I was absolutely doing the 'find' check to see why this item failed, as that was
the guidance I saw listed in the <check-content> tags for both the
no_files_unowned_by_user and no_files_unowned_by_group Rules , which I assumed (perhaps
naively) was actually being done. I started triaging this because the scans run by oscap
with the SSG content were indicating a problem, but Security Blanket (which isn't
using find) were saying all was well. Started digging around to find out why.
-Rob
________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Andrew Gilmore
[agilmore2(a)gmail.com]
Sent: Tuesday, July 23, 2013 4:31 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: Suggestion on the 'Ensure All Files Are Owned...' items
I, along with Robert, assumed that the test was using some sort of find(1) invocation. It
appears not to be, although this OVAL is pretty opaque to me.
When I see the current check failing against my system, I then run a find command, and the
only output is complaints about /proc entries. I then assumed that this output was why the
check was failing.
I can confirm that this check does fail against my system, or at least that testcheck
returns false. The results file points at /.autofsck and /.readahead_collect, which
doesn't make sense at all.
This is one of the more frustrating false positives that I have.
Andrew
On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey
<maura@eclipse.ncsc.mil<mailto:maura@eclipse.ncsc.mil>> wrote:
Just an aside, I did some poking around, and it is possible to eliminate directories from
the search. I looked at the USGCB stuffs and here's what I put together for
file_permissions_unowned.xml in OVAL to eliminate /proc. I can do the same for the group
id version. To add more exclusions, add an '|' after proc, and type in another
directory path. It doesn't seem to care if you escape the forward slashes, but I left
that in just in case the behavior changes later.
If anyone does figure out how to query PAM or nslcd/nscd for network user ids, I think you
can add it as an extra filter option to the file_permissions_unowned_object.
Please note, I have not gotten a single failure with this check against /proc. I get
thousands of failures on my workstation, since I have large git repositories checked out
to directories owned by my network account on the root hard drive.
<def-group>
<definition class="compliance" id="file_permissions_unowned"
version="1">
<metadata>
<title>Find files unowned by a user</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>All files should be owned by a user</description>
</metadata>
<criteria>
<criterion comment="Check all files and make sure they are owned by a
user" test_ref="file_permissions_unowned_test" />
</criteria>
</definition>
<unix:file_state id="file_permissions_unowned_userid_list_match"
version="1">
<unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int" />
</unix:file_state>
<local_variable id="file_permissions_unowned_userid_list"
comment="List of valid user ids" datatype="int"
version="1">
<object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" />
</local_variable>
<ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object" version="1">
<ind:filepath>/etc/passwd</ind:filepath>
<ind:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
<ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />
<unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>
<filter
action="exclude">file_permissions_unowned_userid_list_match</filter>
</unix:file_object>
<unix:file_test check="all" check_existence="none_exist"
comment="Check user ids on all files on the system"
id="file_permissions_unowned_test" version="1">
<unix:object object_ref="file_permissions_unowned_object" />
</unix:file_test>
</def-group>
- Maura Dailey
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide