>From d3a7e6309bcad3e5e3607eedab0b6dbf67078f7d Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 28 Sep 2013 14:07:16 -0400 Subject: [PATCH 3/8] Updated kernel_module_disabled OVAL template - RHEL6 supports *both* /etc/modprobe.conf and /etc/modprob.d, updated check to scan via OR operator - Frank Caviggia called out that while prose calls for /bin/false, /bin/true is equally acceptable. Updated OVAL to pass on either condition, as both meet the intent of the check. Thanks, Frank! TESTING:[root@SSG-RHEL6 templates]# cat /etc/modprobe.d/cramfs.conf install cramfs /bin/tru [root@SSG-RHEL6 templates]# ../testcheck.py output/kernel_module_cramfs_disabled.xml Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabled0Zx73B.xml Writing results to : /tmp/kernel_module_cramfs_disabled0Zx73B.xml-results Definition oval:scap-security-guide.testing:def:100: false Evaluation done. [root@SSG-RHEL6 templates]# echo "install cramfs /bin/true" > /etc/modprobe.d/cramfs.conf ; ../testcheck.py output/kernel_module_cramfs_disabled.xml Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabledIV6_JJ.xml Writing results to : /tmp/kernel_module_cramfs_disabledIV6_JJ.xml-results Definition oval:scap-security-guide.testing:def:100: true Evaluation done. [root@SSG-RHEL6 templates]# echo "install cramfs /bin/false" > /etc/modprobe.d/cramfs.conf ; ../testcheck.py output/kernel_module_cramfs_disabled.xml Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabledWfOEk7.xml Writing results to : /tmp/kernel_module_cramfs_disabledWfOEk7.xml-results Definition oval:scap-security-guide.testing:def:100: true Evaluation done. [root@SSG-RHEL6 templates]# echo "" > /etc/modprobe.d/cramfs.conf ; ../testcheck.py output/kernel_module_cramfs_disabled.xml Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabledlou7nh.xml Writing results to : /tmp/kernel_module_cramfs_disabledlou7nh.xml-results Definition oval:scap-security-guide.testing:def:100: false Evaluation done. [root@SSG-RHEL6 templates]# vim /etc/modprobe.conf [root@SSG-RHEL6 templates]# echo "install cramfs /bin/true" > /etc/modprobe.conf ; ../testcheck.py output/kernel_module_cramfs_disabled.xml Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabled8K27PN.xml Writing results to : /tmp/kernel_module_cramfs_disabled8K27PN.xml-results Definition oval:scap-security-guide.testing:def:100: true Evaluation done. [root@SSG-RHEL6 templates]# rm /etc/modprobe.conf ; ../testcheck.py output/kernel_module_cramfs_disabled.xml rm: remove regular file `/etc/modprobe.conf'? y Evaluating with OVAL tempfile : /tmp/kernel_module_cramfs_disabledrcM8hz.xml Writing results to : /tmp/kernel_module_cramfs_disabledrcM8hz.xml-results Definition oval:scap-security-guide.testing:def:100: false Evaluation done. --- .../input/checks/kernel_module_cramfs_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_dccp_disabled.xml | 28 +++++++++++++++----- .../checks/kernel_module_freevxfs_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_hfs_disabled.xml | 28 +++++++++++++++----- .../checks/kernel_module_hfsplus_disabled.xml | 28 +++++++++++++++----- .../input/checks/kernel_module_jffs2_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_rds_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_sctp_disabled.xml | 28 +++++++++++++++----- .../checks/kernel_module_squashfs_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_tipc_disabled.xml | 28 +++++++++++++++----- RHEL6/input/checks/kernel_module_udf_disabled.xml | 28 +++++++++++++++----- .../checks/kernel_module_usb-storage_disabled.xml | 28 +++++++++++++++----- .../templates/template_kernel_module_disabled | 28 +++++++++++++++----- 13 files changed, 273 insertions(+), 91 deletions(-) diff --git a/RHEL6/input/checks/kernel_module_cramfs_disabled.xml b/RHEL6/input/checks/kernel_module_cramfs_disabled.xml index c157530..cb2b9bf 100644 --- a/RHEL6/input/checks/kernel_module_cramfs_disabled.xml +++ b/RHEL6/input/checks/kernel_module_cramfs_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module cramfs should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+cramfs\s+/bin/false$ + ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+cramfs\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_dccp_disabled.xml b/RHEL6/input/checks/kernel_module_dccp_disabled.xml index 25654c5..6a51f2a 100644 --- a/RHEL6/input/checks/kernel_module_dccp_disabled.xml +++ b/RHEL6/input/checks/kernel_module_dccp_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module dccp should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+dccp\s+/bin/false$ + ^\s*install\s+dccp\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+dccp\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_freevxfs_disabled.xml b/RHEL6/input/checks/kernel_module_freevxfs_disabled.xml index b87b271..d1e623a 100644 --- a/RHEL6/input/checks/kernel_module_freevxfs_disabled.xml +++ b/RHEL6/input/checks/kernel_module_freevxfs_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module freevxfs should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+freevxfs\s+/bin/false$ + ^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_hfs_disabled.xml b/RHEL6/input/checks/kernel_module_hfs_disabled.xml index 5bd3fc9..ae90879 100644 --- a/RHEL6/input/checks/kernel_module_hfs_disabled.xml +++ b/RHEL6/input/checks/kernel_module_hfs_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module hfs should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+hfs\s+/bin/false$ + ^\s*install\s+hfs\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+hfs\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_hfsplus_disabled.xml b/RHEL6/input/checks/kernel_module_hfsplus_disabled.xml index e541a5c..2d021e6 100644 --- a/RHEL6/input/checks/kernel_module_hfsplus_disabled.xml +++ b/RHEL6/input/checks/kernel_module_hfsplus_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module hfsplus should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+hfsplus\s+/bin/false$ + ^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_jffs2_disabled.xml b/RHEL6/input/checks/kernel_module_jffs2_disabled.xml index 402c527..1150239 100644 --- a/RHEL6/input/checks/kernel_module_jffs2_disabled.xml +++ b/RHEL6/input/checks/kernel_module_jffs2_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module jffs2 should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+jffs2\s+/bin/false$ + ^\s*install\s+jffs2\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+jffs2\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_rds_disabled.xml b/RHEL6/input/checks/kernel_module_rds_disabled.xml index 27294a7..7e7f354 100644 --- a/RHEL6/input/checks/kernel_module_rds_disabled.xml +++ b/RHEL6/input/checks/kernel_module_rds_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module rds should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+rds\s+/bin/false$ + ^\s*install\s+rds\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+rds\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_sctp_disabled.xml b/RHEL6/input/checks/kernel_module_sctp_disabled.xml index 91652ec..8102fde 100644 --- a/RHEL6/input/checks/kernel_module_sctp_disabled.xml +++ b/RHEL6/input/checks/kernel_module_sctp_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module sctp should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+sctp\s+/bin/false$ + ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+sctp\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_squashfs_disabled.xml b/RHEL6/input/checks/kernel_module_squashfs_disabled.xml index c45d710..fe44fa4 100644 --- a/RHEL6/input/checks/kernel_module_squashfs_disabled.xml +++ b/RHEL6/input/checks/kernel_module_squashfs_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module squashfs should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+squashfs\s+/bin/false$ + ^\s*install\s+squashfs\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+squashfs\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_tipc_disabled.xml b/RHEL6/input/checks/kernel_module_tipc_disabled.xml index 23c07e0..2b658c2 100644 --- a/RHEL6/input/checks/kernel_module_tipc_disabled.xml +++ b/RHEL6/input/checks/kernel_module_tipc_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module tipc should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+tipc\s+/bin/false$ + ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+tipc\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_udf_disabled.xml b/RHEL6/input/checks/kernel_module_udf_disabled.xml index bbc717d..796eef6 100644 --- a/RHEL6/input/checks/kernel_module_udf_disabled.xml +++ b/RHEL6/input/checks/kernel_module_udf_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module udf should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+udf\s+/bin/false$ + ^\s*install\s+udf\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+udf\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/kernel_module_usb-storage_disabled.xml b/RHEL6/input/checks/kernel_module_usb-storage_disabled.xml index 46e0c32..a6a87d7 100644 --- a/RHEL6/input/checks/kernel_module_usb-storage_disabled.xml +++ b/RHEL6/input/checks/kernel_module_usb-storage_disabled.xml @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module usb-storage should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+usb-storage\s+/bin/false$ + ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ 1 + diff --git a/RHEL6/input/checks/templates/template_kernel_module_disabled b/RHEL6/input/checks/templates/template_kernel_module_disabled index b183174..084f25a 100644 --- a/RHEL6/input/checks/templates/template_kernel_module_disabled +++ b/RHEL6/input/checks/templates/template_kernel_module_disabled @@ -8,23 +8,37 @@ Red Hat Enterprise Linux 6 The kernel module KERNMODULE should be disabled. - + - - + + + - + + + + + /etc/modprobe.d ^.*\.conf$ - ^\s*install\s+KERNMODULE\s+/bin/false$ + ^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$ + 1 + + + + /etc/modprobe.conf + ^\s*install\s+KERNMODULE\s+(/bin/false|/bin/true)$ 1 + -- 1.7.1