRlIj4KICAgICAgPGRpdiBjbGFzcz0ibW96LXRleHQt cGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIKICAgICAgICBzdHlsZT0i Zm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsiCiAgICAgICAgbGFuZz0i eC11bmljb2RlIj4KICAgICAgICA8cHJlIHdyYXA9IiI+QmFzZWQgb24gY29tbWVudHMgYW5kIHJl Y29tbWVuZGF0aW9ucyBmcm9tIHRoZSBmb2xsb3dpbmcgdGhyZWFkLCBJJ3ZlCnN1Ym1pdHRlZCBh IHBhdGNoIHRvIGZpeCBDQ0UtMjcwMzItMiBub19maWxlc191bm93bmVkX2J5X3VzZXIueG1sCjxh IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJl Zj0iaHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL3BpcGVybWFpbC9zY2FwLXNlY3VyaXR5 LWd1aWRlLzIwMTMtSnVseS8wMDM2MjcuaHRtbCI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQu b3JnL3BpcGVybWFpbC9zY2FwLXNlY3VyaXR5LWd1aWRlLzIwMTMtSnVseS8wMDM2MjcuaHRtbDwv YT4KClRoaXMgb25seSBjaGVja3MgL2V0Yy9wYXNzd2QgYW5kIG5vdCBhbnkgb3RoZXIgYXV0aG9y aXphdGlvbiBkYXRhYmFzZXMuCgoKOCZsdDs9PT09PT09PT09PT09PT09PT09PQomZ3Q7RnJvbSBh YjgwNzk3Njk3YmRmMDBjNWUwNWNhZjE1MDEyNGRmNjdlMGE5YTUxIE1vbiBTZXAgMTcgMDA6MDA6 MDAgMjAwMQpGcm9tOiBSb2RuZXkgTWVyY2VyIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOnJtZXJjZXJAaGFycmlzLmNv bSI+Jmx0O3JtZXJjZXJAaGFycmlzLmNvbSZndDs8L2E+CkRhdGU6IFdlZCwgMTggRGVjIDIwMTMg MTU6MDE6MjUgKzAwMDAKU3ViamVjdDogW1BBVENIXSBNb2RpZmllZCBub19maWxlc191bm93bmVk X2J5X3VzZXIueG1sCiBtb2RpZmllZCBjb21wbGV0ZWx5IGJyb2tlbiBub19maWxlc191bm93bmVk X2J5X3VzZXIueG1sIHRvIHByb3Blcmx5CmNoZWNrIGFsbCBmaWxlcyBvbiB0aGUgc3lzdGVtIHRv IG1ha2Ugc3VyZSB0aGF0IHRoZXkgYXJlIG93bmVkIGJ5IGEgdXNlcgp0aGF0IHJlc2lkZXMgaW4g L2V0Yy9wYXNzd2QuCgotLS0KIFJIRUw2L2lucHV0L2NoZWNrcy9ub19maWxlc191bm93bmVkX2J5 X3VzZXIueG1sIHwgICA1MQorKysrKysrKysrKystLS0tLS0tLS0tCiAxIGZpbGVzIGNoYW5nZWQs IDI4IGluc2VydGlvbnMoKyksIDIzIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL1JIRUw2L2lu cHV0L2NoZWNrcy9ub19maWxlc191bm93bmVkX2J5X3VzZXIueG1sCmIvUkhFTDYvaW5wdXQvY2hl Y2tzL25vX2ZpbGVzX3Vub3duZWRfYnlfdXNlci54bWwKaW5kZXggYTczMTgzYS4uZjNmMTI3NiAx MDA2NDQKLS0tIGEvUkhFTDYvaW5wdXQvY2hlY2tzL25vX2ZpbGVzX3Vub3duZWRfYnlfdXNlci54 bWwKKysrIGIvUkhFTDYvaW5wdXQvY2hlY2tzL25vX2ZpbGVzX3Vub3duZWRfYnlfdXNlci54bWwK QEAgLTEsMzggKzEsNDMgQEAKICZsdDtkZWYtZ3JvdXAmZ3Q7Ci0gICZsdDtkZWZpbml0aW9uIGNs YXNzPSJjb21wbGlhbmNlIgotICBpZD0ibm9fZmlsZXNfdW5vd25lZF9ieV91c2VyIiB2ZXJzaW9u PSIxIiZndDsKKyAgJmx0O2RlZmluaXRpb24gY2xhc3M9ImNvbXBsaWFuY2UiIGlkPSJub19maWxl c191bm93bmVkX2J5X3VzZXIiCnZlcnNpb249IjEiJmd0OwogICAgICZsdDttZXRhZGF0YSZndDsK ICAgICAgICZsdDt0aXRsZSZndDtGaW5kIGZpbGVzIHVub3duZWQgYnkgYSB1c2VyJmx0Oy90aXRs ZSZndDsKICAgICAgICZsdDthZmZlY3RlZCBmYW1pbHk9InVuaXgiJmd0OwogICAgICAgICAmbHQ7 cGxhdGZvcm0mZ3Q7UmVkIEhhdCBFbnRlcnByaXNlIExpbnV4IDYmbHQ7L3BsYXRmb3JtJmd0Owog ICAgICAgJmx0Oy9hZmZlY3RlZCZndDsKLSAgICAgICZsdDtkZXNjcmlwdGlvbiZndDtBbGwgZmls ZXMgc2hvdWxkIGJlIG93bmVkIGJ5IGEKLSAgICAgIHVzZXImbHQ7L2Rlc2NyaXB0aW9uJmd0Owor ICAgICAgJmx0O2Rlc2NyaXB0aW9uJmd0O0FsbCBmaWxlcyBzaG91bGQgYmUgb3duZWQgYnkgYSB1 c2VyJmx0Oy9kZXNjcmlwdGlvbiZndDsKKyAgICAgICZsdDtyZWZlcmVuY2Ugc291cmNlPSJybWVy Y2VyIiByZWZfaWQ9IjIwMTMxMjE4IgpyZWZfdXJsPSJ0ZXN0X2F0dGVzdGF0aW9uIiAvJmd0Owog ICAgICZsdDsvbWV0YWRhdGEmZ3Q7CiAgICAgJmx0O2NyaXRlcmlhJmd0OwotICAgICAgJmx0O2Ny aXRlcmlvbiBjb21tZW50PSJDaGVjayBhbGwgZmlsZXMgYW5kIG1ha2Ugc3VyZSB0aGV5IGFyZSBv d25lZApieSBhIHVzZXIiCi0gICAgICBuZWdhdGU9InRydWUiCi0gICAgICB0ZXN0X3JlZj0idGVz dF8yMDA1MCIgLyZndDsKKyAgICAgICZsdDtjcml0ZXJpb24gY29tbWVudD0iQ2hlY2sgYWxsIGZp bGVzIGFuZCBtYWtlIHN1cmUgdGhleSBhcmUgb3duZWQKYnkgYSB1c2VyIiB0ZXN0X3JlZj0ibm9f ZmlsZXNfdW5vd25lZF9ieV91c2VyX3Rlc3QiIC8mZ3Q7CiAgICAgJmx0Oy9jcml0ZXJpYSZndDsK ICAgJmx0Oy9kZWZpbml0aW9uJmd0OwotICAmbHQ7dW5peDpmaWxlX3Rlc3QKeG1sbnM6dW5peD08 YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhy ZWY9Imh0dHA6Ly9vdmFsLm1pdHJlLm9yZy9YTUxTY2hlbWEvb3ZhbC1kZWZpbml0aW9ucy01I3Vu aXgiPiJodHRwOi8vb3ZhbC5taXRyZS5vcmcvWE1MU2NoZW1hL292YWwtZGVmaW5pdGlvbnMtNSN1 bml4IjwvYT4KLSAgY2hlY2s9ImFsbCIgY29tbWVudD0iZmlsZXMgd2l0aCBubyB1c2VyIG93bmVy IgotICBpZD0idGVzdF8yMDA1MCIgdmVyc2lvbj0iMSImZ3Q7Ci0gICAgJmx0O25vdGVzJmd0Owot ICAgICAgJmx0O25vdGUmZ3Q7VGhpcyB3aWxsIGVudW1lcmF0ZSBhbGwgZmlsZXMgb24gbG9jYWwK LSAgICAgIHBhcnRpdGlvbnMmbHQ7L25vdGUmZ3Q7Ci0gICAgJmx0Oy9ub3RlcyZndDsKLSAgICAm bHQ7dW5peDpvYmplY3Qgb2JqZWN0X3JlZj0ib2JqXzIwMDIyIiAvJmd0OwotICAgICZsdDt1bml4 OnN0YXRlIHN0YXRlX3JlZj0ic3RhdGVfMjAwNTAiIC8mZ3Q7Ci0gICZsdDsvdW5peDpmaWxlX3Rl c3QmZ3Q7Ci0gICZsdDt1bml4OmZpbGVfc3RhdGUgY29tbWVudD0iRXhlY3V0YWJsZXMgd2l0aCBz dWlkIHNldCIKLSAgaWQ9InN0YXRlXzIwMDUwIiB2ZXJzaW9uPSIxIiZndDsKLSAgICAmbHQ7dW5p eDp1c2VyX2lkIGRhdGF0eXBlPSJpbnQiJmd0OzAmbHQ7L3VuaXg6dXNlcl9pZCZndDsKKworICAm bHQ7dW5peDpmaWxlX3N0YXRlIGlkPSJmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRfdXNlcmlkX2xp c3RfbWF0Y2giCnZlcnNpb249IjEiJmd0OworICAgICZsdDt1bml4OnVzZXJfaWQgdmFyX2NoZWNr PSJhdCBsZWFzdCBvbmUiCnZhcl9yZWY9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF91c2VyaWRf bGlzdCIgZGF0YXR5cGU9ImludCIgLyZndDsKICAgJmx0Oy91bml4OmZpbGVfc3RhdGUmZ3Q7Ci0g ICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9ImFsbCBsb2NhbCBmaWxlcyIKLSAgaWQ9Im9i al8yMDAyMiIgdmVyc2lvbj0iMSImZ3Q7Ci0gICAgJmx0O3VuaXg6YmVoYXZpb3JzIHJlY3Vyc2U9 InN5bWxpbmtzIGFuZCBkaXJlY3RvcmllcyIKcmVjdXJzZV9maWxlX3N5c3RlbT0ibG9jYWwiIC8m Z3Q7CisKKyAgJmx0O2xvY2FsX3ZhcmlhYmxlIGlkPSJmaWxlX3Blcm1pc3Npb25zX3Vub3duZWRf dXNlcmlkX2xpc3QiCmNvbW1lbnQ9Ikxpc3Qgb2YgdmFsaWQgdXNlciBpZHMiIGRhdGF0eXBlPSJp bnQiIHZlcnNpb249IjEiJmd0OworICAgICZsdDtvYmplY3RfY29tcG9uZW50IGl0ZW1fZmllbGQ9 InN1YmV4cHJlc3Npb24iCm9iamVjdF9yZWY9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF91c2Vy aWRfbGlzdF9vYmplY3QiIC8mZ3Q7CisgICZsdDsvbG9jYWxfdmFyaWFibGUmZ3Q7CisKKyAgJmx0 O2luZDp0ZXh0ZmlsZWNvbnRlbnQ1NF9vYmplY3QKaWQ9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25l ZF91c2VyaWRfbGlzdF9vYmplY3QiIHZlcnNpb249IjEiJmd0OworICAgICZsdDtpbmQ6ZmlsZXBh dGgmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L2luZDpmaWxlcGF0aCZndDsKKyAgICAmbHQ7aW5kOnBhdHRl cm4gb3BlcmF0aW9uPSJwYXR0ZXJuCm1hdGNoIiZndDteW146XSs6W146XSs6KFtcZF0rKTpbXGRd KzpbXjpdKjpbXjpdKzpbXjpdKiQmbHQ7L2luZDpwYXR0ZXJuJmd0OworICAgICZsdDtpbmQ6aW5z dGFuY2Ugb3BlcmF0aW9uPSJncmVhdGVyIHRoYW4gb3IgZXF1YWwiCmRhdGF0eXBlPSJpbnQiJmd0 OzEmbHQ7L2luZDppbnN0YW5jZSZndDsKKyAgJmx0Oy9pbmQ6dGV4dGZpbGVjb250ZW50NTRfb2Jq ZWN0Jmd0OworCisgICZsdDt1bml4OmZpbGVfb2JqZWN0IGNvbW1lbnQ9ImFsbCBsb2NhbCBmaWxl cyIKaWQ9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF9vYmplY3QiIHZlcnNpb249IjEiJmd0Owor ICAgICZsdDt1bml4OmJlaGF2aW9ycyByZWN1cnNlPSJzeW1saW5rcyBhbmQgZGlyZWN0b3JpZXMi CnJlY3Vyc2VfZGlyZWN0aW9uPSJkb3duIiByZWN1cnNlX2ZpbGVfc3lzdGVtPSJsb2NhbCIgLyZn dDsKICAgICAmbHQ7dW5peDpwYXRoJmd0Oy8mbHQ7L3VuaXg6cGF0aCZndDsKICAgICAmbHQ7dW5p eDpmaWxlbmFtZSBvcGVyYXRpb249InBhdHRlcm4gbWF0Y2giJmd0Oy4qJmx0Oy91bml4OmZpbGVu YW1lJmd0OworICAgICZsdDtmaWx0ZXIKYWN0aW9uPSJleGNsdWRlIiZndDtmaWxlX3Blcm1pc3Np b25zX3Vub3duZWRfdXNlcmlkX2xpc3RfbWF0Y2gmbHQ7L2ZpbHRlciZndDsKICAgJmx0Oy91bml4 OmZpbGVfb2JqZWN0Jmd0OworICAKKyAgJmx0O3VuaXg6ZmlsZV90ZXN0CnhtbG5zOnVuaXg9PGEg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLXJmYzIzOTZFIiBocmVm PSJodHRwOi8vb3ZhbC5taXRyZS5vcmcvWE1MU2NoZW1hL292YWwtZGVmaW5pdGlvbnMtNSN1bml4 Ij4iaHR0cDovL292YWwubWl0cmUub3JnL1hNTFNjaGVtYS9vdmFsLWRlZmluaXRpb25zLTUjdW5p eCI8L2E+CisgIGNoZWNrPSJhbGwiIGNoZWNrX2V4aXN0ZW5jZT0ibm9uZV9leGlzdCIgY29tbWVu dD0iQ2hlY2sgdXNlciBpZHMgb24KYWxsIGZpbGVzIG9uIHRoZSBzeXN0ZW0iCisgIGlkPSJub19m aWxlc191bm93bmVkX2J5X3VzZXJfdGVzdCIgdmVyc2lvbj0iMSImZ3Q7CisgICAgJmx0O3VuaXg6 b2JqZWN0IG9iamVjdF9yZWY9ImZpbGVfcGVybWlzc2lvbnNfdW5vd25lZF9vYmplY3QiIC8mZ3Q7 CisgICZsdDsvdW5peDpmaWxlX3Rlc3QmZ3Q7CiAmbHQ7L2RlZi1ncm91cCZndDsKKyAgCjxkaXYg Y2xhc3M9Im1vei10eHQtc2lnIj4tLSAKMS43LjEKCjwvZGl2PjwvcHJlPgogICAgICA8L2Rpdj4K ICAgIDwvYmxvY2txdW90ZT4KICAgIFdvcmtzIG9uIG15IG1hY2hpbmUuIEFjay48YnI+CiAgICA8 YnI+CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============3635749052587299201==--