[PATCH 07/18] Created OVAL checks for /etc/httpd/conf/* directory and files growp ownership.

Willy Santos wsantos at redhat.com
Thu Apr 12 00:31:18 UTC 2012


---
 .../file_group_owner_httpd_server_conf_files.xml   |   49 ++++++++++++++++++++
 1 files changed, 49 insertions(+), 0 deletions(-)
 create mode 100644 rhel6/src/input/checks/file_group_owner_httpd_server_conf_files.xml

diff --git a/rhel6/src/input/checks/file_group_owner_httpd_server_conf_files.xml b/rhel6/src/input/checks/file_group_owner_httpd_server_conf_files.xml
new file mode 100644
index 0000000..9a33842
--- /dev/null
+++ b/rhel6/src/input/checks/file_group_owner_httpd_server_conf_files.xml
@@ -0,0 +1,49 @@
+<def-group>
+  <definition class="compliance" id="file_group_owner_httpd_server_conf_files" version="1">
+    <metadata>
+      <title>Check Group Ownership /etc/httpd/conf</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="CCE-3626-9" source="CCE" />
+      <description>The directory /etc/httpd/conf and contained files should be owned by the apache group.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion test_ref="test_file_group_owner_httpd_server_conf_files-dir" />
+      <criterion test_ref="test_file_group_owner_httpd_server_conf_files-files" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist" comment="apache gid for /etc/http/conf/" id="test_file_group_owner_httpd_server_conf_files-dir" version="1">
+    <unix:object object_ref="object_file_group_owner_httpd_server_conf_files-dir" />
+    <unix:state state_ref="state_file_group_owner_httpd_server_conf_files-dir" />
+  </unix:file_test>
+  <unix:file_object comment="/etc/httpd/conf/" id="object_file_group_owner_httpd_server_conf_files-dir" version="1">
+    <unix:path>/etc/httpd/conf</unix:path>
+    <unix:filename xsi:nil="true" />
+  </unix:file_object>
+  <unix:file_state id="state_file_group_owner_httpd_server_conf_files-dir" version="1">
+    <unix:group_id datatype="int" var_ref="var_apache_gid" />
+  </unix:file_state>
+  <unix:file_test check="all" check_existence="all_exist" comment="apache gid for /etc/http/conf/*" id="test_file_group_owner_httpd_server_conf_files-files" version="1">
+    <unix:object object_ref="object_file_group_owner_httpd_server_conf_files-files" />
+    <unix:state state_ref="state_file_group_owner_httpd_server_conf_files-files" />
+  </unix:file_test>
+  <unix:file_object comment="/etc/httpd/conf/*" id="object_file_group_owner_httpd_server_conf_files-files" version="1">
+    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
+    <unix:path operation="equals">/etc/httpd/conf</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+  </unix:file_object>
+  <unix:file_state id="state_file_group_owner_httpd_server_conf_files-files" version="1">
+    <unix:group_id datatype="int" var_ref="var_apache_gid" />
+  </unix:file_state>
+  <unix:password_test check="all" comment="Find the Apache group id (GID)" id="test_find_apache_gid" version="1">
+    <unix:object object_ref="object_find_apache_gid"/>
+    <!-- <unix:state state_ref="state_find_apache_gid"/> -->
+  </unix:password_test>
+  <unix:password_object id="object_find_apache_gid" version="1">
+    <unix:username operation="equals">apache</unix:username>
+  </unix:password_object>
+  <local_variable id="var_apache_gid" version="1" datatype="int" comment="GID for apache group">
+    <object_component item_field="group_id" object_ref="object_find_apache_gid"/>
+  </local_variable>
+</def-group>
-- 
1.7.7.6


--------------060302030708000108020305
Content-Type: text/x-patch;
 name="0008-Created-OVAL-checks-for-etc-httpd-conf-file-permissi.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename*0="0008-Created-OVAL-checks-for-etc-httpd-conf-file-permissi.pa";
 filename*1="tch"



More information about the scap-security-guide mailing list