Rsyslog Permission Checks

Kurt Seifried kseifried at redhat.com
Tue Aug 13 23:18:42 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/13/2013 03:08 PM, Maura Dailey wrote:
> On 08/13/2013 03:36 PM, Shawn Wells wrote:
>> On 8/13/13 3:25 PM, Maura Dailey wrote:
>>> How do you think we should handle file owner and group
>>> permission checks on rsyslog files? Should we look for a
>>> predetermined list of files (trying to search for *.log is
>>> insufficient, since at the very least, /var/log/messages,
>>> /var/log/secure, and /var/log/maillog would get passed over)?
>>> Or should we try ninja regex to parse rsyslog.conf?
>> I'm torn. The 'right way' would be regex ninja. However that's
>> hard, and has resulted in nothing getting done. Personally I'd
>> rather have *something* hard coded, then evolve into ninja
>> regex.
>> 
>> With that said.... your regex-foo is strong and perhaps you could
>> hack this out in 15min... ;) 
>> _______________________________________________ 
>> scap-security-guide mailing list 
>> scap-security-guide at lists.fedorahosted.org 
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>> 
> LOL, no, my regex is not that great. I played around with it this 
> morning and got as far as the following check, but I can't even
> imagine how to handle rsyslog.conf's templating. If we have a
> consensus, perhaps the best strategy is just to delete both rsyslog
> log permissions checks. I can submit a patch that will do that
> pretty quickly.
> 
> - Maura Dailey
> 

Not to be a Debbie Downer but you forgot:

/etc/rsyslog.d/*

e.g.: /etc/rsyslog.d/spice-vdagentd.conf :

# A template to for higher precision timestamps + severity logging
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
%syslogtag%
%syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

:programname, startswith, "spice-vdagent"
/var/log/spice-vdagent.log;SpiceTmpl





- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJSCr7RAAoJEBYNRVNeJnmTSaoP+wfXA2BWYMpK37FFjqrk8nWF
4aBVyENJc5TscauFwkREN757bxTqZFsQiLVY0lSz1vkNElXKVCodLGb/48xrAG8c
dsErzFNIC30O73RSrodJPIjG+oRNRtr01XEJQ4gyEz4huJBvZ8c7O6JByf/WQtX3
lrT2zA/jRtxgp2OfETYwJxu4cKCrV3WcoLEnyYKDJ30coiM7dVPNXTaud/Bf5DvR
73r7JzwEZQJ5W4Le2IyqZYAFRK6rw4zmMjTcONl7nzG3hzBftu6pVQF6os/kaAMC
LZIlXPNi7aWOLYFjRq7wPIXfmEiV4M+r6LIL1Pf17sohAUbKMROk5yhHkX0Hl4bs
2rBZxXwY7G4Qhp/psETdmqbQkM3O3Ic8ywnATFYggkZqJNIXzXMStDO9tT0rMTba
dBBL3swug5g7j1j5r15gkpfmMrT7xc7VpMLywBNdlLv4nMLcnqxJIB25F1JR7eF9
d7HRt88qfGU0SJ2sUjfxJtLgsFeZw/queRp1ebPq/X8f+tzcTI9BKQUodaXXDwny
w032wvdSANNk3MNlGNGzwXrsmZV73FeM+y+m+m8rycCk/IymPJ3ak9O8GCBHzBwk
/iPQSeL0vaLTw9r0UmVKCIPQdfm5h+IY2CAilpMmtRk6bjBZ7UcL85aMqDjHxSj9
FcCYT5DK8We9cEx0uXg6
=xJ8s
-----END PGP SIGNATURE-----


More information about the scap-security-guide mailing list