On 7/31/15 2:51 PM, Gabe Alford wrote:
Do you happen to generate and/or save an HTML report? You can
generate
a report, click on the "Verify that Shared Library Files have
Restrictive Permissions" link which should open a new window, and
check out the "OVAL details" section would should give you a list of
the offending files.
+1. Need to see OVAL results to evaluate what files are being
detected.
For reference, the underlying OVAL code looks like this:
(from shared/oval/file_permissions_library_dirs.xml)
<unix:file_object comment="library directories"
id="object_file_permissions_lib_dir" version="1">
<!-- Check that /lib, /lib64, /usr/lib, /usr/lib64 directories
have safe permissions (go-w) -->
<unix:path operation="pattern
match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
<unix:filename xsi:nil="true" />
<filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">perms_state_symlink</filter>
</unix:file_object>
<unix:file_object comment="library files"
id="object_file_permissions_lib_files" version="1">
<!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64
directories have safe permissions (go-w) -->
<unix:path operation="pattern
match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
<filter
action="include">state_perms_nogroupwrite_noworldwrite</filter>
<filter action="exclude">perms_state_symlink</filter>
</unix:file_object>
<unix:file_state id="state_perms_nogroupwrite_noworldwrite"
version="1" operator="OR">
<unix:gwrite datatype="boolean">true</unix:gwrite>
<unix:owrite datatype="boolean">true</unix:owrite>
</unix:file_state>
<unix:file_state id="perms_state_symlink" version="1">
<unix:type operation="equals">symbolic link</unix:type>
</unix:file_state>
symbolic links are being specifically excluded from /var/{lib lib64} and
/{lib lib64}. Files that aren't symlinks are being evaluated for no
group write and no world write.