[PATCH 3/3] significant overhaul of OVAL checks for auditing * support for Values * consistent naming (which may yet be made more concise in the future) * actually tested the checks
Jeffrey Blank
blank at eclipse.ncsc.mil
Wed Jun 6 01:54:44 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
.../auditd_data_retention_action_mail_acct.xml | 36 ++++++++++++++++++++
.../auditd_data_retention_admin_space_left.xml | 30 ----------------
...ditd_data_retention_admin_space_left_action.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_mail_acct.xml | 30 ----------------
.../input/checks/auditd_data_retention_max_log.xml | 30 ----------------
.../checks/auditd_data_retention_max_log_file.xml | 28 +++++++++------
.../auditd_data_retention_max_log_file_action.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_num_logs.xml | 36 ++++++++++++++++++++
.../checks/auditd_data_retention_space_left.xml | 30 ----------------
.../auditd_data_retention_space_left_action.xml | 36 ++++++++++++++++++++
10 files changed, 197 insertions(+), 131 deletions(-)
create mode 100644 rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_num_logs.xml
delete mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
diff --git a/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
new file mode 100644
index 0000000..3782c06
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_action_mail_acct" version="1">
+ <metadata>
+ <title>Auditd Email Account to Notify Upon Action</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="action_mail_acct setting in auditd.conf" test_ref="test_auditd_data_retention_action_mail_acct" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="email account for actions" id="test_auditd_data_retention_action_mail_acct" version="1">
+ <ind:object object_ref="object_auditd_data_retention_action_mail_acct" />
+ <ind:state state_ref="state_auditd_data_retention_action_mail_acct" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_action_mail_acct" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^action_mail_acct\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_action_mail_acct" version="1">
+ <ind:subexpression operation="equals" var_ref="var_auditd_action_mail_acct" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit action_mail_acct setting" datatype="string" id="var_auditd_action_mail_acct" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
deleted file mode 100644
index 5c708b8..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance" id="auditd_data_retention_admin_space_left" version="1">
- <metadata>
- <title>Auditd Admin Space Left Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>max_log_file_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="space left line halt" test_ref="test_auditd_data_retention_admin_space_left_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="space left line halt" id="test_auditd_data_retention_admin_space_left_action" version="1">
- <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern match">^admin\_space\_left\_action[\s]+\=[\s]+halt\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
new file mode 100644
index 0000000..db5f2b6
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_admin_space_left_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Disk is Low on Space</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="test_auditd_data_retention_admin_space_left_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="space left action" id="test_auditd_data_retention_admin_space_left_action" version="1">
+ <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
+ <ind:state state_ref="state_auditd_data_retention_admin_space_left_action" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^admin_space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_admin_space_left_action" version="1">
+ <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_admin_space_left_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit admin_space_left_action setting" datatype="string" id="var_auditd_admin_space_left_action" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
deleted file mode 100644
index 172266b..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance" id="auditd_data_retention_mail_acct" version="1">
- <metadata>
- <title>Auditd Mail Acct Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>action_mail_acct line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="mail acct action root" test_ref="test_auditd_data_retention_mail_acct_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="mail acct action root" id="test_auditd_data_retention_mail_acct_action" version="1">
- <ind:object object_ref="object_auditd_data_retention_mail_acct_action" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_auditd_data_retention_mail_acct_action" version="1">
- <ind:path> /etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern match">^action\_mail\_acct[\s]+\=[\s]+root\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log.xml b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
deleted file mode 100644
index 90d3b6a..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_max_log.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance" id="auditd_data_retention_max_log" version="1">
- <metadata>
- <title>Auditd Max Log File Size Set</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>max_log_file line is set in auditd.conf.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="max log size" test_ref="test_auditd_data_retention_max_log_size" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="max log size" id="test_auditd_data_retention_max_log_size" version="1">
- <ind:object object_ref="object_auditd_data_retention_max_log_size" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_size" version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern match">^max\_log\_file[\s]+[\d]\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
index f05d59f..a49d7ad 100644
--- a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
@@ -1,30 +1,36 @@
<def-group>
<definition class="compliance" id="auditd_data_retention_max_log_file" version="1">
<metadata>
- <title>Auditd Max Log File Action Set</title>
+ <title>Auditd Maximum Log File Size</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="TODO" source="CCE" />
- <description>max_log_file_action is set to keep logs.</description>
+ <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
</metadata>
<criteria>
-
- <criterion comment="max log file action" test_ref="test_auditd_data_retention_max_log_file_size" />
-
+ <criterion comment="max_log_file setting in auditd.conf" test_ref="test_auditd_data_retention_max_log_file" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="max log file action" id="test_auditd_data_retention_max_log_file_size" version="1">
- <ind:object object_ref="object_auditd_data_retention_max_log_file_size" />
+ <ind:textfilecontent54_test check="all" comment="max log file size" id="test_auditd_data_retention_max_log_file" version="1">
+ <ind:object object_ref="object_auditd_data_retention_max_log_file" />
+ <ind:state state_ref="state_auditd_data_retention_max_log_file" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_size" version="1">
- <ind:path>/etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern match">^max\_log\_file\_action[\s]+\=[\s]+keep\_logs\s*$</ind:pattern>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^max_log_file\s*=\s*(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+ <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file" version="1">
+ <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit max_log_file settting" datatype="int" id="var_auditd_max_log_file" version="1" />
+
+
</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
new file mode 100644
index 0000000..21d13c7
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_max_log_file_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Maximum Log Size Reached</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="max_log_file_action setting in auditd.conf" test_ref="test_auditd_data_retention_max_log_file_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_max_log_file_action" version="1">
+ <ind:object object_ref="object_auditd_data_retention_max_log_file_action" />
+ <ind:state state_ref="state_auditd_data_retention_max_log_file_action" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_action" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^max_log_file_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file_action" version="1">
+ <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_max_log_file_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit max_log_file_action setting" datatype="string" id="var_auditd_max_log_file_action" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_num_logs.xml b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
new file mode 100644
index 0000000..9021d80
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_num_logs" version="1">
+ <metadata>
+ <title>Auditd Maximum Number of Logs to Retain</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="num_logs setting in auditd.conf" test_ref="test_auditd_data_retention_num_logs" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_num_logs" version="1">
+ <ind:object object_ref="object_auditd_data_retention_num_logs" />
+ <ind:state state_ref="state_auditd_data_retention_num_logs" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_num_logs" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^num_logs\s*=\s*(\d+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_num_logs" version="1">
+ <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit num_logs settting" datatype="int" id="var_auditd_num_logs" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
deleted file mode 100644
index 29f97eb..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
- <definition class="compliance" id="auditd_data_retention_space_left" version="1">
- <metadata>
- <title>Auditd Space Left Action</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <reference ref_id="TODO" source="CCE" />
- <description>space_left_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
- </metadata>
-
- <criteria>
-
- <criterion comment="space left action email" test_ref="test_auditd_data_retention_space_left_action" />
-
- </criteria>
-
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="space left action email" id="test_auditd_data_retention_space_left_action" version="1">
- <ind:object object_ref="object_auditd_data_retention_space_left_action" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
- <ind:path> /etc/audit</ind:path>
- <ind:filename>auditd.conf</ind:filename>
- <ind:pattern operation="pattern match">^space\_left\_action[\s]+\=[\s]+email\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
new file mode 100644
index 0000000..ad5c8fd
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+ <definition class="compliance" id="auditd_data_retention_space_left_action" version="1">
+ <metadata>
+ <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+ </metadata>
+
+ <criteria>
+ <criterion comment="space_left_action setting in auditd.conf" test_ref="test_auditd_data_retention_space_left_action" />
+ </criteria>
+
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="space left action" id="test_auditd_data_retention_space_left_action" version="1">
+ <ind:object object_ref="object_auditd_data_retention_space_left_action" />
+ <ind:state state_ref="state_auditd_data_retention_space_left_action" />
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
+ <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+ <ind:pattern operation="pattern match">^space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_auditd_data_retention_space_left_action" version="1">
+ <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_space_left_action" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="audit space_left_action setting" datatype="string" id="var_auditd_space_left_action" version="1" />
+
+
+</def-group>
--
1.7.1
More information about the scap-security-guide
mailing list