Rsyslog Permission Checks
Maura Dailey
maura at eclipse.ncsc.mil
Tue Aug 13 21:08:32 UTC 2013
On 08/13/2013 03:36 PM, Shawn Wells wrote:
> On 8/13/13 3:25 PM, Maura Dailey wrote:
>> How do you think we should handle file owner and group permission
>> checks on rsyslog files? Should we look for a predetermined list of
>> files (trying to search for *.log is insufficient, since at the very
>> least, /var/log/messages, /var/log/secure, and /var/log/maillog would
>> get passed over)? Or should we try ninja regex to parse rsyslog.conf?
> I'm torn. The 'right way' would be regex ninja. However that's hard,
> and has resulted in nothing getting done. Personally I'd rather have
> *something* hard coded, then evolve into ninja regex.
>
> With that said.... your regex-foo is strong and perhaps you could hack
> this out in 15min... ;)
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
LOL, no, my regex is not that great. I played around with it this
morning and got as far as the following check, but I can't even imagine
how to handle rsyslog.conf's templating. If we have a consensus, perhaps
the best strategy is just to delete both rsyslog log permissions checks.
I can submit a patch that will do that pretty quickly.
- Maura Dailey
<def-group>
<definition class="compliance" id="rsyslog_files_groupownership"
version="1">
<metadata>
<title>Confirm Existence and Permissions of System Log Files</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>All syslog log files should be owned by the
appropriate group.</description>
</metadata>
<criteria>
<criterion comment="Check if group root owns all syslog log
files" test_ref="test_rsyslog_files_groupownership" />
</criteria>
</definition>
<ind:textfilecontent54_object comment="Find all /var/log files in
rsyslog.conf" id="rsyslog_files" version="1">
<ind:path>/etc</ind:path>
<ind:filename>rsyslog.conf</ind:filename>
<ind:pattern operation="pattern
match">^.*(\/var\/log\/.*)$</ind:pattern>
<ind:instance operation="greater than or equal"
datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<local_variable comment="Build list of log files" datatype="string"
id="var_rsyslog_files_groupownership" version="1" >
<object_component item_field="subexpression"
object_ref="rsyslog_files" />
</local_variable>
<unix:file_state id="state_rsyslog_files_groupownership" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="Examine permissions of list of log files"
id="object_rsyslog_files_groupownership" version="1">
<unix:filepath var_ref="var_rsyslog_files_groupownership"
var_check="only one" />
</unix:file_object>
<unix:file_test check="all" check_existence="all_exist"
id="test_rsyslog_files_groupownership" version="1" comment="Test to see
if files in /var/log mentioned by rsyslog.conf have the correct group">
<unix:object object_ref="object_rsyslog_files_groupownership" />
<unix:state state_ref="state_rsyslog_files_groupownership" />
</unix:file_test>
</def-group>
More information about the scap-security-guide
mailing list