Rsyslog Permission Checks

Maura Dailey maura at eclipse.ncsc.mil
Tue Aug 13 21:08:32 UTC 2013


On 08/13/2013 03:36 PM, Shawn Wells wrote:
> On 8/13/13 3:25 PM, Maura Dailey wrote:
>> How do you think we should handle file owner and group permission 
>> checks on rsyslog files? Should we look for a predetermined list of 
>> files (trying to search for *.log is insufficient, since at the very 
>> least, /var/log/messages, /var/log/secure, and /var/log/maillog would 
>> get passed over)? Or should we try ninja regex to parse rsyslog.conf?
> I'm torn. The 'right way' would be regex ninja. However that's hard, 
> and has resulted in nothing getting done. Personally I'd rather have 
> *something* hard coded, then evolve into ninja regex.
>
> With that said.... your regex-foo is strong and perhaps you could hack 
> this out in 15min... ;)
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

LOL, no, my regex is not that great. I played around with it this 
morning and got as far as the following check, but I can't even imagine 
how to handle rsyslog.conf's templating. If we have a consensus, perhaps 
the best strategy is just to delete both rsyslog log permissions checks. 
I can submit a patch that will do that pretty quickly.

- Maura Dailey

<def-group>
   <definition class="compliance" id="rsyslog_files_groupownership" 
version="1">
     <metadata>
       <title>Confirm Existence and Permissions of System Log Files</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>All syslog log files should be owned by the 
appropriate group.</description>
     </metadata>
     <criteria>
       <criterion comment="Check if group root owns all syslog log 
files" test_ref="test_rsyslog_files_groupownership" />
     </criteria>
   </definition>

   <ind:textfilecontent54_object comment="Find all /var/log files in 
rsyslog.conf" id="rsyslog_files" version="1">
     <ind:path>/etc</ind:path>
     <ind:filename>rsyslog.conf</ind:filename>
     <ind:pattern operation="pattern 
match">^.*(\/var\/log\/.*)$</ind:pattern>
     <ind:instance operation="greater than or equal" 
datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>

   <local_variable comment="Build list of log files" datatype="string" 
id="var_rsyslog_files_groupownership" version="1" >
       <object_component item_field="subexpression" 
object_ref="rsyslog_files" />
   </local_variable>

   <unix:file_state id="state_rsyslog_files_groupownership" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>

   <unix:file_object comment="Examine permissions of list of log files" 
id="object_rsyslog_files_groupownership" version="1">
     <unix:filepath var_ref="var_rsyslog_files_groupownership" 
var_check="only one" />
   </unix:file_object>

   <unix:file_test check="all" check_existence="all_exist" 
id="test_rsyslog_files_groupownership" version="1" comment="Test to see 
if files in /var/log mentioned by rsyslog.conf have the correct group">
     <unix:object object_ref="object_rsyslog_files_groupownership" />
     <unix:state state_ref="state_rsyslog_files_groupownership" />
   </unix:file_test>
</def-group>


More information about the scap-security-guide mailing list