From maura at eclipse.ncsc.mil Thu Aug 20 11:34:47 2015 Content-Type: multipart/mixed; boundary="===============0934007055857888154==" MIME-Version: 1.0 From: Maura Dailey To: scap-security-guide at lists.fedorahosted.org Subject: Re: Rsyslog Permission Checks Date: Tue, 13 Aug 2013 17:08:32 -0400 Message-ID: <520AA050.4010302@eclipse.ncsc.mil> In-Reply-To: 520A8AB5.3090907@redhat.com --===============0934007055857888154== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/13/2013 03:36 PM, Shawn Wells wrote: > On 8/13/13 3:25 PM, Maura Dailey wrote: >> How do you think we should handle file owner and group permission = >> checks on rsyslog files? Should we look for a predetermined list of = >> files (trying to search for *.log is insufficient, since at the very = >> least, /var/log/messages, /var/log/secure, and /var/log/maillog would = >> get passed over)? Or should we try ninja regex to parse rsyslog.conf? > I'm torn. The 'right way' would be regex ninja. However that's hard, = > and has resulted in nothing getting done. Personally I'd rather have = > *something* hard coded, then evolve into ninja regex. > > With that said.... your regex-foo is strong and perhaps you could hack = > this out in 15min... ;) > _______________________________________________ > scap-security-guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide LOL, no, my regex is not that great. I played around with it this = morning and got as far as the following check, but I can't even imagine = how to handle rsyslog.conf's templating. If we have a consensus, perhaps = the best strategy is just to delete both rsyslog log permissions checks. = I can submit a patch that will do that pretty quickly. - Maura Dailey Confirm Existence and Permissions of System Log Files Red Hat Enterprise Linux 6 All syslog log files should be owned by the = appropriate group. /etc rsyslog.conf ^.*(\/var\/log\/.*)$ 1 0 --===============0934007055857888154==--