>From 89c957f6eb8ce52e17dcc3589fc88b0ed42f66bc Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 27 Dec 2013 02:59:15 -0500 Subject: [PATCH 29/31] Renamed XCCDF audit_logs_permissions to file_permissions_var_log_audit, added to shared/ - Renamed XCCDF rule to align with fileperm template - Tested on RHEL7, updated CPE, moved to shared/, created symlinks --- RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- .../checks/file_permissions_var_log_audit.xml | 37 +--------------------- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL/6/input/profiles/rht-ccp.xml | 2 +- RHEL/6/input/system/auditing.xml | 2 +- RHEL/7/input/auxiliary/stig_overlay.xml | 2 +- .../checks/file_permissions_var_log_audit.xml | 1 + RHEL/7/input/profiles/rht-ccp.xml | 2 +- RHEL/7/input/system/auditing.xml | 2 +- shared/oval/file_permissions_var_log_audit.xml | 37 ++++++++++++++++++++++ 13 files changed, 49 insertions(+), 46 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/file_permissions_var_log_audit.xml create mode 120000 RHEL/7/input/checks/file_permissions_var_log_audit.xml create mode 100644 shared/oval/file_permissions_var_log_audit.xml diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml index ff2e42c..0186138 100644 --- a/RHEL/6/input/auxiliary/stig_overlay.xml +++ b/RHEL/6/input/auxiliary/stig_overlay.xml @@ -1053,7 +1053,7 @@ The operating system must use internal system clocks to generate time stamps for audit records. - + Audit log files must have mode 0640 or less permissive. diff --git a/RHEL/6/input/checks/file_permissions_var_log_audit.xml b/RHEL/6/input/checks/file_permissions_var_log_audit.xml deleted file mode 100644 index fae4702..0000000 --- a/RHEL/6/input/checks/file_permissions_var_log_audit.xml +++ /dev/null @@ -1,36 +0,0 @@ - - - - Verify /var/log/audit Permissions - - Red Hat Enterprise Linux 6 - - Checks for correct permissions for all log files in /var/log/audit. - - - - - - - - - - - - /var/log/audit - ^.*$ - state_not_mode_0640 - - - - true - true - true - true - true - true - true - true - true - - diff --git a/RHEL/6/input/checks/file_permissions_var_log_audit.xml b/RHEL/6/input/checks/file_permissions_var_log_audit.xml new file mode 120000 index 0000000..ac79299 --- /dev/null +++ b/RHEL/6/input/checks/file_permissions_var_log_audit.xml @@ -0,0 +1 @@ +../../../../shared/oval/file_permissions_var_log_audit.xml \ No newline at end of file diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml index 1486b0a..ad0ee18 100644 --- a/RHEL/6/input/profiles/CS2.xml +++ b/RHEL/6/input/profiles/CS2.xml @@ -136,7 +136,7 @@ + diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml index 55e2830..07cfd51 100644 --- a/RHEL/6/input/profiles/common.xml +++ b/RHEL/6/input/profiles/common.xml @@ -45,7 +45,7 @@ - diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml index 1b68a8f..07e9ba9 100644 --- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml @@ -64,7 +64,7 @@ + diff --git a/RHEL/6/input/profiles/nist-CL-IL-AL.xml b/RHEL/6/input/profiles/nist-CL-IL-AL.xml index b8c4e10..06d2c69 100644 --- a/RHEL/6/input/profiles/nist-CL-IL-AL.xml +++ b/RHEL/6/input/profiles/nist-CL-IL-AL.xml @@ -131,7 +131,7 @@ assurance." + diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml index 495fdb2..69fbb25 100644 --- a/RHEL/6/input/profiles/rht-ccp.xml +++ b/RHEL/6/input/profiles/rht-ccp.xml @@ -83,7 +83,7 @@ + diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml index 2777db1..6ab1527 100644 --- a/RHEL/6/input/system/auditing.xml +++ b/RHEL/6/input/system/auditing.xml @@ -675,7 +675,7 @@ audited. - + System Audit Logs Must Have Mode 0640 or Less Permissive Change the mode of the audit log files with the following command: diff --git a/RHEL/7/input/auxiliary/stig_overlay.xml b/RHEL/7/input/auxiliary/stig_overlay.xml index ca6bf57..39180cb 100644 --- a/RHEL/7/input/auxiliary/stig_overlay.xml +++ b/RHEL/7/input/auxiliary/stig_overlay.xml @@ -1053,7 +1053,7 @@ The operating system must use internal system clocks to generate time stamps for audit records. - + Audit log files must have mode 0640 or less permissive. diff --git a/RHEL/7/input/checks/file_permissions_var_log_audit.xml b/RHEL/7/input/checks/file_permissions_var_log_audit.xml new file mode 120000 index 0000000..ac79299 --- /dev/null +++ b/RHEL/7/input/checks/file_permissions_var_log_audit.xml @@ -0,0 +1 @@ +../../../../shared/oval/file_permissions_var_log_audit.xml \ No newline at end of file diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml index 5624d98..9a58d05 100644 --- a/RHEL/7/input/profiles/rht-ccp.xml +++ b/RHEL/7/input/profiles/rht-ccp.xml @@ -82,7 +82,7 @@ FILE PERMISSION CHECKS + diff --git a/RHEL/7/input/system/auditing.xml b/RHEL/7/input/system/auditing.xml index 355c7ef..9711628 100644 --- a/RHEL/7/input/system/auditing.xml +++ b/RHEL/7/input/system/auditing.xml @@ -675,7 +675,7 @@ audited. - + System Audit Logs Must Have Mode 0640 or Less Permissive Change the mode of the audit log files with the following command: diff --git a/shared/oval/file_permissions_var_log_audit.xml b/shared/oval/file_permissions_var_log_audit.xml new file mode 100644 index 0000000..a35ca2f --- /dev/null +++ b/shared/oval/file_permissions_var_log_audit.xml @@ -0,0 +1,37 @@ + + + + Verify /var/log/audit Permissions + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + Checks for correct permissions for all log files in /var/log/audit. + + + + + + + + + + + + /var/log/audit + ^.*$ + state_not_mode_0640 + + + + true + true + true + true + true + true + true + true + true + + -- 1.8.3.1