>From ad39dd001cbc87106c43d96facaab12ec967f523 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 10 Nov 2013 02:31:45 -0500 Subject: [PATCH 08/11] OVAL update + remediation for accounts_umask_etc_profile - OVAL filename->filepath - Naming scheme update to accounts_* for consistency - Added remediation script [root@SSG-RHEL6 checks]# var_accounts_user_umask=077 ; export var_accounts_user_umask [root@SSG-RHEL6 checks]# ./testcheck.py accounts_umask_etc_profile.xml external_variable with id : var_accounts_user_umask Evaluating with OVAL tempfile : /tmp/accounts_umask_etc_profilevp6vwU.xml Writing results to : /tmp/accounts_umask_etc_profilevp6vwU.xml-results Definition oval:scap-security-guide.testing:def:289: false Evaluation done. [root@SSG-RHEL6 checks]# cd ../fixes/bash/ [root@SSG-RHEL6 bash]# bash accounts_umask_etc_profile.sh [root@SSG-RHEL6 bash]# cd - /var/www/html/scap-security-guide/RHEL6/input/checks [root@SSG-RHEL6 checks]# ./testcheck.py accounts_umask_etc_profile.xml external_variable with id : var_accounts_user_umask Evaluating with OVAL tempfile : /tmp/accounts_umask_etc_profileTUvqsj.xml Writing results to : /tmp/accounts_umask_etc_profileTUvqsj.xml-results Definition oval:scap-security-guide.testing:def:289: true Evaluation done. --- RHEL6/input/checks/accounts_umask_cshrc.xml | 3 +-- RHEL6/input/checks/accounts_umask_etc_profile.xml | 3 +-- .../input/fixes/bash/accounts_umask_etc_profile.sh | 8 ++++++++ RHEL6/input/profiles/CS2.xml | 2 +- RHEL6/input/profiles/stig-rhel6-server.xml | 2 +- RHEL6/input/profiles/test.xml | 2 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL6/input/system/accounts/session.xml | 2 +- 8 files changed, 15 insertions(+), 9 deletions(-) create mode 100644 RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh diff --git a/RHEL6/input/checks/accounts_umask_cshrc.xml b/RHEL6/input/checks/accounts_umask_cshrc.xml index 86921e1..3919453 100644 --- a/RHEL6/input/checks/accounts_umask_cshrc.xml +++ b/RHEL6/input/checks/accounts_umask_cshrc.xml @@ -24,8 +24,7 @@ - /etc - csh.cshrc + /etc/csh.cshrc ^[\s]*umask[\s]+([^#\s]*) 1 diff --git a/RHEL6/input/checks/accounts_umask_etc_profile.xml b/RHEL6/input/checks/accounts_umask_etc_profile.xml index c7e753e..18e1226 100644 --- a/RHEL6/input/checks/accounts_umask_etc_profile.xml +++ b/RHEL6/input/checks/accounts_umask_etc_profile.xml @@ -28,8 +28,7 @@ - /etc - profile + /etc/profile ^[\s]*umask[\s]+([^#\s]*) 1 diff --git a/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh b/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh new file mode 100644 index 0000000..38e969a --- /dev/null +++ b/RHEL6/input/fixes/bash/accounts_umask_etc_profile.sh @@ -0,0 +1,8 @@ +source ./templates/support.sh +populate var_accounts_user_umask + +grep -q umask /etc/profile && \ + sed -i "s/umask.*/umask $var_accounts_user_umask/g" /etc/profile +if ! [ $? -eq 0 ]; then + echo "umask $var_accounts_user_umask" >> /etc/profile +fi diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 05966f0..171f701 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -91,7 +91,7 @@ + + diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml index 9f05e6e..d815897 100644 --- a/RHEL6/input/profiles/test.xml +++ b/RHEL6/input/profiles/test.xml @@ -45,7 +45,7 @@ - + diff --git a/RHEL6/input/system/accounts/session.xml b/RHEL6/input/system/accounts/session.xml index 069d8b1..3d2574f 100644 --- a/RHEL6/input/system/accounts/session.xml +++ b/RHEL6/input/system/accounts/session.xml @@ -255,7 +255,7 @@ umask 077 - + Ensure the Default Umask is Set Correctly in /etc/profile To ensure the default umask controlled by /etc/profile is set properly, -- 1.7.1