[PATCH] Use mode 0 for gshadow file
kstailey.lists at gmail.com
kstailey.lists at gmail.com
Wed Sep 5 21:11:37 UTC 2012
From: Kenneth Stailey <kstailey.lists at gmail.com>
By using mode 0 for the /etc/gshadow file we avoid switching
to a less restrictive protection mode and avoid having the
file permissions to deviate from the permissions recorded
in the RPM database.
Signed-off-by: Kenneth Stailey <kstailey.lists at gmail.com>
---
.../input/checks/file_permissions_etc_gshadow.xml | 57 ++++++++++++----------
.../checks/templates/file_dir_permissions.csv | 1 +
2 files changed, 33 insertions(+), 25 deletions(-)
diff --git a/RHEL6/input/checks/file_permissions_etc_gshadow.xml b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
index d86a582..17c3e0c 100644
--- a/RHEL6/input/checks/file_permissions_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_permissions_etc_gshadow.xml
@@ -1,39 +1,46 @@
<def-group>
- <definition class="compliance"
- id="file_permissions_etc_gshadow" version="1">
+ <!-- THIS FILE IS GENERATED by create_permission_checks.py. DO NOT EDIT. -->
+ <definition class="compliance" id="file_permissions_etc_gshadow" version="1">
<metadata>
- <title>Verify permissions on 'gshadow' file</title>
+ <title>Verify /etc/gshadow Permissions</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>File permissions for /etc/gshadow should be set
- correctly.</description>
+ <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
+ the target file or directory has an extended ACL then it will fail the mode check.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20044" />
+ <criterion test_ref="test_etc_gshadow" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing gshadow permissions"
- id="test_20044" version="1">
- <unix:object object_ref="obj_20038" />
- <unix:state state_ref="state_1000400" />
+ <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="test_etc_gshadow" version="1">
+ <unix:object object_ref="object_etc_gshadow" />
+ <unix:state state_ref="state_uid_0" />
+ <unix:state state_ref="state_gid_0" />
+ <unix:state state_ref="state_mode_0000" />
</unix:file_test>
- <unix:file_state id="state_1000400"
- version="1">
- <unix:uread datatype="boolean">true</unix:uread>
- <unix:uwrite datatype="boolean">false</unix:uwrite>
- <unix:uexec datatype="boolean">false</unix:uexec>
- <unix:gread datatype="boolean">false</unix:gread>
- <unix:gwrite datatype="boolean">false</unix:gwrite>
- <unix:gexec datatype="boolean">false</unix:gexec>
- <unix:oread datatype="boolean">false</unix:oread>
- <unix:owrite datatype="boolean">false</unix:owrite>
- <unix:oexec datatype="boolean">false</unix:oexec>
- </unix:file_state>
- <unix:file_object comment="/etc/gshadow"
- id="obj_20038" version="1">
+ <unix:file_object comment="/etc/gshadow" id="object_etc_gshadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>gshadow</unix:filename>
</unix:file_object>
+ <unix:file_state id="state_uid_0" version="1">
+ <unix:user_id datatype="int" operation="equals">0</unix:user_id>
+ </unix:file_state>
+ <unix:file_state id="state_gid_0" version="1">
+ <unix:group_id datatype="int" operation="equals">0</unix:group_id>
+ </unix:file_state>
+ <unix:file_state id="state_mode_0000" version="1">
+ <unix:suid datatype="boolean">false</unix:suid>
+ <unix:sgid datatype="boolean">false</unix:sgid>
+ <unix:sticky datatype="boolean">false</unix:sticky>
+ <unix:uread datatype="boolean">false</unix:uread>
+ <unix:uwrite datatype="boolean">false</unix:uwrite>
+ <unix:uexec datatype="boolean">false</unix:uexec>
+ <unix:gread datatype="boolean">false</unix:gread>
+ <unix:gwrite datatype="boolean">false</unix:gwrite>
+ <unix:gexec datatype="boolean">false</unix:gexec>
+ <unix:oread datatype="boolean">false</unix:oread>
+ <unix:owrite datatype="boolean">false</unix:owrite>
+ <unix:oexec datatype="boolean">false</unix:oexec>
+ </unix:file_state>
</def-group>
diff --git a/RHEL6/input/checks/templates/file_dir_permissions.csv b/RHEL6/input/checks/templates/file_dir_permissions.csv
index 781f413..1e0164e 100644
--- a/RHEL6/input/checks/templates/file_dir_permissions.csv
+++ b/RHEL6/input/checks/templates/file_dir_permissions.csv
@@ -1,3 +1,4 @@
/etc,shadow,0,0,0000
+/etc,gshadow,0,0,0000
/etc,passwd,0,0,0644
/boot/grub,grub.conf,0,0,0600
--
1.7.12
More information about the scap-security-guide
mailing list