>From d11ffa5b587f3ec35122c7541d8affcf376f880f Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 19 Apr 2013 23:25:16 -0400 Subject: [PATCH 2/2] Request for review - OVAL for file_permissions_library_dirs - unix:file_state trouble I've been staring at this for awhile, and can't figure out why the results constantly return false: [root@rhel6 checks]# chmod -R 755 /lib/ /lib64/ /usr/lib/ /usr/lib64/ /lib/modules/ [root@rhel6 checks]# ./testcheck.py file_permissions_library_dirs.xml Evaluating with OVAL tempfile : /tmp/file_ownership_etc_skelm9KJNG.xml Definition oval:scap-security-guide.testing:def:100: false Evaluation done. Anyone have ideas? --- .../input/checks/file_permissions_library_dirs.xml | 149 ++++++++++++++++++++ RHEL6/input/system/permissions/files.xml | 1 + 2 files changed, 150 insertions(+), 0 deletions(-) create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml b/RHEL6/input/checks/file_permissions_library_dirs.xml new file mode 100644 index 0000000..0cbe682 --- /dev/null +++ b/RHEL6/input/checks/file_permissions_library_dirs.xml @@ -0,0 +1,149 @@ + + + + Verify that Shared Library Files Have Restrictive Permissions + + Red Hat Enterprise Linux 6 + + Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable + or world-writable. + + + + + + + + + + + + + + + + + + + + + + + + + + + + /lib + + state_perms_nogroupwrite_noworldwrite + + + + + /lib + ^.*$ + state_perms_nogroupwrite_noworldwrite + + + + + + + + + + + + + + + /lib64 + + state_perms_nogroupwrite_noworldwrite + + + + + /lib64 + ^.*$ + state_perms_nogroupwrite_noworldwrite + + + + + + + + + + + + + + + /usr/lib + + state_perms_nogroupwrite_noworldwrite + + + + + /usr/lib + ^.*$ + state_perms_nogroupwrite_noworldwrite + + + + + + + + + + + + + + + /usr/lib64 + + state_perms_nogroupwrite_noworldwrite + + + + + /usr/lib64 + ^.*$ + state_perms_nogroupwrite_noworldwrite + + + + + + + + + + + + + + + /lib/modules + + state_perms_nogroupwrite_noworldwrite + + + + + /lib/modules + ^.*$ + state_perms_nogroupwrite_noworldwrite + + + + true + true + + diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml index 21af4ea..1085fce 100644 --- a/RHEL6/input/system/permissions/files.xml +++ b/RHEL6/input/system/permissions/files.xml @@ -216,6 +216,7 @@ runtime. Restrictive permissions are necessary to protect the integrity of the s + -- 1.7.1