[PATCH 1/2] OVAL check to find library files with permissions go+w

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Apr 23 22:24:20 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../input/checks/file_permissions_library_dirs.xml |  153 ++++++++++++++++++++
 1 files changed, 153 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/file_permissions_library_dirs.xml

diff --git a/RHEL6/input/checks/file_permissions_library_dirs.xml b/RHEL6/input/checks/file_permissions_library_dirs.xml
new file mode 100644
index 0000000..7e0a25a
--- /dev/null
+++ b/RHEL6/input/checks/file_permissions_library_dirs.xml
@@ -0,0 +1,153 @@
+<def-group>
+  <definition class="compliance" id="file_permissions_library_dirs" version="1">
+    <metadata>
+      <title>Verify that Shared Library Files Have Restrictive Permissions</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and objects therein, are not group-writable
+      or world-writable.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion test_ref="test_perms_lib_dir" />
+      <criterion test_ref="test_perms_lib64_dir" />
+      <criterion test_ref="test_perms_usr_lib_dir" />
+      <criterion test_ref="test_perms_usr_lib64_dir" />
+      <criterion test_ref="test_perms_lib_modules_dir" />
+      <criterion test_ref="test_perms_lib_files" />
+      <criterion test_ref="test_perms_lib64_files" />
+      <criterion test_ref="test_perms_usr_lib_files" />
+      <criterion test_ref="test_perms_usr_lib64_files" />
+      <criterion test_ref="test_perms_lib_modules_files" />
+    </criteria>
+  </definition>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib directories go-w" id="test_perms_lib_dir" version="1">
+    <unix:object object_ref="object_lib_dir" />
+  </unix:file_test>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib files go-w" id="test_perms_lib_files" version="1">
+    <unix:object object_ref="object_lib_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/lib directories" id="object_lib_dir" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/lib files" id="object_lib_files" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib64 directories go-w" id="test_perms_lib64_dir" version="1">
+    <unix:object object_ref="object_lib64_dir" />
+  </unix:file_test>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib64 files go-w" id="test_perms_lib64_files" version="1">
+    <unix:object object_ref="object_lib64_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/lib64 directories" id="object_lib64_dir" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib64</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/lib64 files" id="object_lib64_files" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib64</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib directories go-w" id="test_perms_usr_lib_dir" version="1">
+    <unix:object object_ref="object_usr_lib_dir" />
+  </unix:file_test>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib files go-w" id="test_perms_usr_lib_files" version="1">
+    <unix:object object_ref="object_usr_lib_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/lib directories" id="object_usr_lib_dir" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/lib</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/lib files" id="object_usr_lib_files" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/lib</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>  
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 directories go-w" id="test_perms_usr_lib64_dir" version="1">
+    <unix:object object_ref="object_usr_lib64_dir" />
+  </unix:file_test>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/usr/lib64 files go-w" id="test_perms_usr_lib64_files" version="1">
+    <unix:object object_ref="object_usr_lib64_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/usr/lib64 directories" id="object_usr_lib64_dir" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/lib64</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/usr/lib64 files" id="object_usr_lib64_files" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/usr/lib64</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules directories go-w" id="test_perms_lib_modules_dir" version="1">
+    <unix:object object_ref="object_lib_modules_dir" />
+  </unix:file_test>
+
+  <unix:file_test check="all" check_existence="none_exist" comment="/lib/modules files go-w" id="test_perms_lib_modules_files" version="1">
+    <unix:object object_ref="object_lib_modules_files" />
+  </unix:file_test>
+
+  <unix:file_object comment="/lib/modules directories" id="object_lib_modules_dir" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib/modules</unix:path>
+    <unix:filename xsi:nil="true" />
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_object comment="/lib/modules files" id="object_lib_modules_files" version="1">
+    <unix:behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
+    <unix:path operation="equals">/lib/modules</unix:path>
+    <unix:filename operation="pattern match">^.*$</unix:filename>
+    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
+    <filter action="exclude">state_symlink</filter>
+  </unix:file_object>
+
+  <unix:file_state id="state_symlink" version="1">
+    <unix:type operation="equals">symbolic link</unix:type>
+  </unix:file_state>
+
+  <unix:file_state id="state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
+    <unix:gwrite datatype="boolean">true</unix:gwrite>
+    <unix:owrite datatype="boolean">true</unix:owrite>
+  </unix:file_state>
+</def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list