[PATCH 2/2] Request for review - OVAL for file_permissions_library_dirs - unix:file_state issues
Shawn Wells
shawn.d.wells at gmail.com
Sat Apr 20 03:26:17 UTC 2013
-------------- next part --------------
>From d11ffa5b587f3ec35122c7541d8affcf376f880f Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 19 Apr 2013 23:25:16 -0400
Subject: [PATCH 2/2] Request for review - OVAL for file_permissions_library_dirs - unix:file_state trouble
I've been staring at this for awhile, and can't figure out why the results constantly return false:
[root at rhel6 checks]# chmod -R 755 /lib/ /lib64/ /usr/lib/ /usr/lib64/ /lib/modules/
[root at rhel6 checks]# ./testcheck.py file_permissions_library_dirs.xml
Evaluating with OVAL tempfile : /tmp/file_ownership_etc_skelm9KJNG.xml
Definition oval:scap-security-guide.testing:def:100: false
Evaluation done.
Anyone have ideas?
---
.../input/checks/file_permissions_library_dirs.xml | 149 ++++++++++++++++++++
RHEL6/input/system/permissions/files.xml | 1 +
2 files changed, 150 insertions(+), 0 deletions(-)
create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml
diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml b/RHEL6/input/checks/file_permissions_library_dirs.xml
new file mode 100644
index 0000000..0cbe682
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_library_dirs.xml
@@ -0,0 +1,149 @@
+<def-group>
+ <definition class="compliance" id="file_ownership_etc_skel" version="1">
+ <metadata>
+ <title>Verify that Shared Library Files Have Restrictive Permissions</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable
+ or world-writable.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion test_ref="test_perms_lib_dir" />
+ <criterion test_ref="test_perms_lib64_dir" />
+ <criterion test_ref="test_perms_usr_lib_dir" />
+ <criterion test_ref="test_perms_usr_lib64_dir" />
+ <criterion test_ref="test_perms_lib_modules_dir" />
+ <criterion test_ref="test_perms_lib_files" />
+ <criterion test_ref="test_perms_lib64_files" />
+ <criterion test_ref="test_perms_usr_lib_files" />
+ <criterion test_ref="test_perms_usr_lib64_files" />
+ <criterion test_ref="test_perms_lib_modules_files" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib directories go-w" id="test_perms_lib_dir" version="1">
+ <unix:object object_ref="object_lib_dir" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib files go-w" id="test_perms_lib_files" version="1">
+ <unix:object object_ref="object_lib_files" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib directories" id="object_lib_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib files" id="object_lib_files" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib64 directories go-w" id="test_perms_lib64_dir" version="1">
+ <unix:object object_ref="object_lib64_dir" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib64 files go-w" id="test_perms_lib64_files" version="1">
+ <unix:object object_ref="object_lib64_files" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib64 directories" id="object_lib64_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib64</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib64 files" id="object_lib64_files" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib64</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir" version="1">
+ <unix:object object_ref="object_usr_lib_dir" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib files go-w" id="test_perms_usr_lib_files" version="1">
+ <unix:object object_ref="object_usr_lib_files" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_object comment="/usr/lib directories" id="object_usr_lib_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/usr/lib files" id="object_usr_lib_files" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir" version="1">
+ <unix:object object_ref="object_usr_lib64_dir" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files" version="1">
+ <unix:object object_ref="object_usr_lib64_files" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_object comment="/usr/lib64 directories" id="object_usr_lib64_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib64</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/usr/lib64 files" id="object_usr_lib64_files" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/usr/lib64</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules directories go-w" id="test_perms_lib_modules_dir" version="1">
+ <unix:object object_ref="object_lib_modules_dir" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules files go-w" id="test_perms_lib_modules_files" version="1">
+ <unix:object object_ref="object_lib_modules_files" />
+ <unix:state state_ref="state_perms_nogroupwrite_noworldwrite" />
+ </unix:file_test>
+
+ <unix:file_object comment="/lib/modules directories" id="object_lib_modules_dir" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib/modules</unix:path>
+ <unix:filename xsi:nil="true" />
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_object comment="/lib/modules files" id="object_lib_modules_files" version="1">
+ <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+ <unix:path operation="equals">/lib/modules</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
+ <unix:gwrite datatype="boolean">true</unix:gwrite>
+ <unix:owrite datatype="boolean">true</unix:owrite>
+ </unix:file_state>
+</def-group>
diff --git a/RHEL6/input/system/permissions/files.xml b/RHEL6/input/system/permissions/files.xml
index 21af4ea..1085fce 100644
--- a/RHEL6/input/system/permissions/files.xml
+++ b/RHEL6/input/system/permissions/files.xml
@@ -216,6 +216,7 @@ runtime. Restrictive permissions are necessary to protect the integrity of the s
</rationale>
<ref nist="AC-6" disa="1499"/>
<tested by="DS" on="20121026"/>
+<oval id="file_permissions_library_dirs" />
</Rule>
<Rule id="file_ownership_library_dirs" severity="medium">
--
1.7.1
More information about the scap-security-guide
mailing list