[PATCH 3/3] significant overhaul of OVAL checks for auditing * support for Values * consistent naming (which may yet be made more concise in the future) * actually tested the checks

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Jun 6 01:54:44 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../auditd_data_retention_action_mail_acct.xml     |   36 ++++++++++++++++++++
 .../auditd_data_retention_admin_space_left.xml     |   30 ----------------
 ...ditd_data_retention_admin_space_left_action.xml |   36 ++++++++++++++++++++
 .../checks/auditd_data_retention_mail_acct.xml     |   30 ----------------
 .../input/checks/auditd_data_retention_max_log.xml |   30 ----------------
 .../checks/auditd_data_retention_max_log_file.xml  |   28 +++++++++------
 .../auditd_data_retention_max_log_file_action.xml  |   36 ++++++++++++++++++++
 .../checks/auditd_data_retention_num_logs.xml      |   36 ++++++++++++++++++++
 .../checks/auditd_data_retention_space_left.xml    |   30 ----------------
 .../auditd_data_retention_space_left_action.xml    |   36 ++++++++++++++++++++
 10 files changed, 197 insertions(+), 131 deletions(-)
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
 delete mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
 delete mode 100644 rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
 delete mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_num_logs.xml
 delete mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left.xml
 create mode 100644 rhel6/src/input/checks/auditd_data_retention_space_left_action.xml

diff --git a/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
new file mode 100644
index 0000000..3782c06
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_action_mail_acct.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_action_mail_acct" version="1">
+    <metadata>
+      <title>Auditd Email Account to Notify Upon Action</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
+    </metadata>
+   
+    <criteria>
+	<criterion comment="action_mail_acct setting in auditd.conf" test_ref="test_auditd_data_retention_action_mail_acct" />
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="email account for actions" id="test_auditd_data_retention_action_mail_acct" version="1">
+    <ind:object object_ref="object_auditd_data_retention_action_mail_acct" />
+    <ind:state state_ref="state_auditd_data_retention_action_mail_acct" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_action_mail_acct" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^action_mail_acct\s*=\s*(\S+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_auditd_data_retention_action_mail_acct" version="1">
+    <ind:subexpression operation="equals" var_ref="var_auditd_action_mail_acct" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit action_mail_acct setting" datatype="string" id="var_auditd_action_mail_acct" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
deleted file mode 100644
index 5c708b8..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_admin_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
-  <definition class="compliance" id="auditd_data_retention_admin_space_left" version="1">
-    <metadata>
-      <title>Auditd Admin Space Left Action</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <reference ref_id="TODO" source="CCE" />
-      <description>max_log_file_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
-    </metadata>
-   
-    <criteria>
-      
-	<criterion comment="space left line halt" test_ref="test_auditd_data_retention_admin_space_left_action" />
-
-    </criteria>
-
-  </definition>
-  
-  <ind:textfilecontent54_test check="all" comment="space left line halt" id="test_auditd_data_retention_admin_space_left_action" version="1">
-    <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
-    <ind:path>/etc/audit</ind:path>
-    <ind:filename>auditd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^admin\_space\_left\_action[\s]+\=[\s]+halt\s*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
new file mode 100644
index 0000000..db5f2b6
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_admin_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_admin_space_left_action" version="1">
+    <metadata>
+      <title>Auditd Action to Take When Disk is Low on Space</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+    </metadata>
+   
+    <criteria>
+	<criterion comment="admin_space_left_action setting in auditd.conf" test_ref="test_auditd_data_retention_admin_space_left_action" />
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="space left action" id="test_auditd_data_retention_admin_space_left_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_admin_space_left_action" />
+    <ind:state state_ref="state_auditd_data_retention_admin_space_left_action" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_admin_space_left_action" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^admin_space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_auditd_data_retention_admin_space_left_action" version="1">
+    <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_admin_space_left_action" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit admin_space_left_action setting" datatype="string" id="var_auditd_admin_space_left_action" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml b/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
deleted file mode 100644
index 172266b..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_mail_acct.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
-  <definition class="compliance" id="auditd_data_retention_mail_acct" version="1">
-    <metadata>
-      <title>Auditd Mail Acct Action</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <reference ref_id="TODO" source="CCE" />
-      <description>action_mail_acct line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
-    </metadata>
-   
-    <criteria>
-
-	<criterion comment="mail acct action root" test_ref="test_auditd_data_retention_mail_acct_action" />
-
-    </criteria>
-
-  </definition>
-  
-  <ind:textfilecontent54_test check="all" comment="mail acct action root" id="test_auditd_data_retention_mail_acct_action" version="1">
-    <ind:object object_ref="object_auditd_data_retention_mail_acct_action" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_auditd_data_retention_mail_acct_action" version="1">
-    <ind:path> /etc/audit</ind:path>
-    <ind:filename>auditd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^action\_mail\_acct[\s]+\=[\s]+root\s*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log.xml b/rhel6/src/input/checks/auditd_data_retention_max_log.xml
deleted file mode 100644
index 90d3b6a..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_max_log.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
-  <definition class="compliance" id="auditd_data_retention_max_log" version="1">
-    <metadata>
-      <title>Auditd Max Log File Size Set</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <reference ref_id="TODO" source="CCE" />
-      <description>max_log_file line is set in auditd.conf.</description>
-    </metadata>
-   
-    <criteria>
-      
-	<criterion comment="max log size" test_ref="test_auditd_data_retention_max_log_size" />
-
-    </criteria>
-
-  </definition>
-  
-  <ind:textfilecontent54_test check="all" comment="max log size" id="test_auditd_data_retention_max_log_size" version="1">
-    <ind:object object_ref="object_auditd_data_retention_max_log_size" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_size" version="1">
-    <ind:path>/etc/audit</ind:path>
-    <ind:filename>auditd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^max\_log\_file[\s]+[\d]\s*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
index f05d59f..a49d7ad 100644
--- a/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file.xml
@@ -1,30 +1,36 @@
 <def-group>
   <definition class="compliance" id="auditd_data_retention_max_log_file" version="1">
     <metadata>
-      <title>Auditd Max Log File Action Set</title>
+      <title>Auditd Maximum Log File Size</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <reference ref_id="TODO" source="CCE" />
-      <description>max_log_file_action is set to keep logs.</description>
+      <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
     </metadata>
    
     <criteria>
-      
-	<criterion comment="max log file action" test_ref="test_auditd_data_retention_max_log_file_size" />
-
+	<criterion comment="max_log_file setting in auditd.conf" test_ref="test_auditd_data_retention_max_log_file" />
     </criteria>
 
   </definition>
   
-  <ind:textfilecontent54_test check="all" comment="max log file action" id="test_auditd_data_retention_max_log_file_size" version="1">
-    <ind:object object_ref="object_auditd_data_retention_max_log_file_size" />
+  <ind:textfilecontent54_test check="all" comment="max log file size" id="test_auditd_data_retention_max_log_file" version="1">
+    <ind:object object_ref="object_auditd_data_retention_max_log_file" />
+    <ind:state state_ref="state_auditd_data_retention_max_log_file" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_size" version="1">
-    <ind:path>/etc/audit</ind:path>
-    <ind:filename>auditd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^max\_log\_file\_action[\s]+\=[\s]+keep\_logs\s*$</ind:pattern>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^max_log_file\s*=\s*(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
+  <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_auditd_max_log_file" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit max_log_file settting" datatype="int" id="var_auditd_max_log_file" version="1" />
+
+
 </def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
new file mode 100644
index 0000000..21d13c7
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_max_log_file_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_max_log_file_action" version="1">
+    <metadata>
+      <title>Auditd Action to Take When Maximum Log Size Reached</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+    </metadata>
+   
+    <criteria>
+	<criterion comment="max_log_file_action setting in auditd.conf" test_ref="test_auditd_data_retention_max_log_file_action" />
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_max_log_file_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_max_log_file_action" />
+    <ind:state state_ref="state_auditd_data_retention_max_log_file_action" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_max_log_file_action" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^max_log_file_action\s*=\s*(\S+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_auditd_data_retention_max_log_file_action" version="1">
+    <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_max_log_file_action" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit max_log_file_action setting" datatype="string" id="var_auditd_max_log_file_action" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_num_logs.xml b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
new file mode 100644
index 0000000..9021d80
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_num_logs.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_num_logs" version="1">
+    <metadata>
+      <title>Auditd Maximum Number of Logs to Retain</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
+    </metadata>
+   
+    <criteria>
+	<criterion comment="num_logs setting in auditd.conf" test_ref="test_auditd_data_retention_num_logs" />
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="admin space left action " id="test_auditd_data_retention_num_logs" version="1">
+    <ind:object object_ref="object_auditd_data_retention_num_logs" />
+    <ind:state state_ref="state_auditd_data_retention_num_logs" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_num_logs" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^num_logs\s*=\s*(\d+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_auditd_data_retention_num_logs" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_auditd_num_logs" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit num_logs settting" datatype="int" id="var_auditd_num_logs" version="1" />
+
+
+</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left.xml b/rhel6/src/input/checks/auditd_data_retention_space_left.xml
deleted file mode 100644
index 29f97eb..0000000
--- a/rhel6/src/input/checks/auditd_data_retention_space_left.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<def-group>
-  <definition class="compliance" id="auditd_data_retention_space_left" version="1">
-    <metadata>
-      <title>Auditd Space Left Action</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <reference ref_id="TODO" source="CCE" />
-      <description>space_left_action line of auditd.conf is set to act appropriately when auditing disk space runs low.</description>
-    </metadata>
-   
-    <criteria>
-	
-	<criterion comment="space left action email" test_ref="test_auditd_data_retention_space_left_action" />
-
-    </criteria>
-
-  </definition>
-  
-  <ind:textfilecontent54_test check="all" comment="space left action email" id="test_auditd_data_retention_space_left_action" version="1">
-    <ind:object object_ref="object_auditd_data_retention_space_left_action" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
-    <ind:path> /etc/audit</ind:path>
-    <ind:filename>auditd.conf</ind:filename>
-    <ind:pattern operation="pattern match">^space\_left\_action[\s]+\=[\s]+email\s*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-</def-group>
diff --git a/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
new file mode 100644
index 0000000..ad5c8fd
--- /dev/null
+++ b/rhel6/src/input/checks/auditd_data_retention_space_left_action.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="auditd_data_retention_space_left_action" version="1">
+    <metadata>
+      <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TODO" source="CCE" />
+      <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
+    </metadata>
+   
+    <criteria>
+	<criterion comment="space_left_action setting in auditd.conf" test_ref="test_auditd_data_retention_space_left_action" />
+    </criteria>
+
+  </definition>
+  
+  <ind:textfilecontent54_test check="all" comment="space left action" id="test_auditd_data_retention_space_left_action" version="1">
+    <ind:object object_ref="object_auditd_data_retention_space_left_action" />
+    <ind:state state_ref="state_auditd_data_retention_space_left_action" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_auditd_data_retention_space_left_action" version="1">
+    <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
+    <ind:pattern operation="pattern match">^space_left_action\s*=\s*(\S+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_auditd_data_retention_space_left_action" version="1">
+    <ind:subexpression operation="case insensitive equals" var_ref="var_auditd_space_left_action" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="audit space_left_action setting" datatype="string" id="var_auditd_space_left_action" version="1" />
+
+
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list