Sounds a bit like
* Permissives * Protection * Interlocks * Acquisition & Audit * Etc
From: sgrubb@redhat.com Sent: January 10, 2019 12:56 PM To: scap-security-guide@lists.fedorahosted.org Reply to: scap-security-guide@lists.fedorahosted.org Cc: shawn@redhat.com Subject: Re: Rule rpm_verify_file_hashes and config files
On Thursday, January 10, 2019 11:24:20 AM EST Shawn Wells wrote:
On 1/9/19 8:54 PM, Trevor Vaughan wrote:
DoD refined as requiring audit of all success/failed attempts to create/access/delete/modify files [2]
Ugh... this thing *destroys* systems on a regular basis along with the chmod/chown rules. I get it but I've seen *so* many systems tanked by those rules.
Way the current Configuration Annex is written is that CNSSI 1253 and DoD systems will need to audit every file I/O.
It is almost the same as what is called out for by OSPP-4.2. Which you can see here:
https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42...
AFAICS, CNSSI 1253 also wants accesses of configuration files. I would say that is ill-advised. You may want failures due to permissions in accessing files. But with a lot of subsystems putting configuration in /usr/lib/ how do you tell what to monitor and what is applications? I'd say treat config files as any other file because they are too spread out and accessed constantly, like $HOME/.bashrc
-Steve
They have a reasonably responsive team behind these. Can open a ticket through GitHub, or even submit a PR, to start the conversation to have these changed:
https://github.com/commoncriteria/operatingsystem/blob/master/input/configa nnex.xml#L212#L223
_______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor... THIS MESSAGE IS FOR THE USE OF THE INTENDED RECIPIENT(S) ONLY AND MAY CONTAIN INFORMATION THAT IS PRIVILEGED, PROPRIETARY, CONFIDENTIAL, AND/OR EXEMPT FROM DISCLOSURE UNDER ANY RELEVANT PRIVACY LEGISLATION. No rights to any privilege have been waived. If you are not the intended recipient, you are hereby notified that any review, re-transmission, dissemination, distribution, copying, conversion to hard copy, taking of action in reliance on or other use of this communication is strictly prohibited. If you are not the intended recipient and have received this message in error, please notify me by return e-mail and delete or destroy all copies of this message.