Hi Jeffrey,

 

I also dislike the hardcoded list but I really cannot think of another way to implement ‘no suid/sgid outside core system’. Just checking ‘no unpackaged suid/sgid’ doesn’t work for me: I don’t want to trust 3rd party packages and I cannot “push” that trust into our customers for which we integrate and develop RPM packaged solutions.

 

Perhaps this constitutes a different rule, I don’t know.

 

Thanks

 

--

Rui Pedro Bernardino

CTE2/Tecnologias e Desenvolvimento

PT Inovação

 

From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Jeffrey Blank
Sent: domingo, 14 de Julho de 2013 23:04
To: scap-security-guide@lists.fedorahosted.org
Subject: Re: OVAL check for unauthorized suig/sgid files

 

Thanks Rui!  This raises an important question about how to handle setuid/setgid programs. 

 

Your OVAL includes a hardcoded list of setuid/setgid programs included with RHEL.

However, this could change with each update of RHEL, or with every installation of 3rd party software. 

 

A better approach might be (as the text in XCCDF suggests) to see if each setuid or setgid program is included a part of an RPM package.

 

This would address the problems of:

1) installation of unpackaged software

2) admins flipping a setuid bit on a program (accidental or intentional misconfiguration)

 

(The threat of malicious software is not addressed by this check in any form.)

 

Thoughts?

Let me see if I can create OVAL to accomplish that...

 

 

On Mon, Jul 8, 2013 at 10:16 AM, Rui Pedro Bernardino <rui-p-bernardino@ptinovacao.pt> wrote:

Hi,

I found that the 'file_permissions_unauthorized_suid/sgid' checks were too important to always fail, so I picked up Open SCAP's and adapted the check to SSG.

It works for me, hope you find it useful.


Regards

--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação



_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide