[PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files

Shawn Wells shawn.d.wells at gmail.com
Sun Apr 14 08:04:17 UTC 2013


-------------- next part --------------
>From 7178840030a743f77c3ecacb50403a1c5972675e Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 14 Apr 2013 03:43:26 -0400
Subject: [PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files
 - Changed XCCDF name to rsyslog_files_groupownership, to stay compliant with naming scheme
 for other rsyslog_* rules
 - Updated file pattern match to '.', as not all log files have a *.log syntax

Testing:
[shawn at rhel6 checks]$ sudo sh -c "chgrp -R root /var/log"
[shawn at rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownershipvDb8cx.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
[shawn at rhel6 checks]$ sudo sh -c "chgrp shawn /var/log/messages"
[shawn at rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownership5hwL0x.xml
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
---
 RHEL6/input/auxiliary/alt-titles-stig.xml          |    2 +-
 RHEL6/input/auxiliary/stig_overlay.xml             |    2 +-
 .../input/checks/rsyslog_files_groupownership.xml  |   24 ++++++++++++++-----
 RHEL6/input/profiles/common.xml                    |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    2 +-
 RHEL6/input/system/logging.xml                     |    2 +-
 7 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index d4a9cf0..fab8b62 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -344,7 +344,7 @@ The system's system logging services must be enabled.
 <title rule="userowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate User">
 All rsyslog-generated log files must be owned by root.
 </title>
-<title rule="groupowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate Group">
+<title rule="rsyslog_files_groupownership" shorttitle="Ensure Log Files Are Owned By Appropriate Group">
 All rsyslog-generated log files must be group-owned by root.
 </title>
 <title rule="rsyslog_file_permissions" shorttitle="Ensure System Log Files Have Correct Permissions">
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 2c553bd..2e0b5b4 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -297,7 +297,7 @@
 	<overlay owner="disastig" ruleid="userowner_rsyslog_files" ownerid="RHEL-06-000133" disa="1314" severity="medium">
 		<title>All rsyslog-generated log files must be owned by root.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="groupowner_rsyslog_files" ownerid="RHEL-06-000134" disa="1314" severity="medium">
+	<overlay owner="disastig" ruleid="rsyslog_files_groupownership" ownerid="RHEL-06-000134" disa="1314" severity="medium">
 		<title>All rsyslog-generated log files must be group-owned by root.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="rsyslog_file_permissions" ownerid="RHEL-06-000135" disa="1314" severity="medium">
diff --git a/RHEL6/input/checks/rsyslog_files_groupownership.xml b/RHEL6/input/checks/rsyslog_files_groupownership.xml
index 729f4b2..c28b257 100644
--- a/RHEL6/input/checks/rsyslog_files_groupownership.xml
+++ b/RHEL6/input/checks/rsyslog_files_groupownership.xml
@@ -1,6 +1,5 @@
 <def-group>
-  <definition class="compliance"
-  id="rsyslog_files_groupownership" version="1">
+  <definition class="compliance" id="rsyslog_files_groupownership" version="1">
     <metadata>
       <title>Confirm Existence and Permissions of System Log
       Files</title>
@@ -11,11 +10,22 @@
       appropriate group.</description>
     </metadata>
     <criteria>
-      <criterion comment="check if group root owns all syslog log files"
-      test_ref="test_20155" />
+      <criterion comment="check if group root owns all syslog log files" test_ref="test_rsyslog_files_groupownership" />
     </criteria>
   </definition>
-  <ind:unknown_test check="all"
-  comment="use extended content to evaluated this test"
-  id="test_20155" version="1" />
+
+  <unix:file_test check="all" check_existence="all_exist" comment="syslog files owned by group root" id="test_rsyslog_files_groupownership" version="1">
+    <unix:object object_ref="object_rsyslog_files_groupownership" />
+    <unix:state state_ref="state_rsyslog_files_groupownership" />
+  </unix:file_test>
+
+  <unix:file_object comment="syslog files owned by root" id="object_rsyslog_files_groupownership" version="1">
+    <unix:path>/var/log</unix:path>
+    <unix:filename operation="pattern match">.</unix:filename>
+    <!-- <filter action="exclude">state_rsyslog_files_groupownership</filter> -->
+  </unix:file_object>
+
+  <unix:file_state id="state_rsyslog_files_groupownership" version="1">
+    <unix:group_id datatype="int">0</unix:group_id>
+  </unix:file_state>
 </def-group>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 2a7565a..48a0358 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -102,7 +102,7 @@
 <select idref="service_rsyslog_enabled" selected="true"/>
 
 <select idref="userowner_rsyslog_files" selected="true"/>
-<select idref="groupowner_rsyslog_files" selected="true"/>
+<select idref="rsyslog_files_groupownership" selected="true"/>
 <select idref="rsyslog_file_permissions" selected="true"/>
 <select idref="rsyslog_send_messages_to_logserver" selected="true"/>
 <select idref="ensure_logrotate_activated" selected="true"/>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e092650..171c183 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -158,7 +158,7 @@ assurance."</description>
 <select idref="set_daemon_umask" selected="true" \>
 <select idref="no_uidzero_except_root" selected="true" \>
 <select idref="userowner_rsyslog_files" selected="true" \>
-<select idref="groupowner_rsyslog_files" selected="true" \>
+<select idref="rsyslog_files_groupownership" selected="true" \>
 
 <!-- AC-6(2) -->
 <select idref="restrict_root_console_logins" selected="true" \>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index af95ac2..bce3d12 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -164,7 +164,7 @@
 <select idref="package_rsyslog_installed" selected="true" />
 <select idref="service_rsyslog_enabled" selected="true" />
 <select idref="rsyslog_file_permissions" selected="true" />
-<select idref="groupowner_rsyslog_files" selected="true" />
+<select idref="rsyslog_files_groupownership" selected="true" />
 <select idref="userowner_rsyslog_files" selected="true" />
 <select idref="rsyslog_send_messages_to_logserver" selected="true" />
 <select idref="rsyslog_accept_remote_messages_none" selected="true" />
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index ffe05c0..c0a5160 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -144,7 +144,7 @@ protected from unauthorized access.</rationale>
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="groupowner_rsyslog_files" severity="medium">
+<Rule id="rsyslog_files_groupownership" severity="medium">
 <title>Ensure Log Files Are Owned By Appropriate Group</title>
 <description>The group-owner of all log files written by
 <tt>rsyslog</tt> should be root.
-- 
1.7.1



More information about the scap-security-guide mailing list