How's this?
I haven't submitted a check for the file permissions check yet,
because I need to discuss the fact that EFI's grub.conf is going
to be 700, not 600. A side effect of VFAT, I suppose.
- Maura Dailey
Signed-off-by: Maura Dailey
<maura@eclipse.ncsc.mil>
---
RHEL6/input/checks/file_group_owner_grub_conf.xml |
20 +++++++++++++++-----
RHEL6/input/checks/file_user_owner_grub_conf.xml |
20 +++++++++++++++-----
2 files changed, 30 insertions(+), 10 deletions(-)
diff --git
a/RHEL6/input/checks/file_group_owner_grub_conf.xml
b/RHEL6/input/checks/file_group_owner_grub_conf.xml
index 3fc076a..6d54f69 100644
--- a/RHEL6/input/checks/file_group_owner_grub_conf.xml
+++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml
@@ -1,14 +1,16 @@
<def-group>
<definition class="compliance"
id="file_group_owner_grub_conf" version="1">
<metadata>
- <title>File /boot/grub/grub.conf Owned By
root Group </title>
+ <title>File grub.conf Owned By root Group
</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux
6</platform>
</affected>
- <description>The /boot/grub/grub.conf file
should be owned by the root group.</description>
+ <description>The grub.conf file should be
owned by the root group. By default, this file is located at
/boot/grub/grub.conf or, for EFI systems, at
/boot/efi/EFI/redhat/grub.conf</description>
+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" />
</metadata>
- <criteria>
+ <criteria operator="OR">
<criterion
test_ref="test_file_group_owner_grub_conf" />
+ <criterion
test_ref="test_file_group_owner_efi_grub_conf" />
</criteria>
</definition>
@@ -17,9 +19,17 @@
<unix:state
state_ref="state_file_group_owner_grub_conf" />
</unix:file_test>
+ <unix:file_test check="all"
check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_group_owner_efi_grub_conf" version="1">
+ <unix:object
object_ref="object_file_group_owner_efi_grub_conf" />
+ <unix:state
state_ref="state_file_group_owner_grub_conf" />
+ </unix:file_test>
+
<unix:file_object comment="/boot/grub/grub.conf"
id="object_file_group_owner_grub_conf" version="1">
- <unix:path>/boot/grub</unix:path>
-
<unix:filename>grub.conf</unix:filename>
+
<unix:filepath>/boot/grub/grub.conf</unix:filepath>
+ </unix:file_object>
+
+ <unix:file_object
comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_group_owner_efi_grub_conf" version="1">
+
<unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
</unix:file_object>
<unix:file_state
id="state_file_group_owner_grub_conf" version="1">
diff --git
a/RHEL6/input/checks/file_user_owner_grub_conf.xml
b/RHEL6/input/checks/file_user_owner_grub_conf.xml
index 53d5e2f..0a3df12 100644
--- a/RHEL6/input/checks/file_user_owner_grub_conf.xml
+++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml
@@ -1,14 +1,16 @@
<def-group>
<definition class="compliance"
id="file_user_owner_grub_conf" version="1">
<metadata>
- <title>File /boot/grub/grub.conf Owned By
root User</title>
+ <title>File grub.conf Owned By root
User</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux
6</platform>
</affected>
- <description>The /boot/grub/grub.conf file
should be owned by the root user.</description>
+ <description>The grub.conf file should be
owned by the root user. By default, this file is located at
/boot/grub/grub.conf or, for EFI systems, at
/boot/efi/EFI/redhat/grub.conf</description>
+ <reference source="MED" ref_id="20130830"
ref_url="test_attestation" />
</metadata>
- <criteria>
+ <criteria operator="OR">
<criterion
test_ref="test_file_user_owner_grub_conf" />
+ <criterion
test_ref="test_file_user_owner_efi_grub_conf" />
</criteria>
</definition>
@@ -17,9 +19,17 @@
<unix:state
state_ref="state_file_user_owner_grub_conf" />
</unix:file_test>
+ <unix:file_test check="all"
check_existence="all_exist"
comment="/boot/efi/EFI/redhat/grub.conf owned by root"
id="test_file_user_owner_efi_grub_conf" version="1">
+ <unix:object
object_ref="object_file_user_owner_efi_grub_conf" />
+ <unix:state
state_ref="state_file_user_owner_grub_conf" />
+ </unix:file_test>
+
<unix:file_object comment="/boot/grub/grub.conf"
id="object_file_user_owner_grub_conf" version="1">
- <unix:path>/boot/grub</unix:path>
-
<unix:filename>grub.conf</unix:filename>
+
<unix:filepath>/boot/grub/grub.conf</unix:filepath>
+ </unix:file_object>
+
+ <unix:file_object
comment="/boot/efi/EFI/redhat/grub.conf"
id="object_file_user_owner_efi_grub_conf" version="1">
+
<unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
</unix:file_object>
<unix:file_state
id="state_file_user_owner_grub_conf" version="1">
--
1.7.1