I, along with Robert, assumed that the test was using some sort of find(1)
invocation. It appears not to be, although this OVAL is pretty opaque to me.
When I see the current check failing against my system, I then run a find
command, and the only output is complaints about /proc entries. I then
assumed that this output was why the check was failing.
I can confirm that this check does fail against my system, or at least that
testcheck returns false. The results file points at /.autofsck and
/.readahead_collect, which doesn't make sense at all.
This is one of the more frustrating false positives that I have.
Andrew
On Tue, Jul 23, 2013 at 1:47 PM, Maura Dailey <maura(a)eclipse.ncsc.mil>wrote:
Just an aside, I did some poking around, and it is possible to
eliminate
directories from the search. I looked at the USGCB stuffs and here's what I
put together for file_permissions_unowned.xml in OVAL to eliminate /proc. I
can do the same for the group id version. To add more exclusions, add an
'|' after proc, and type in another directory path. It doesn't seem to care
if you escape the forward slashes, but I left that in just in case the
behavior changes later.
If anyone does figure out how to query PAM or nslcd/nscd for network user
ids, I think you can add it as an extra filter option to the
file_permissions_unowned_object.
Please note, I have not gotten a single failure with this check against
/proc. I get thousands of failures on my workstation, since I have large
git repositories checked out to directories owned by my network account on
the root hard drive.
<def-group>
<definition class="compliance" id="file_permissions_unowned"
version="1">
<metadata>
<title>Find files unowned by a user</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>All files should be owned by a user</description>
</metadata>
<criteria>
<criterion comment="Check all files and make sure they are owned by
a user" test_ref="file_permissions_unowned_test" />
</criteria>
</definition>
<unix:file_state id="file_permissions_unowned_userid_list_match"
version="1">
<unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int" />
</unix:file_state>
<local_variable id="file_permissions_unowned_userid_list"
comment="List
of valid user ids" datatype="int" version="1">
<object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" />
</local_variable>
<ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object" version="1">
<ind:filepath>/etc/passwd</ind:filepath>
<ind:pattern operation="pattern
match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
<ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" />
<unix:filepath operation="pattern
match">^(?!\/proc)/</unix:filepath>
<filter
action="exclude">file_permissions_unowned_userid_list_match</filter>
</unix:file_object>
<unix:file_test check="all" check_existence="none_exist"
comment="Check
user ids on all files on the system" id="file_permissions_unowned_test"
version="1">
<unix:object object_ref="file_permissions_unowned_object" />
</unix:file_test>
</def-group>
- Maura Dailey
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide