The current check that's checked into git is broken. The
permissions_ungroupowned.xml check is searching the local file system
for things with group_id set to 0 and negating the result of the check.
That's all it's doing. The permissions_unowned.xml check was doing the
same thing, but with user_ids set to 0. I feel like it was guaranteed to
fail.
On 07/23/2013 04:31 PM, Andrew Gilmore wrote:
I, along with Robert, assumed that the test was using some sort of
find(1) invocation. It appears not to be, although this OVAL is pretty
opaque to me.
When I see the current check failing against my system, I then run a
find command, and the only output is complaints about /proc entries. I
then assumed that this output was why the check was failing.
I can confirm that this check does fail against my system, or at least
that testcheck returns false. The results file points at /.autofsck
and /.readahead_collect, which doesn't make sense at all.
This is one of the more frustrating false positives that I have.
Andrew
On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey <maura(a)eclipse.ncsc.mil
<mailto:maura@eclipse.ncsc.mil>> wrote:
Just an aside, I did some poking around, and it is possible to
eliminate directories from the search. I looked at the USGCB
stuffs and here's what I put together for
file_permissions_unowned.xml in OVAL to eliminate /proc. I can do
the same for the group id version. To add more exclusions, add an
'|' after proc, and type in another directory path. It doesn't
seem to care if you escape the forward slashes, but I left that in
just in case the behavior changes later.
If anyone does figure out how to query PAM or nslcd/nscd for
network user ids, I think you can add it as an extra filter option
to the file_permissions_unowned_object.
Please note, I have not gotten a single failure with this check
against /proc. I get thousands of failures on my workstation,
since I have large git repositories checked out to directories
owned by my network account on the root hard drive.
|<def-group>||
|| <definition class="compliance"
id="file_permissions_unowned"
version="1">||
|| <metadata>||
|| <title>Find files unowned by a user</title>||
|| <affected family="unix">||
|| <platform>Red Hat Enterprise Linux 6</platform>||
|| </affected>||
|| <description>All files should be owned by a
user</description>||
|| </metadata>||
|| <criteria>||
|| <criterion comment="Check all files and make sure they are
owned by a user" test_ref="file_permissions_unowned_test" />||
|| </criteria>||
|| </definition>||
||
|| <unix:file_state
id="file_permissions_unowned_userid_list_match"
version="1">||
|| <unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int"
/>||
|| </unix:file_state>||
||
|| <local_variable id="file_permissions_unowned_userid_list"
comment="List of valid user ids" datatype="int"
version="1">||
|| <object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" />||
|| </local_variable>||
||
|| <ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object"
version="1">||
||<ind:filepath>/etc/passwd</ind:filepath>||
|| <ind:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>||
|| <ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>||
|| </ind:textfilecontent54_object>||
||
|| <unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1">||
|| <unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />||
|| <unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>||
|| <filter
action="exclude">file_permissions_unowned_userid_list_match</filter>||
|| </unix:file_object>||
||
|| <unix:file_test check="all" check_existence="none_exist"
comment="Check user ids on all files on the system"
id="file_permissions_unowned_test" version="1">||
|| <unix:object object_ref="file_permissions_unowned_object" />||
|| </unix:file_test>||
||</def-group>|
- Maura Dailey
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide