The proposed patch replaces rsyslog_files_permissions OVAL unknown test stub
with actual check implementation.
The check:
* first searches /etc/rsyslog.conf for (uncommented) presence of /var/log/*
log files paths and stores these paths into list,
* then selects just file objects (from all the system ones) having path matching
some of the selected ones,
* lastly compares (via file object state) if the permissions are 0600 or stronger.
The change has been tested on both, RHEL-6 & RHEL-7 & seems to work properly
(=>
update the test_attestations, created links & moved the test to shared within
the patch proposal too).
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team