On 1/15/14, 2:38 PM, Andrew Gilmore wrote:
1) mountopt_noexec_on_removable_partitions exits with error, when
there are no removable partitions configured in fstab
2) file_ownership_library_dirs complains about an /usr/libexec suid
abrt file
I receive the following which causes failures:
<unix-sys:filepath>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</unix-sys:filepath>
Specifically, because it's owned by UID 173:
<unix-sys:group_id datatype="int">173</unix-sys:group_id>
<unix-sys:user_id datatype="int">173</unix-sys:user_id>
$ ll /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
-rwsr-xr-x. 1 abrt abrt 5792 Aug 13 12:10
/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
So, I chown to root and rescan:
[shawn@SSG-RHEL6 checks]$ sudo chown root
/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
[sudo] password for shawn:
[shawn@SSG-RHEL6 checks]$ ./testcheck.py file_ownership_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_library_dirsvMGoUH.xml
Writing results to : /tmp/file_ownership_library_dirsvMGoUH.xml-results
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
If anyone is feeling ambitious, file a bug with Red Hat Customer Service
(customerservice(a)redhat.com) to tell the ABRT to clean up their file
perms ;) Feel free to CC me.
The original failure against abrt seems legitimate though, given
incorrect UID.
3) no_files_unowned_by_* are still broken and looking for any files
in /
Acking Rodney's patch, should be fixed shortly.
4) enable_execshield and sysctl_kernel_randomize_va_space are
failing,
although sysctl shows correct results
Note these checks for runtime and static
configuration settings. Ensure
both are properly set. Able to pass on my local system:
[root@SSG-RHEL6 checks]# ./testcheck.py sysctl_kernel_exec_shield.xml
Evaluating with OVAL tempfile : /tmp/sysctl_kernel_exec_shieldpSQjvh.xml
Writing results to : /tmp/sysctl_kernel_exec_shieldpSQjvh.xml-results
Definition oval:scap-security-guide.testing:def:113: true
Evaluation done.
[root@SSG-RHEL6 checks]# vim sysctl_kernel_exec_shield.xml
[root@SSG-RHEL6 checks]# vim sysctl_kernel_randomize_va_space.xml
[root@SSG-RHEL6 checks]# ./testcheck.py sysctl_kernel_randomize_va_space.xml
Evaluating with OVAL tempfile :
/tmp/sysctl_kernel_randomize_va_spaceuhATnO.xml
Writing results to : /tmp/sysctl_kernel_randomize_va_spaceuhATnO.xml-results
Definition oval:scap-security-guide.testing:def:119: true
Evaluation done.
5) selinux_all_devicefiles_labeled shows errors with the /dev/.udev
directories
Known issue :(
6) enable_gdm_login_banner didn't get the gconf mandatory check
fixed,
although all the rest did (YAY!)
Hmm, you're right. You've patched a few things before.... patches welcome ;)
7) sysctl_ipv6_default_accept_redirects and
service_ip6tables_enabled
fail when ipv6 has been disabled via modprobe.d entries
Like Rodney pointed out...
https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=6a27...
8) install_openswan is obsoleted by libreswan
Currently working offline. Can you open a ticket on this to ensure it
doesn't get lost?
9) audit_file_access does not check for open_by_handle_at, and fails
when the audit rules lines do not contain exactly the content specified.
What rule are you using to meet the requirement?
I was very glad to see almost all of the sysctl and gconf false
positives fixed!
Thanks for the feedback!