|How's this?
I haven't submitted a check for the file permissions check yet, because
I need to discuss the fact that EFI's grub.conf is going to be 700, not
600. A side effect of VFAT, I suppose.
||
- Maura Dailey
||Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>||
||---||
|| RHEL6/input/checks/file_group_owner_grub_conf.xml | 20
+++++++++++++++-----||
|| RHEL6/input/checks/file_user_owner_grub_conf.xml | 20
+++++++++++++++-----||
|| 2 files changed, 30 insertions(+), 10 deletions(-)||
||
||diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml
b/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||index 3fc076a..6d54f69 100644||
||--- a/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||+++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml||
||@@ -1,14 +1,16 @@||
|| <def-group>||
|| <definition class="compliance" id="file_group_owner_grub_conf"
version="1">||
|| <metadata>||
||- <title>File /boot/grub/grub.conf Owned By root Group </title>||
||+ <title>File grub.conf Owned By root Group </title>||
|| <affected family="unix">||
|| <platform>Red Hat Enterprise Linux 6</platform>||
|| </affected>||
||- <description>The /boot/grub/grub.conf file should be owned by
the root group.</description>||
||+ <description>The grub.conf file should be owned by the root
group. By default, this file is located at /boot/grub/grub.conf or, for
EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>||
||+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" />||
|| </metadata>||
||- <criteria>||
||+ <criteria operator="OR">||
|| <criterion test_ref="test_file_group_owner_grub_conf" />||
||+ <criterion test_ref="test_file_group_owner_efi_grub_conf" />||
|| </criteria>||
|| </definition>||
||||
||@@ -17,9 +19,17 @@||
|| <unix:state state_ref="state_file_group_owner_grub_conf" />||
|| </unix:file_test>||
||||
||+ <unix:file_test check="all" check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_group_owner_efi_grub_conf" version="1">||
||+ <unix:object object_ref="object_file_group_owner_efi_grub_conf"
/>||
||+ <unix:state state_ref="state_file_group_owner_grub_conf" />||
||+ </unix:file_test>||
||+||
|| <unix:file_object comment="/boot/grub/grub.conf"
id="object_file_group_owner_grub_conf" version="1">||
||- <unix:path>/boot/grub</unix:path>||
||- <unix:filename>grub.conf</unix:filename>||
||+ <unix:filepath>/boot/grub/grub.conf</unix:filepath>||
||+ </unix:file_object>||
||+||
||+ <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_group_owner_efi_grub_conf" version="1">||
||+ <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>||
|| </unix:file_object>||
||||
|| <unix:file_state id="state_file_group_owner_grub_conf"
version="1">||
||diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml
b/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||index 53d5e2f..0a3df12 100644||
||--- a/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||+++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml||
||@@ -1,14 +1,16 @@||
|| <def-group>||
|| <definition class="compliance" id="file_user_owner_grub_conf"
version="1">||
|| <metadata>||
||- <title>File /boot/grub/grub.conf Owned By root User</title>||
||+ <title>File grub.conf Owned By root User</title>||
|| <affected family="unix">||
|| <platform>Red Hat Enterprise Linux 6</platform>||
|| </affected>||
||- <description>The /boot/grub/grub.conf file should be owned by
the root user.</description>||
||+ <description>The grub.conf file should be owned by the root
user. By default, this file is located at /boot/grub/grub.conf or, for
EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>||
||+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" />||
|| </metadata>||
||- <criteria>||
||+ <criteria operator="OR">||
|| <criterion test_ref="test_file_user_owner_grub_conf" />||
||+ <criterion test_ref="test_file_user_owner_efi_grub_conf" />||
|| </criteria>||
|| </definition>||
||||
||@@ -17,9 +19,17 @@||
|| <unix:state state_ref="state_file_user_owner_grub_conf" />||
|| </unix:file_test>||
||||
||+ <unix:file_test check="all" check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_user_owner_efi_grub_conf" version="1">||
||+ <unix:object object_ref="object_file_user_owner_efi_grub_conf"
/>||
||+ <unix:state state_ref="state_file_user_owner_grub_conf" />||
||+ </unix:file_test>||
||+||
|| <unix:file_object comment="/boot/grub/grub.conf"
id="object_file_user_owner_grub_conf" version="1">||
||- <unix:path>/boot/grub</unix:path>||
||- <unix:filename>grub.conf</unix:filename>||
||+ <unix:filepath>/boot/grub/grub.conf</unix:filepath>||
||+ </unix:file_object>||
||+||
||+ <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_user_owner_efi_grub_conf" version="1">||
||+ <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>||
|| </unix:file_object>||
||||
|| <unix:file_state id="state_file_user_owner_grub_conf"
version="1">||
||-- ||
||1.7.1||
|