[PATCH 2/5] added new macros for file permissions, kernel modules, audit rules

Shawn Wells shawn at redhat.com
Mon Sep 24 14:56:36 UTC 2012


On 9/24/12 9:45 AM, Jeffrey Blank wrote:
> Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
> ---
>   RHEL6/transforms/shorthand2xccdf.xslt |   91 ++++++++++++++++++++++++++++++--
>   1 files changed, 85 insertions(+), 6 deletions(-)
>
> diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
> index 0d8f56e..07daf3d 100644
> --- a/RHEL6/transforms/shorthand2xccdf.xslt
> +++ b/RHEL6/transforms/shorthand2xccdf.xslt
> @@ -11,6 +11,7 @@ exclude-result-prefixes="xccdf xhtml">
>   
>   <xsl:variable name="defaultseverity" select="'low'" />
>   
> +
>     <!-- Content:template -->
>     <xsl:template match="Benchmark">
>       <xsl:copy>
> @@ -209,20 +210,61 @@ exclude-result-prefixes="xccdf xhtml">
>   
>     <!-- convenience macros for XCCDF prose -->
>     <xsl:template match="sysctl-desc-macro">
> +    To set the runtime status of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter,
> +    run the following command:
> +    <xhtml:pre># sysctl -w <xsl:value-of select="@sysctl"/> <xsl:value-of select="@value"/></xhtml:pre>
> +  </xsl:template>
> +
> +  <xsl:template match="sysctl-check-macro">
>       The status of the <xhtml:code><xsl:value-of select="@sysctl"/></xhtml:code> kernel parameter can be queried
>       by running the following command:
>       <xhtml:pre>$ sysctl <xsl:value-of select="@sysctl"/></xhtml:pre>
>       The output of the command should indicate a value of <xhtml:code><xsl:value-of select="@value"/></xhtml:code>.
> +    If this value is not the default value, investigate how it could have been adjusted at runtime, and verify
> +    that it is not set improperly in <tt>/etc/sysctl.conf</tt>.
>     </xsl:template>
>   
> -  <xsl:template match="service-disable-macro">
> -    The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command:
> -    <xhtml:pre># chkconfig <xsl:value-of select="@service"/> off</xhtml:pre>
> +  <xsl:template match="fileperms-desc-macro">
> +    To properly set the permissions of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre xml:space="preserve"># chmod <xsl:value-of select="@file"/> <xsl:value-of select="@perms"/></xhtml:pre>
>     </xsl:template>
>   
> -  <xsl:template match="service-enable-macro">
> -    The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command:
> -    <xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
> +  <xsl:template match="fileowner-desc-macro">
> +    To properly set the owner of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre xml:space="preserve"># chown <xsl:value-of select="@file"/> <xsl:value-of select="@owner"/></xhtml:pre>
> +  </xsl:template>
> +
> +  <xsl:template match="filegroupowner-desc-macro">
> +    To properly set the group owner of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre xml:space="preserve"># chown <xsl:value-of select="@file"/> <xsl:value-of select="@group"/></xhtml:pre>
> +  </xsl:template>
> +
> +  <xsl:template match="fileperms-check-macro">
> +    To check the permissions of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre>$ ls -l <xsl:value-of select="@file"/></xhtml:pre>
> +    If properly configured, the output should indicate the following permissions:
> +    <xhtml:code><xsl:value-of select="@perms"/></xhtml:code>
> +  </xsl:template>
> +
> +  <xsl:template match="fileowner-check-macro">
> +    To check the ownership of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre>$ ls -l <xsl:value-of select="@file"/></xhtml:pre>
> +    If properly configured, the output should indicate the following owner:
> +    <xhtml:code><xsl:value-of select="@owner"/></xhtml:code>
> +  </xsl:template>
> +
> +  <xsl:template match="filegroupowner-check-macro">
> +    To check the group ownership of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre>$ ls -l <xsl:value-of select="@file"/></xhtml:pre>
> +    If properly configured, the output should indicate the following group-owner:
> +    <xhtml:code><xsl:value-of select="@group"/></xhtml:code>
> +  </xsl:template>
> +
> +  <xsl:template match="fileperms-check-macro">
> +    To check the permissions of <xhtml:code><xsl:value-of select="@file"/></xhtml:code>, run the command:
> +    <xhtml:pre>$ ls -l <xsl:value-of select="@file"/></xhtml:pre>
> +    If properly configured, the output should indicate the following permissions:
> +    <xhtml:code><xsl:value-of select="@perms"/></xhtml:code>
>     </xsl:template>
>   
>     <xsl:template match="package-install-macro">
> @@ -241,6 +283,16 @@ exclude-result-prefixes="xccdf xhtml">
>       It will return a line for <xhtml:code><xsl:value-of select="@part"/></xhtml:code> if it is on its own partition.
>     </xsl:template>
>   
> +  <xsl:template match="service-disable-macro">
> +    The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be disabled with the following command:
> +    <xhtml:pre># chkconfig <xsl:value-of select="@service"/> off</xhtml:pre>
> +  </xsl:template>
> +
> +  <xsl:template match="service-enable-macro">
> +    The <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service can be enabled with the following command:
> +    <xhtml:pre># chkconfig <xsl:value-of select="@service"/> on</xhtml:pre>
> +  </xsl:template>
> +
>     <xsl:template match="service-disable-check-macro">
>       Run the following command to determine the current status of the
>   <xhtml:code><xsl:value-of select="@service"/></xhtml:code> service:
> @@ -260,6 +312,33 @@ exclude-result-prefixes="xccdf xhtml">
>       <xhtml:pre># rpm -q <xsl:value-of select="@package"/></xhtml:pre>
>     </xsl:template>
>   
> +
> +  <xsl:template match="module-disable-macro">
> +To configure the system to prevent the <xhtml:code><xsl:value-of select="@module"/></xhtml:code>
> +kernel module from being loaded, add the following line to a file in the directory <tt>/etc/modprobe.d</tt>:
> +<pre xml:space="preserve">install <xsl:value-of select="@module"/> /bin/true</pre>
> +  </xsl:template>
> +
> +  <xsl:template match="module-disable-check-macro">
> +If the system is configured to prevent the loading of the
> +<xhtml:code><xsl:value-of select="@module"/></xhtml:code> kernel module,
> +it will contain lines inside any file in <tt>/etc/modprobe.d</tt> or the deprecated<tt>/etc/modprobe.conf</tt>.
> +These lines instruct the module loading system to run another program (such as
> +<tt>/bin/true</tt>) upon a module <tt>install</tt> event.
> +Run the following command to search for such lines in all files in <tt>/etc/modprobe.d</tt>
> +and the deprecated <tt>/etc/modprobe.conf</tt>:
> +<pre xml:space="preserve">$ grep -r <xsl:value-of select="@module"/> /etc/modprobe.conf /etc/modprobe.d</pre>
> +  </xsl:template>
> +
> +  <xsl:template match="audit-syscall-check-macro">
> +To determine if the system is configured to audit calls to
> +the <xhtml:code><xsl:value-of select="@syscall"/></xhtml:code>
> +system call, run the following command:
> +<pre xml:space="preserve"># auditctl -l | grep syscall | grep <xsl:value-of select="@syscall"/></pre>
> +If the system is configured to audit this activity, it will return a line.
> +  </xsl:template>
> +
> +
>     <!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
>     <!-- (expanding xhtml tags back into the xhtml namespace) -->
>     <xsl:template match="br">

Ack


More information about the scap-security-guide mailing list