[PATCH 2/5] Fixed rsyslog_files_ownership OVAL

Shawn Wells shawn.d.wells at gmail.com
Sun Apr 14 08:04:24 UTC 2013


-------------- next part --------------
>From e93a48578a4763fd8491b5c6eae42afda441f433 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 14 Apr 2013 03:48:22 -0400
Subject: [PATCH 2/5] Fixed rsyslog_files_ownership OVAL
 - Descriptions were wrong, updated to reflect /var/log checking
 - Updated file pattern match, as not all logfiles within /var/log end in *.log!

Before Change:
$ sudo sh -c "chown shawn /var/log/messages"
$ ./testcheck.py rsyslog_files_ownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_ownershipUr9KWm.xml
Definition oval:scap-security-guide.testing:def:104: true
Evaluation done.

After Change:
$ sudo sh -c "chown shawn /var/log/messages"
$ ./testcheck.py rsyslog_files_ownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_ownershipvFE2iM.xml
Definition oval:scap-security-guide.testing:def:104: false
Evaluation done.
$ sudo sh -c "chown -R root /var/log/"
$ ./testcheck.py rsyslog_files_ownership.xml
Evaluating with OVAL tempfile : /tmp/rsyslog_files_ownershipFdQB3H.xml
Definition oval:scap-security-guide.testing:def:104: true
Evaluation done.
---
 RHEL6/input/checks/rsyslog_files_ownership.xml |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/RHEL6/input/checks/rsyslog_files_ownership.xml b/RHEL6/input/checks/rsyslog_files_ownership.xml
index 05bc20e..937dbe8 100644
--- a/RHEL6/input/checks/rsyslog_files_ownership.xml
+++ b/RHEL6/input/checks/rsyslog_files_ownership.xml
@@ -7,21 +7,21 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>All syslog log files should be owned by the
-      appropriate user.</description>
+      root user.</description>
     </metadata>
     <criteria>
-      <criterion comment="check if group root owns all syslog log files" test_ref="test_rsyslog_files_ownership" />
+      <criterion comment="check if user root owns all syslog log files" test_ref="test_rsyslog_files_ownership" />
     </criteria>
   </definition>
 
-  <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub/grub.conf owned by root" id="test_rsyslog_files_ownership" version="1">
+  <unix:file_test check="all" check_existence="all_exist" comment="/var/log/ log files owned by root" id="test_rsyslog_files_ownership" version="1">
     <unix:object object_ref="object_rsyslog_files_ownership" />
     <unix:state state_ref="state_rsyslog_files_ownership" />
   </unix:file_test>
 
-  <unix:file_object comment="/boot/grub/grub.conf" id="object_rsyslog_files_ownership" version="1">
+  <unix:file_object comment="/var/log/ log files owned by root" id="object_rsyslog_files_ownership" version="1">
     <unix:path>/var/log</unix:path>
-    <unix:filename operation="pattern match">.*log</unix:filename>
+    <unix:filename operation="pattern match">.</unix:filename>
     <!-- <filter action="exclude">state_rsyslog_files_ownership</filter> -->
   </unix:file_object>
 
-- 
1.7.1



More information about the scap-security-guide mailing list