I think some of these ids were leftover from the USGCB for RHEL 5. In any case, I've replaced them with human readable ones, which should make them easier to read for future editors.
- Maura Dailey
Maura Dailey (1): Small patch to replace autogenerated test, state, and object ids with human readable ones
.../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- .../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)
diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml index 36a02cf..478ee73 100644 --- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml +++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml @@ -1,60 +1,41 @@ <def-group> - <definition class="compliance" - id="accounts_root_path_dirs_no_write" version="1"> + <definition class="compliance" id="accounts_root_path_dirs_no_write" version="1"> <metadata> - <title>Write permissions are disabled for group and other in - all directories in Root's Path</title> + <title>Write permissions are disabled for group and other in all directories in Root's Path</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Check each directory in root's path and make use - it does not grant write permission to group and - other</description> + <description>Check each directory in root's path and make use it does not grant write permission to group and other</description> </metadata> - <criteria comment="Check that write permission to group and other in root's path is denied" - negate="true" operator="OR"> - <criterion comment="Check for write permission to group in root's path" - test_ref="test_2008551" /> - <criterion comment="Check for write permission to other in root's path" - test_ref="test_2008552" /> + <criteria comment="Check that write permission to group and other in root's path is denied" negate="true" operator="OR"> + <criterion comment="Check for write permission to group in root's path" test_ref="test_accounts_root_path_dirs_no_write_group" /> + <criterion comment="Check for write permission to other in root's path" test_ref="test_accounts_root_path_dirs_no_write_other" /> </criteria> </definition> - <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008551" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008551" /> + <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to group in root's path is denied" id="test_accounts_root_path_dirs_no_write_group" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_group" /> </unix:file_test> - <unix:file_state comment="Group has write privilege" - id="state_2008551" version="1"> + <unix:file_state comment="Group has write privilege" id="state_accounts_root_path_dirs_no_write_group" version="1"> <unix:gwrite datatype="boolean">1</unix:gwrite> </unix:file_state> - <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - comment="root's PATH" id="obj_200855" - version="1"> - <unix:path var_ref="var_200855" /> + <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" comment="root's PATH" id="object_accounts_root_path_dirs_no_write" version="1"> + <unix:path var_ref="var_accounts_root_path_dirs_no_write" /> <unix:filename xsi:nil="true" /> </unix:file_object> - <local_variable comment="Split the PATH on the : delimiter" - datatype="string" id="var_200855" - version="1"> + <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="var_accounts_root_path_dirs_no_write" version="1"> <split delimiter=":"> - <object_component item_field="value" - object_ref="obj_20085" /> + <object_component item_field="value" object_ref="object_accounts_root_path_dirs_no_write_pathenv" /> </split> </local_variable> - <ind:environmentvariable_object id="obj_20085" - version="1"> + <ind:environmentvariable_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1"> ind:namePATH</ind:name> </ind:environmentvariable_object> - <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008552" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008552" /> + <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to other in root's path is denied" id="test_accounts_root_path_dirs_no_write_other" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_other" /> </unix:file_test> - <unix:file_state comment="Other has write privilege" - id="state_2008552" version="1"> + <unix:file_state comment="Other has write privilege" id="state_accounts_root_path_dirs_no_write_other" version="1"> <unix:owrite datatype="boolean">1</unix:owrite> </unix:file_state> </def-group> diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml index a2079f9..22ed337 100644 --- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml +++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml @@ -1,27 +1,20 @@ <def-group> - <definition class="compliance" - id="core_dump_suid_progs_limits_conf" version="1"> + <definition class="compliance" id="core_dump_suid_progs_limits_conf" version="1"> <metadata> <title>Disable Core Dumps for setuid programs</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Core dumps for setuid programs should be - disabled</description> + <description>Core dumps for setuid programs should be disabled</description> </metadata> <criteria> - <criterion comment="Are core dumps for setuid programs disabled?" - test_ref="test_20056" /> + <criterion comment="Are core dumps for setuid programs disabled?" test_ref="test_core_dump_suid_progs_limits_conf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" - comment="Tests the value of the ^[\s]*fs.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" - id="test_20056" version="2"> - <ind:object object_ref="obj_20056" /> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the ^[\s]*fs.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" id="test_core_dump_suid_progs_limits_conf" version="2"> + <ind:object object_ref="object_core_dump_suid_progs_limits_conf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20056" - version="1"> + <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf" version="1"> ind:path/etc/security</ind:path> ind:filenamelimits.conf</ind:filename> <ind:pattern operation="pattern match">^fs.suid_dumpable\s+=\s+1$</ind:pattern> diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml b/RHEL6/input/checks/core_dumps_limitsconf.xml index cb86b30..9583361 100644 --- a/RHEL6/input/checks/core_dumps_limitsconf.xml +++ b/RHEL6/input/checks/core_dumps_limitsconf.xml @@ -1,31 +1,24 @@ <def-group> - <definition class="compliance" - id="core_dumps_limitsconf" version="1"> + <definition class="compliance" id="core_dumps_limitsconf" version="1"> <metadata> <title>Disable Core Dumps</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Core dumps for all users should be - disabled</description> + <description>Core dumps for all users should be disabled</description> </metadata> <criteria> - <criterion comment="Are core dumps disabled" - test_ref="test_20055" /> + <criterion comment="Are core dumps disabled" test_ref="test_core_dumps_limitsconf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - comment="Tests the value of the ^[\s]**[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" - id="test_20055" version="1"> - <ind:object object_ref="obj_20055" /> - <ind:state state_ref="state_20055" /> + <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]**[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="test_core_dumps_limitsconf" version="1"> + <ind:object object_ref="object_core_dumps_limitsconf" /> + <ind:state state_ref="state_core_dumps_limitsconf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20055" - version="1"> + <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1"> <ind:subexpression operation="equals">0</ind:subexpression> </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20055" - version="1"> + <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1"> ind:path/etc/security</ind:path> ind:filenamelimits.conf</ind:filename> <ind:pattern operation="pattern match">^[\s]**[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern> diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml b/RHEL6/input/checks/file_groupowner_etc_group.xml index eb61289..8fdc923 100644 --- a/RHEL6/input/checks/file_groupowner_etc_group.xml +++ b/RHEL6/input/checks/file_groupowner_etc_group.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_group" version="1"> + <definition class="compliance" id="file_groupowner_etc_group" version="1"> <metadata> <title>Verify group who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate group.</description> + <description>The /etc/group file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20037" /> + <criterion test_ref="test_file_groupowner_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership" - id="test_20037" version="1"> - <unix:object object_ref="obj_20009" /> - <unix:state state_ref="state_20037" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership" id="test_file_groupowner_etc_group" version="1"> + <unix:object object_ref="object_file_groupowner_etc_group" /> + <unix:state state_ref="state_file_groupowner_etc_group" /> </unix:file_test> - <unix:file_state id="state_20037" - version="1"> + <unix:file_state id="state_file_groupowner_etc_group" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20009" version="1"> + <unix:file_object comment="/etc/group" id="object_file_groupowner_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml index 7ee2921..139f551 100644 --- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_gshadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_gshadow" version="1"> <metadata> <title>Verify group who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate group.</description> + <description>The /etc/gshadow file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20039" /> + <criterion test_ref="test_file_groupowner_etc_gshadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20039" version="1"> - <unix:object object_ref="obj_20013" /> - <unix:state state_ref="state_20039" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_groupowner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_gshadow" /> + <unix:state state_ref="state_file_groupowner_etc_gshadow" /> </unix:file_test> - <unix:file_state id="state_20039" - version="1"> + <unix:file_state id="state_file_groupowner_etc_gshadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/gshadow" - id="obj_20013" version="1"> + <unix:file_object comment="/etc/gshadow" id="object_file_groupowner_etc_gshadow" version="1"> unix:path/etc</unix:path> unix:filenamegshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml b/RHEL6/input/checks/file_groupowner_etc_passwd.xml index d47e9bc..269bf48 100644 --- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml +++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_passwd" version="1"> + <definition class="compliance" id="file_groupowner_etc_passwd" version="1"> <metadata> <title>Verify group who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate group.</description> + <description>The /etc/passwd file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20041" /> + <criterion test_ref="test_file_groupowner_etc_passwd" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership of /etc/passwd" - id="test_20041" version="1"> - <unix:object object_ref="obj_20018" /> - <unix:state state_ref="state_20041" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="test_file_groupowner_etc_passwd" version="1"> + <unix:object object_ref="object_file_groupowner_etc_passwd" /> + <unix:state state_ref="state_file_groupowner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20041" - version="1"> + <unix:file_state id="state_file_groupowner_etc_passwd" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/passwd" - id="obj_20018" version="1"> + <unix:file_object comment="/etc/passwd" id="object_file_groupowner_etc_passwd" version="1"> unix:path/etc</unix:path> unix:filenamepasswd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml b/RHEL6/input/checks/file_groupowner_etc_shadow.xml index 4127177..21c2a10 100644 --- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_shadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_shadow" version="1"> <metadata> <title>Verify group who owns 'shadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/shadow file should be owned by the - appropriate group.</description> + <description>The /etc/shadow file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20035" /> + <criterion test_ref="test_groupowner_etc_shadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership /etc/shadow" - id="test_20035" version="1"> - <unix:object object_ref="obj_20008" /> - <unix:state state_ref="state_20035" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="test_groupowner_etc_shadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_shadow" /> + <unix:state state_ref="state_file_groupowner_etc_shadow" /> </unix:file_test> - <unix:file_state id="state_20035" - version="1"> + <unix:file_state id="state_file_groupowner_etc_shadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/shadow" - id="obj_20008" version="1"> + <unix:file_object comment="/etc/shadow" id="object_file_groupowner_etc_shadow" version="1"> unix:path/etc</unix:path> unix:filenameshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_group.xml b/RHEL6/input/checks/file_owner_etc_group.xml index de3de67..002cd57 100644 --- a/RHEL6/input/checks/file_owner_etc_group.xml +++ b/RHEL6/input/checks/file_owner_etc_group.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_group" version="1"> + <definition class="compliance" id="file_owner_etc_group" version="1"> <metadata> <title>Verify user who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate user.</description> + <description>The /etc/group file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20036" /> + <criterion test_ref="test_file_owner_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20036" version="1"> - <unix:object object_ref="obj_20036" /> - <unix:state state_ref="state_20036" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_group" version="1"> + <unix:object object_ref="object_file_owner_etc_group" /> + <unix:state state_ref="state_file_owner_etc_group" /> </unix:file_test> - <unix:file_state id="state_20036" - version="1"> + <unix:file_state id="state_file_owner_etc_group" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20036" version="1"> + <unix:file_object comment="/etc/group" id="object_file_owner_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml b/RHEL6/input/checks/file_owner_etc_gshadow.xml index eb02df1..b9b09f5 100644 --- a/RHEL6/input/checks/file_owner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_gshadow" version="1"> + <definition class="compliance" id="file_owner_etc_gshadow" version="1"> <metadata> <title>Verify user who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate user.</description> + <description>The /etc/gshadow file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20038" /> + <criterion test_ref="test_file_owner_etc_gshadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20038" version="1"> - <unix:object object_ref="obj_20017" /> - <unix:state state_ref="state_20038" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_owner_etc_gshadow" /> + <unix:state state_ref="state_file_owner_etc_gshadow" /> </unix:file_test> - <unix:file_state id="state_20038" - version="1"> + <unix:file_state id="state_file_owner_etc_gshadow" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/gshadow" - id="obj_20017" version="1"> + <unix:file_object comment="/etc/gshadow" id="object_file_owner_etc_gshadow" version="1"> unix:path/etc</unix:path> unix:filenamegshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml b/RHEL6/input/checks/file_owner_etc_passwd.xml index 73e9899..139fb95 100644 --- a/RHEL6/input/checks/file_owner_etc_passwd.xml +++ b/RHEL6/input/checks/file_owner_etc_passwd.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_passwd" version="1"> + <definition class="compliance" id="file_owner_etc_passwd" version="1"> <metadata> <title>Verify user who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate user.</description> + <description>The /etc/passwd file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20040" /> + <criterion test_ref="test_file_owner_etc_passwd" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20040" version="1"> - <unix:object object_ref="obj_20040" /> - <unix:state state_ref="state_20040" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_passwd" version="1"> + <unix:object object_ref="object_file_owner_etc_passwd" /> + <unix:state state_ref="state_file_owner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20040" - version="1"> + <unix:file_state id="state_file_owner_etc_passwd" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/passwd" - id="obj_20040" version="1"> + <unix:file_object comment="/etc/passwd" id="object_file_owner_etc_passwd" version="1"> unix:path/etc</unix:path> unix:filenamepasswd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml b/RHEL6/input/checks/file_permissions_etc_group.xml index 774c5d9..5cabfe7 100644 --- a/RHEL6/input/checks/file_permissions_etc_group.xml +++ b/RHEL6/input/checks/file_permissions_etc_group.xml @@ -1,26 +1,21 @@ <def-group> - <definition class="compliance" - id="file_permissions_etc_group" version="1"> + <definition class="compliance" id="file_permissions_etc_group" version="1"> <metadata> <title>Verify permissions on 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>File permissions for /etc/group should be set - correctly.</description> + <description>File permissions for /etc/group should be set correctly.</description> </metadata> <criteria> - <criterion test_ref="test_20043" /> + <criterion test_ref="test_file_permissions_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing /etc/group permissions" - id="test_20043" version="1"> - <unix:object object_ref="obj_20012" /> - <unix:state state_ref="state_1000645" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="test_file_permissions_etc_group" version="1"> + <unix:object object_ref="object_file_permissions_etc_group" /> + <unix:state state_ref="state_file_permissions_etc_group" /> </unix:file_test> - <unix:file_state id="state_1000645" - version="1"> + <unix:file_state id="state_file_permissions_etc_group" version="1"> <unix:uread datatype="boolean">true</unix:uread> <unix:uwrite datatype="boolean">true</unix:uwrite> <unix:uexec datatype="boolean">false</unix:uexec> @@ -31,8 +26,7 @@ <unix:owrite datatype="boolean">false</unix:owrite> <unix:oexec datatype="boolean">false</unix:oexec> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20012" version="1"> + <unix:file_object comment="/etc/group" id="object_file_permissions_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml b/RHEL6/input/checks/file_permissions_ungroupowned.xml index 5bc34f7..c6dcb8c 100644 --- a/RHEL6/input/checks/file_permissions_ungroupowned.xml +++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml @@ -1,36 +1,27 @@ <def-group> - <definition class="compliance" - id="file_permissions_ungroupowned" version="1"> + <definition class="compliance" id="file_permissions_ungroupowned" version="1"> <metadata> <title>Find files unowned by a group</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - group</description> + <description>All files should be owned by a group</description> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a group" - negate="true" - test_ref="test_20051" /> + <criterion comment="Check all files and make sure they are owned by a group" negate="true" test_ref="test_file_permissions_ungroupowned" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no group owner" - id="test_20051" version="1"> + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="files with no group owner" id="test_file_permissions_ungroupowned" version="1"> <notes> - <note>This will enumerate all files on local - partitions</note> + <note>This will enumerate all files on local partitions</note> </notes> - <unix:object object_ref="obj_20025" /> - <unix:state state_ref="state_20051" /> + <unix:object object_ref="object_file_permissions_ungroupowned" /> + <unix:state state_ref="state_file_permissions_ungroupowned" /> </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20051" version="1"> + <unix:file_state comment="Executables with suid set" id="state_file_permissions_ungroupowned" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20025" version="1"> + <unix:file_object comment="all local files" id="object_file_permissions_ungroupowned" version="1"> <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> unix:path/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml index 7f8ddd8..439baa0 100644 --- a/RHEL6/input/checks/interactive_boot_disable.xml +++ b/RHEL6/input/checks/interactive_boot_disable.xml @@ -1,26 +1,20 @@ <def-group> - <definition class="compliance" - id="interactive_boot_disable" version="1"> + <definition class="compliance" id="interactive_boot_disable" version="1"> <metadata> <title>Disable Interactive Boot</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The ability for users to perform interactive - startups should be disabled.</description> + <description>The ability for users to perform interactive startups should be disabled.</description> </metadata> <criteria> - <criterion test_ref="test_20097" /> + <criterion test_ref="test_interactive_boot_disable" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" - id="test_20097" version="1"> - <ind:object object_ref="obj_20096" /> + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" id="test_interactive_boot_disable" version="1"> + <ind:object object_ref="object_interactive_boot_disable" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20096" - version="1"> + <ind:textfilecontent54_object id="object_interactive_boot_disable" version="1"> ind:path/etc/sysconfig</ind:path> ind:filenameinit</ind:filename> <ind:pattern operation="pattern match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern>
On 8/6/13 12:58 PM, Maura Dailey wrote:
I think some of these ids were leftover from the USGCB for RHEL 5. In any case, I've replaced them with human readable ones, which should make them easier to read for future editors.
- Maura Dailey
Maura Dailey (1): Small patch to replace autogenerated test, state, and object ids with human readable ones
.../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)
THANK YOU!! Those names have been really annoying.
The ~80 char lines are admittedly nice though, especially for those of us without your dual 42" monitors ;) Any chance the patch could be updated to retain line breaks?
I'll try running xmltidy on the file and see what happens.
- Maura Dailey
On 08/06/2013 01:08 PM, Shawn Wells wrote:
On 8/6/13 12:58 PM, Maura Dailey wrote:
I think some of these ids were leftover from the USGCB for RHEL 5. In any case, I've replaced them with human readable ones, which should make them easier to read for future editors.
- Maura Dailey
Maura Dailey (1): Small patch to replace autogenerated test, state, and object ids with human readable ones
.../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)
THANK YOU!! Those names have been really annoying.
The ~80 char lines are admittedly nice though, especially for those of us without your dual 42" monitors ;) Any chance the patch could be updated to retain line breaks? _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
New patch created by running the following command:
tidy -xml -w 80 -i filename.xml > filename.xml.new
Patch is attached.
- Maura Dailey
On 8/6/13 1:54 PM, Maura Dailey wrote:
New patch created by running the following command:
tidy -xml -w 80 -i filename.xml > filename.xml.new
Patch is attached.
- Maura Dailey
0001-Small-patch-to-replace-autogenerated-test-state-and-.patch
From 499d1cab2e0c290869185fea3f8a22cd359edbb4 Mon Sep 17 00:00:00 2001 From: Maura Daileymaura@eclipse.ncsc.mil Date: Tue, 6 Aug 2013 13:52:36 -0400 Subject: [PATCH] Small patch to replace autogenerated test, state, and object ids with human readable ones (now with 80 character line breaks)
Signed-off-by: Maura Daileymaura@eclipse.ncsc.mil
.../checks/accounts_root_path_dirs_no_write.xml | 50 +++++++++---------- .../checks/core_dump_suid_progs_limits_conf.xml | 18 ++++---- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 ++++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 24 ++++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 ++++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 20 ++++---- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 ++++----- RHEL6/input/checks/file_owner_etc_group.xml | 23 ++++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 24 ++++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 23 ++++----- RHEL6/input/checks/file_permissions_etc_group.xml | 20 ++++---- .../input/checks/file_permissions_ungroupowned.xml | 26 +++++------ RHEL6/input/checks/interactive_boot_disable.xml | 21 ++++---- 13 files changed, 145 insertions(+), 171 deletions(-)
diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml index 36a02cf..d0a20d3 100644 --- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml +++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml @@ -1,60 +1,58 @@
<def-group> - <definition class="compliance" - id="accounts_root_path_dirs_no_write" version="1"> + <definition class="compliance" id="accounts_root_path_dirs_no_write" + version="1"> <metadata> - <title>Write permissions are disabled for group and other in - all directories in Root's Path</title> + <title>Write permissions are disabled for group and other in all + directories in Root's Path</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Check each directory in root's path and make use - it does not grant write permission to group and - other</description> + <description>Check each directory in root's path and make use it does not + grant write permission to group and other</description> </metadata> <criteria comment="Check that write permission to group and other in root's path is denied" negate="true" operator="OR"> <criterion comment="Check for write permission to group in root's path" - test_ref="test_2008551" /> + test_ref="test_accounts_root_path_dirs_no_write_group" /> <criterion comment="Check for write permission to other in root's path" - test_ref="test_2008552" /> + test_ref="test_accounts_root_path_dirs_no_write_other" /> </criteria> </definition> <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008551" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008551" /> + comment="Check that write permission to group in root's path is denied" + id="test_accounts_root_path_dirs_no_write_group" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_group" /> </unix:file_test> <unix:file_state comment="Group has write privilege" - id="state_2008551" version="1"> + id="state_accounts_root_path_dirs_no_write_group" version="1"> <unix:gwrite datatype="boolean">1</unix:gwrite> </unix:file_state> <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - comment="root's PATH" id="obj_200855" + comment="root's PATH" id="object_accounts_root_path_dirs_no_write" version="1"> - <unix:path var_ref="var_200855" /> + <unix:path var_ref="var_accounts_root_path_dirs_no_write" /> <unix:filename xsi:nil="true" /> </unix:file_object> - <local_variable comment="Split the PATH on the : delimiter" - datatype="string" id="var_200855" - version="1"> + <local_variable comment="Split the PATH on the : delimiter" datatype="string" + id="var_accounts_root_path_dirs_no_write" version="1"> <split delimiter=":"> <object_component item_field="value" - object_ref="obj_20085" /> + object_ref="object_accounts_root_path_dirs_no_write_pathenv" /> </split> </local_variable> - <ind:environmentvariable_object id="obj_20085" + <ind:environmentvariable_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1"> <ind:name>PATH</ind:name> </ind:environmentvariable_object> <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008552" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008552" /> + comment="Check that write permission to other in root's path is denied" + id="test_accounts_root_path_dirs_no_write_other" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_other" /> </unix:file_test> <unix:file_state comment="Other has write privilege" - id="state_2008552" version="1"> + id="state_accounts_root_path_dirs_no_write_other" version="1"> <unix:owrite datatype="boolean">1</unix:owrite> </unix:file_state> </def-group> diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml index a2079f9..066957a 100644 --- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml +++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml @@ -1,6 +1,6 @@ <def-group> - <definition class="compliance" - id="core_dump_suid_progs_limits_conf" version="1"> + <definition class="compliance" id="core_dump_suid_progs_limits_conf" + version="1"> <metadata> <title>Disable Core Dumps for setuid programs</title> <affected family="unix"> @@ -11,20 +11,20 @@ </metadata> <criteria> <criterion comment="Are core dumps for setuid programs disabled?" - test_ref="test_20056" /> + test_ref="test_core_dump_suid_progs_limits_conf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" - id="test_20056" version="2"> - <ind:object object_ref="obj_20056" /> + id="test_core_dump_suid_progs_limits_conf" version="2"> + <ind:object object_ref="object_core_dump_suid_progs_limits_conf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20056" + <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf" version="1"> <ind:path>/etc/security</ind:path> <ind:filename>limits.conf</ind:filename> - <ind:pattern operation="pattern match">^fs.suid_dumpable\s+=\s+1$</ind:pattern> + <ind:pattern operation="pattern match"> + ^fs.suid_dumpable\s+=\s+1$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml b/RHEL6/input/checks/core_dumps_limitsconf.xml index cb86b30..4107aae 100644 --- a/RHEL6/input/checks/core_dumps_limitsconf.xml +++ b/RHEL6/input/checks/core_dumps_limitsconf.xml @@ -1,34 +1,31 @@ <def-group> - <definition class="compliance" - id="core_dumps_limitsconf" version="1"> + <definition class="compliance" id="core_dumps_limitsconf" version="1"> <metadata> <title>Disable Core Dumps</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Core dumps for all users should be - disabled</description> + <description>Core dumps for all users should be disabled</description> </metadata> <criteria> <criterion comment="Are core dumps disabled" - test_ref="test_20055" /> + test_ref="test_core_dumps_limitsconf" /> </criteria> </definition> <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" - id="test_20055" version="1"> - <ind:object object_ref="obj_20055" /> - <ind:state state_ref="state_20055" /> + id="test_core_dumps_limitsconf" version="1"> + <ind:object object_ref="object_core_dumps_limitsconf" /> + <ind:state state_ref="state_core_dumps_limitsconf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20055" - version="1"> + <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1"> <ind:subexpression operation="equals">0</ind:subexpression> </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20055" - version="1"> + <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1"> <ind:path>/etc/security</ind:path> <ind:filename>limits.conf</ind:filename> - <ind:pattern operation="pattern match">^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern> + <ind:pattern operation="pattern match"> + ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml b/RHEL6/input/checks/file_groupowner_etc_group.xml index eb61289..67f44cb 100644 --- a/RHEL6/input/checks/file_groupowner_etc_group.xml +++ b/RHEL6/input/checks/file_groupowner_etc_group.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_group" version="1"> + <definition class="compliance" id="file_groupowner_etc_group" version="1"> <metadata> <title>Verify group who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate group.</description> + <description>The /etc/group file should be owned by the appropriate + group.</description> </metadata> <criteria> - <criterion test_ref="test_20037" /> + <criterion test_ref="test_file_groupowner_etc_group" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership" - id="test_20037" version="1"> - <unix:object object_ref="obj_20009" /> - <unix:state state_ref="state_20037" /> - </unix:file_test> - <unix:file_state id="state_20037" + comment="Testing group ownership" id="test_file_groupowner_etc_group" version="1"> + <unix:object object_ref="object_file_groupowner_etc_group" /> + <unix:state state_ref="state_file_groupowner_etc_group" /> + </unix:file_test> + <unix:file_state id="state_file_groupowner_etc_group" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20009" version="1"> + <unix:file_object comment="/etc/group" id="object_file_groupowner_etc_group" + version="1"> <unix:path>/etc</unix:path> <unix:filename>group</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml index 7ee2921..833aa53 100644 --- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_gshadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_gshadow" version="1"> <metadata> <title>Verify group who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate group.</description> + <description>The /etc/gshadow file should be owned by the appropriate + group.</description> </metadata> <criteria> - <criterion test_ref="test_20039" /> + <criterion test_ref="test_file_groupowner_etc_gshadow" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20039" version="1"> - <unix:object object_ref="obj_20013" /> - <unix:state state_ref="state_20039" /> - </unix:file_test> - <unix:file_state id="state_20039" + comment="Testing gshadow ownership" id="test_file_groupowner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_gshadow" /> + <unix:state state_ref="state_file_groupowner_etc_gshadow" /> + </unix:file_test> + <unix:file_state id="state_file_groupowner_etc_gshadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> <unix:file_object comment="/etc/gshadow" - id="obj_20013" version="1"> + id="object_file_groupowner_etc_gshadow" version="1"> <unix:path>/etc</unix:path> <unix:filename>gshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml b/RHEL6/input/checks/file_groupowner_etc_passwd.xml index d47e9bc..5f79132 100644 --- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml +++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_passwd" version="1"> + <definition class="compliance" id="file_groupowner_etc_passwd" version="1"> <metadata> <title>Verify group who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate group.</description> + <description>The /etc/passwd file should be owned by the appropriate + group.</description> </metadata> <criteria> - <criterion test_ref="test_20041" /> + <criterion test_ref="test_file_groupowner_etc_passwd" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" - id="test_20041" version="1"> - <unix:object object_ref="obj_20018" /> - <unix:state state_ref="state_20041" /> + id="test_file_groupowner_etc_passwd" version="1"> + <unix:object object_ref="object_file_groupowner_etc_passwd" /> + <unix:state state_ref="state_file_groupowner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20041" - version="1"> + <unix:file_state id="state_file_groupowner_etc_passwd" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> <unix:file_object comment="/etc/passwd" - id="obj_20018" version="1"> + id="object_file_groupowner_etc_passwd" version="1"> <unix:path>/etc</unix:path> <unix:filename>passwd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml b/RHEL6/input/checks/file_groupowner_etc_shadow.xml index 4127177..953c869 100644 --- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_shadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_shadow" version="1"> <metadata> <title>Verify group who owns 'shadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/shadow file should be owned by the - appropriate group.</description> + <description>The /etc/shadow file should be owned by the appropriate + group.</description> </metadata> <criteria> - <criterion test_ref="test_20035" /> + <criterion test_ref="test_groupowner_etc_shadow" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership /etc/shadow" - id="test_20035" version="1"> - <unix:object object_ref="obj_20008" /> - <unix:state state_ref="state_20035" /> - </unix:file_test> - <unix:file_state id="state_20035" + comment="Testing group ownership /etc/shadow" id="test_groupowner_etc_shadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_shadow" /> + <unix:state state_ref="state_file_groupowner_etc_shadow" /> + </unix:file_test> + <unix:file_state id="state_file_groupowner_etc_shadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> <unix:file_object comment="/etc/shadow" - id="obj_20008" version="1"> + id="object_file_groupowner_etc_shadow" version="1"> <unix:path>/etc</unix:path> <unix:filename>shadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_group.xml b/RHEL6/input/checks/file_owner_etc_group.xml index de3de67..a74ef27 100644 --- a/RHEL6/input/checks/file_owner_etc_group.xml +++ b/RHEL6/input/checks/file_owner_etc_group.xml @@ -1,30 +1,27 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_group" version="1"> + <definition class="compliance" id="file_owner_etc_group" version="1"> <metadata> <title>Verify user who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate user.</description> + <description>The /etc/group file should be owned by the appropriate + user.</description> </metadata> <criteria> - <criterion test_ref="test_20036" /> + <criterion test_ref="test_file_owner_etc_group" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20036" version="1"> - <unix:object object_ref="obj_20036" /> - <unix:state state_ref="state_20036" /> + comment="Testing user ownership" id="test_file_owner_etc_group" version="1"> + <unix:object object_ref="object_file_owner_etc_group" /> + <unix:state state_ref="state_file_owner_etc_group" /> </unix:file_test> - <unix:file_state id="state_20036" - version="1"> + <unix:file_state id="state_file_owner_etc_group" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20036" version="1"> + <unix:file_object comment="/etc/group" id="object_file_owner_etc_group" + version="1"> <unix:path>/etc</unix:path> <unix:filename>group</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml b/RHEL6/input/checks/file_owner_etc_gshadow.xml index eb02df1..a33952e 100644 --- a/RHEL6/input/checks/file_owner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml @@ -1,30 +1,28 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_gshadow" version="1"> + <definition class="compliance" id="file_owner_etc_gshadow" version="1"> <metadata> <title>Verify user who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate user.</description> + <description>The /etc/gshadow file should be owned by the appropriate + user.</description> </metadata> <criteria> - <criterion test_ref="test_20038" /> + <criterion test_ref="test_file_owner_etc_gshadow" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20038" version="1"> - <unix:object object_ref="obj_20017" /> - <unix:state state_ref="state_20038" /> - </unix:file_test> - <unix:file_state id="state_20038" + comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_owner_etc_gshadow" /> + <unix:state state_ref="state_file_owner_etc_gshadow" /> + </unix:file_test> + <unix:file_state id="state_file_owner_etc_gshadow" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/gshadow" - id="obj_20017" version="1"> + <unix:file_object comment="/etc/gshadow" id="object_file_owner_etc_gshadow" + version="1"> <unix:path>/etc</unix:path> <unix:filename>gshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml b/RHEL6/input/checks/file_owner_etc_passwd.xml index 73e9899..5fb621d 100644 --- a/RHEL6/input/checks/file_owner_etc_passwd.xml +++ b/RHEL6/input/checks/file_owner_etc_passwd.xml @@ -1,30 +1,27 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_passwd" version="1"> + <definition class="compliance" id="file_owner_etc_passwd" version="1"> <metadata> <title>Verify user who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate user.</description> + <description>The /etc/passwd file should be owned by the appropriate + user.</description> </metadata> <criteria> - <criterion test_ref="test_20040" /> + <criterion test_ref="test_file_owner_etc_passwd" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20040" version="1"> - <unix:object object_ref="obj_20040" /> - <unix:state state_ref="state_20040" /> + comment="Testing user ownership" id="test_file_owner_etc_passwd" version="1"> + <unix:object object_ref="object_file_owner_etc_passwd" /> + <unix:state state_ref="state_file_owner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20040" - version="1"> + <unix:file_state id="state_file_owner_etc_passwd" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/passwd" - id="obj_20040" version="1"> + <unix:file_object comment="/etc/passwd" id="object_file_owner_etc_passwd" + version="1"> <unix:path>/etc</unix:path> <unix:filename>passwd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml b/RHEL6/input/checks/file_permissions_etc_group.xml index 774c5d9..c547656 100644 --- a/RHEL6/input/checks/file_permissions_etc_group.xml +++ b/RHEL6/input/checks/file_permissions_etc_group.xml @@ -1,6 +1,5 @@ <def-group> - <definition class="compliance" - id="file_permissions_etc_group" version="1"> + <definition class="compliance" id="file_permissions_etc_group" version="1"> <metadata> <title>Verify permissions on 'group' file</title> <affected family="unix"> @@ -10,17 +9,16 @@ correctly.</description> </metadata> <criteria> - <criterion test_ref="test_20043" /> + <criterion test_ref="test_file_permissions_etc_group" /> </criteria> </definition> <unix:file_test check="all" check_existence="all_exist" - comment="Testing /etc/group permissions" - id="test_20043" version="1"> - <unix:object object_ref="obj_20012" /> - <unix:state state_ref="state_1000645" /> - </unix:file_test> - <unix:file_state id="state_1000645" + comment="Testing /etc/group permissions" id="test_file_permissions_etc_group" version="1"> + <unix:object object_ref="object_file_permissions_etc_group" /> + <unix:state state_ref="state_file_permissions_etc_group" /> + </unix:file_test> + <unix:file_state id="state_file_permissions_etc_group" version="1"> <unix:uread datatype="boolean">true</unix:uread> <unix:uwrite datatype="boolean">true</unix:uwrite> <unix:uexec datatype="boolean">false</unix:uexec> @@ -31,8 +29,8 @@ <unix:owrite datatype="boolean">false</unix:owrite> <unix:oexec datatype="boolean">false</unix:oexec> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20012" version="1"> + <unix:file_object comment="/etc/group" id="object_file_permissions_etc_group" + version="1"> <unix:path>/etc</unix:path> <unix:filename>group</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml b/RHEL6/input/checks/file_permissions_ungroupowned.xml index 5bc34f7..8becd03 100644 --- a/RHEL6/input/checks/file_permissions_ungroupowned.xml +++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml @@ -1,37 +1,35 @@ <def-group> - <definition class="compliance" - id="file_permissions_ungroupowned" version="1"> + <definition class="compliance" id="file_permissions_ungroupowned" + version="1"> <metadata> <title>Find files unowned by a group</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - group</description> + <description>All files should be owned by a group</description> </metadata> <criteria> <criterion comment="Check all files and make sure they are owned by a group" - negate="true" - test_ref="test_20051" /> + negate="true" test_ref="test_file_permissions_ungroupowned" /> </criteria> </definition> <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="files with no group owner" - id="test_20051" version="1"> + id="test_file_permissions_ungroupowned" version="1"> <notes> - <note>This will enumerate all files on local - partitions</note> + <note>This will enumerate all files on local partitions</note> </notes> - <unix:object object_ref="obj_20025" /> - <unix:state state_ref="state_20051" /> + <unix:object object_ref="object_file_permissions_ungroupowned" /> + <unix:state state_ref="state_file_permissions_ungroupowned" /> </unix:file_test> <unix:file_state comment="Executables with suid set" - id="state_20051" version="1"> + id="state_file_permissions_ungroupowned" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> <unix:file_object comment="all local files" - id="obj_20025" version="1"> - <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> + id="object_file_permissions_ungroupowned" version="1"> + <unix:behaviors recurse="symlinks and directories" + recurse_file_system="local" /> <unix:path>/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml index 7f8ddd8..0f694ea 100644 --- a/RHEL6/input/checks/interactive_boot_disable.xml +++ b/RHEL6/input/checks/interactive_boot_disable.xml @@ -1,29 +1,28 @@ <def-group> - <definition class="compliance" - id="interactive_boot_disable" version="1"> + <definition class="compliance" id="interactive_boot_disable" version="1"> <metadata> <title>Disable Interactive Boot</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The ability for users to perform interactive - startups should be disabled.</description> + <description>The ability for users to perform interactive startups should + be disabled.</description> </metadata> <criteria> - <criterion test_ref="test_20097" /> + <criterion test_ref="test_interactive_boot_disable" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" - id="test_20097" version="1"> - <ind:object object_ref="obj_20096" /> + id="test_interactive_boot_disable" version="1"> + <ind:object object_ref="object_interactive_boot_disable" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20096" + <ind:textfilecontent54_object id="object_interactive_boot_disable" version="1"> <ind:path>/etc/sysconfig</ind:path> <ind:filename>init</ind:filename> - <ind:pattern operation="pattern match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern> + <ind:pattern operation="pattern match"> + PROMPT[\s]*=[\s]*no\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> -- 1.7.1
Ack
scap-security-guide@lists.fedorahosted.org