[PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files
Shawn Wells
shawn.d.wells at gmail.com
Sun Apr 14 08:04:17 UTC 2013
-------------- next part --------------
>From 7178840030a743f77c3ecacb50403a1c5972675e Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 14 Apr 2013 03:43:26 -0400
Subject: [PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files
- Changed XCCDF name to rsyslog_files_groupownership, to stay compliant with naming scheme
for other rsyslog_* rules
- Updated file pattern match to '.', as not all log files have a *.log syntax
Testing:
[shawn at rhel6 checks]$ sudo sh -c "chgrp -R root /var/log"
[shawn at rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownershipvDb8cx.xml
Definition oval:scap-security-guide.testing:def:100: true
Evaluation done.
[shawn at rhel6 checks]$ sudo sh -c "chgrp shawn /var/log/messages"
[shawn at rhel6 checks]$ ./testcheck.py rsyslog_files_groupownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_groupownership5hwL0x.xml
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
---
RHEL6/input/auxiliary/alt-titles-stig.xml | 2 +-
RHEL6/input/auxiliary/stig_overlay.xml | 2 +-
.../input/checks/rsyslog_files_groupownership.xml | 24 ++++++++++++++-----
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL6/input/system/logging.xml | 2 +-
7 files changed, 23 insertions(+), 13 deletions(-)
diff --git a/RHEL6/input/auxiliary/alt-titles-stig.xml b/RHEL6/input/auxiliary/alt-titles-stig.xml
index d4a9cf0..fab8b62 100644
--- a/RHEL6/input/auxiliary/alt-titles-stig.xml
+++ b/RHEL6/input/auxiliary/alt-titles-stig.xml
@@ -344,7 +344,7 @@ The system's system logging services must be enabled.
<title rule="userowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate User">
All rsyslog-generated log files must be owned by root.
</title>
-<title rule="groupowner_rsyslog_files" shorttitle="Ensure Log Files Are Owned By Appropriate Group">
+<title rule="rsyslog_files_groupownership" shorttitle="Ensure Log Files Are Owned By Appropriate Group">
All rsyslog-generated log files must be group-owned by root.
</title>
<title rule="rsyslog_file_permissions" shorttitle="Ensure System Log Files Have Correct Permissions">
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 2c553bd..2e0b5b4 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -297,7 +297,7 @@
<overlay owner="disastig" ruleid="userowner_rsyslog_files" ownerid="RHEL-06-000133" disa="1314" severity="medium">
<title>All rsyslog-generated log files must be owned by root.</title>
</overlay>
- <overlay owner="disastig" ruleid="groupowner_rsyslog_files" ownerid="RHEL-06-000134" disa="1314" severity="medium">
+ <overlay owner="disastig" ruleid="rsyslog_files_groupownership" ownerid="RHEL-06-000134" disa="1314" severity="medium">
<title>All rsyslog-generated log files must be group-owned by root.</title>
</overlay>
<overlay owner="disastig" ruleid="rsyslog_file_permissions" ownerid="RHEL-06-000135" disa="1314" severity="medium">
diff --git a/RHEL6/input/checks/rsyslog_files_groupownership.xml b/RHEL6/input/checks/rsyslog_files_groupownership.xml
index 729f4b2..c28b257 100644
--- a/RHEL6/input/checks/rsyslog_files_groupownership.xml
+++ b/RHEL6/input/checks/rsyslog_files_groupownership.xml
@@ -1,6 +1,5 @@
<def-group>
- <definition class="compliance"
- id="rsyslog_files_groupownership" version="1">
+ <definition class="compliance" id="rsyslog_files_groupownership" version="1">
<metadata>
<title>Confirm Existence and Permissions of System Log
Files</title>
@@ -11,11 +10,22 @@
appropriate group.</description>
</metadata>
<criteria>
- <criterion comment="check if group root owns all syslog log files"
- test_ref="test_20155" />
+ <criterion comment="check if group root owns all syslog log files" test_ref="test_rsyslog_files_groupownership" />
</criteria>
</definition>
- <ind:unknown_test check="all"
- comment="use extended content to evaluated this test"
- id="test_20155" version="1" />
+
+ <unix:file_test check="all" check_existence="all_exist" comment="syslog files owned by group root" id="test_rsyslog_files_groupownership" version="1">
+ <unix:object object_ref="object_rsyslog_files_groupownership" />
+ <unix:state state_ref="state_rsyslog_files_groupownership" />
+ </unix:file_test>
+
+ <unix:file_object comment="syslog files owned by root" id="object_rsyslog_files_groupownership" version="1">
+ <unix:path>/var/log</unix:path>
+ <unix:filename operation="pattern match">.</unix:filename>
+ <!-- <filter action="exclude">state_rsyslog_files_groupownership</filter> -->
+ </unix:file_object>
+
+ <unix:file_state id="state_rsyslog_files_groupownership" version="1">
+ <unix:group_id datatype="int">0</unix:group_id>
+ </unix:file_state>
</def-group>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 2a7565a..48a0358 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -102,7 +102,7 @@
<select idref="service_rsyslog_enabled" selected="true"/>
<select idref="userowner_rsyslog_files" selected="true"/>
-<select idref="groupowner_rsyslog_files" selected="true"/>
+<select idref="rsyslog_files_groupownership" selected="true"/>
<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver" selected="true"/>
<select idref="ensure_logrotate_activated" selected="true"/>
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index e092650..171c183 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -158,7 +158,7 @@ assurance."</description>
<select idref="set_daemon_umask" selected="true" \>
<select idref="no_uidzero_except_root" selected="true" \>
<select idref="userowner_rsyslog_files" selected="true" \>
-<select idref="groupowner_rsyslog_files" selected="true" \>
+<select idref="rsyslog_files_groupownership" selected="true" \>
<!-- AC-6(2) -->
<select idref="restrict_root_console_logins" selected="true" \>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index af95ac2..bce3d12 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -164,7 +164,7 @@
<select idref="package_rsyslog_installed" selected="true" />
<select idref="service_rsyslog_enabled" selected="true" />
<select idref="rsyslog_file_permissions" selected="true" />
-<select idref="groupowner_rsyslog_files" selected="true" />
+<select idref="rsyslog_files_groupownership" selected="true" />
<select idref="userowner_rsyslog_files" selected="true" />
<select idref="rsyslog_send_messages_to_logserver" selected="true" />
<select idref="rsyslog_accept_remote_messages_none" selected="true" />
diff --git a/RHEL6/input/system/logging.xml b/RHEL6/input/system/logging.xml
index ffe05c0..c0a5160 100644
--- a/RHEL6/input/system/logging.xml
+++ b/RHEL6/input/system/logging.xml
@@ -144,7 +144,7 @@ protected from unauthorized access.</rationale>
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="groupowner_rsyslog_files" severity="medium">
+<Rule id="rsyslog_files_groupownership" severity="medium">
<title>Ensure Log Files Are Owned By Appropriate Group</title>
<description>The group-owner of all log files written by
<tt>rsyslog</tt> should be root.
--
1.7.1
More information about the scap-security-guide
mailing list