[PATCH 3/7] added OVAL files which are now created through template

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Sep 4 23:16:33 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../file_permissions_boot_grub_grub_conf.xml       |   46 ++++++++++++++++++++
 .../input/checks/file_permissions_var_log_cron.xml |   46 ++++++++++++++++++++
 2 files changed, 92 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
 create mode 100644 RHEL6/input/checks/file_permissions_var_log_cron.xml

diff --git a/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml b/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
new file mode 100644
index 0000000..3033e50
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_boot_grub_grub_conf.xml
@@ -0,0 +1,46 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="file_permissions_boot_grub_grub_conf" version="1">
+    <metadata>
+      <title>Verify /boot/grub/grub.conf Permissions</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>This test makes sure that /boot/grub/grub.conf is owned by 0, group owned by 0, and has mode 0600. If
+      the target file or directory has an extended ACL then it will fail the mode check.</description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="test_boot_grub_grub_conf" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub/grub.conf mode and ownership" id="test_boot_grub_grub_conf" version="1">
+    <unix:object object_ref="object_boot_grub_grub_conf" />
+    <unix:state state_ref="state_uid_0" />
+    <unix:state state_ref="state_gid_0" />
+    <unix:state state_ref="state_mode_0600" />
+  </unix:file_test>
+  <unix:file_object comment="/boot/grub/grub.conf" id="object_boot_grub_grub_conf" version="1">
+    <unix:path>/boot/grub</unix:path>
+    <unix:filename>grub.conf</unix:filename>
+  </unix:file_object>
+  <unix:file_state id="state_uid_0" version="1">
+    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
+  </unix:file_state>
+  <unix:file_state id="state_gid_0" version="1">
+    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
+  </unix:file_state>
+  <unix:file_state id="state_mode_0600" version="1">
+	<unix:suid datatype="boolean">false</unix:suid>
+	<unix:sgid datatype="boolean">false</unix:sgid>
+	<unix:sticky datatype="boolean">false</unix:sticky>
+	<unix:uread datatype="boolean">true</unix:uread>
+	<unix:uwrite datatype="boolean">true</unix:uwrite>
+	<unix:uexec datatype="boolean">false</unix:uexec>
+	<unix:gread datatype="boolean">false</unix:gread>
+	<unix:gwrite datatype="boolean">false</unix:gwrite>
+	<unix:gexec datatype="boolean">false</unix:gexec>
+	<unix:oread datatype="boolean">false</unix:oread>
+	<unix:owrite datatype="boolean">false</unix:owrite>
+	<unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+</def-group>
diff --git a/RHEL6/input/checks/file_permissions_var_log_cron.xml b/RHEL6/input/checks/file_permissions_var_log_cron.xml
new file mode 100644
index 0000000..e577df1
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_var_log_cron.xml
@@ -0,0 +1,46 @@
+<def-group>
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
+  <definition class="compliance" id="file_permissions_var_log_cron" version="1">
+    <metadata>
+      <title>Verify /var/log/cron Permissions</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>This test makes sure that /var/log/cron is owned by 0, group owned by 0, and has mode 0600. If
+      the target file or directory has an extended ACL then it will fail the mode check.</description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="test_var_log_cron" />
+    </criteria>
+  </definition>
+  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/cron mode and ownership" id="test_var_log_cron" version="1">
+    <unix:object object_ref="object_var_log_cron" />
+    <unix:state state_ref="state_uid_0" />
+    <unix:state state_ref="state_gid_0" />
+    <unix:state state_ref="state_mode_0600" />
+  </unix:file_test>
+  <unix:file_object comment="/var/log/cron" id="object_var_log_cron" version="1">
+    <unix:path>/var/log</unix:path>
+    <unix:filename>cron</unix:filename>
+  </unix:file_object>
+  <unix:file_state id="state_uid_0" version="1">
+    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
+  </unix:file_state>
+  <unix:file_state id="state_gid_0" version="1">
+    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
+  </unix:file_state>
+  <unix:file_state id="state_mode_0600" version="1">
+	<unix:suid datatype="boolean">false</unix:suid>
+	<unix:sgid datatype="boolean">false</unix:sgid>
+	<unix:sticky datatype="boolean">false</unix:sticky>
+	<unix:uread datatype="boolean">true</unix:uread>
+	<unix:uwrite datatype="boolean">true</unix:uwrite>
+	<unix:uexec datatype="boolean">false</unix:uexec>
+	<unix:gread datatype="boolean">false</unix:gread>
+	<unix:gwrite datatype="boolean">false</unix:gwrite>
+	<unix:gexec datatype="boolean">false</unix:gexec>
+	<unix:oread datatype="boolean">false</unix:oread>
+	<unix:owrite datatype="boolean">false</unix:owrite>
+	<unix:oexec datatype="boolean">false</unix:oexec>
+  </unix:file_state>
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list