Yes, that probably makes sense.
There's certainly room for Rules of both styles.
Until we figure out how to make OVAL do that, we'll stick with your
whitelist.
Also, I added two setuid binaries to the list -- both were from abrt,
and installed by default on my workstation. Hopefully you are okay with
setuids from any package in RHEL.
Thanks,
Jeff
On 07/15/2013 05:34 AM, Rui Pedro Bernardino wrote:
Hi Jeffrey,
I also dislike the hardcoded list but I really cannot think of another
way to implement ‘no suid/sgid outside core system’. Just checking ‘no
unpackaged suid/sgid’ doesn’t work for me: I don’t want to trust 3^rd
party packages and I cannot “push” that trust into our customers for
which we integrate and develop RPM packaged solutions.
Perhaps this constitutes a different rule, I don’t know.
Thanks
--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação
*From:*scap-security-guide-bounces@lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] *On Behalf
Of *Jeffrey Blank
*Sent:* domingo, 14 de Julho de 2013 23:04
*To:* scap-security-guide(a)lists.fedorahosted.org
*Subject:* Re: OVAL check for unauthorized suig/sgid files
Thanks Rui! This raises an important question about how to handle
setuid/setgid programs.
Your OVAL includes a hardcoded list of setuid/setgid programs included
with RHEL.
However, this could change with each update of RHEL, or with every
installation of 3rd party software.
A better approach might be (as the text in XCCDF suggests) to see if
each setuid or setgid program is included a part of an RPM package.
This would address the problems of:
1) installation of unpackaged software
2) admins flipping a setuid bit on a program (accidental or intentional
misconfiguration)
(The threat of malicious software is not addressed by this check in any
form.)
Thoughts?
Let me see if I can create OVAL to accomplish that...
On Mon, Jul 8, 2013 at 10:16 AM, Rui Pedro Bernardino
<rui-p-bernardino(a)ptinovacao.pt <mailto:rui-p-bernardino@ptinovacao.pt>>
wrote:
Hi,
I found that the 'file_permissions_unauthorized_suid/sgid' checks were
too important to always fail, so I picked up Open SCAP's and adapted the
check to SSG.
It works for me, hope you find it useful.
Regards
--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide