Rsyslog Permission Checks

Maura Dailey maura at eclipse.ncsc.mil
Tue Aug 13 23:24:25 UTC 2013


On 08/13/2013 07:18 PM, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/13/2013 03:08 PM, Maura Dailey wrote:
>> On 08/13/2013 03:36 PM, Shawn Wells wrote:
>>> On 8/13/13 3:25 PM, Maura Dailey wrote:
>>>> How do you think we should handle file owner and group
>>>> permission checks on rsyslog files? Should we look for a
>>>> predetermined list of files (trying to search for *.log is
>>>> insufficient, since at the very least, /var/log/messages,
>>>> /var/log/secure, and /var/log/maillog would get passed over)?
>>>> Or should we try ninja regex to parse rsyslog.conf?
>>> I'm torn. The 'right way' would be regex ninja. However that's
>>> hard, and has resulted in nothing getting done. Personally I'd
>>> rather have *something* hard coded, then evolve into ninja
>>> regex.
>>>
>>> With that said.... your regex-foo is strong and perhaps you could
>>> hack this out in 15min... ;)
>>> _______________________________________________
>>> scap-security-guide mailing list
>>> scap-security-guide at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> LOL, no, my regex is not that great. I played around with it this
>> morning and got as far as the following check, but I can't even
>> imagine how to handle rsyslog.conf's templating. If we have a
>> consensus, perhaps the best strategy is just to delete both rsyslog
>> log permissions checks. I can submit a patch that will do that
>> pretty quickly.
>>
>> - Maura Dailey
>>
> Not to be a Debbie Downer but you forgot:
>
> /etc/rsyslog.d/*
>
> e.g.: /etc/rsyslog.d/spice-vdagentd.conf :
>
> # A template to for higher precision timestamps + severity logging
> $template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
> %syslogtag%
> %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
>
> :programname, startswith, "spice-vdagent"
> /var/log/spice-vdagent.log;SpiceTmpl
>

Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't there. 
The point is that the check I wrote in my last email isn't complete. I'm 
voting for deleting both the rsyslog permission checks.

- Maura Dailey

>
>
>
> - -- 
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
>
> iQIcBAEBAgAGBQJSCr7RAAoJEBYNRVNeJnmTSaoP+wfXA2BWYMpK37FFjqrk8nWF
> 4aBVyENJc5TscauFwkREN757bxTqZFsQiLVY0lSz1vkNElXKVCodLGb/48xrAG8c
> dsErzFNIC30O73RSrodJPIjG+oRNRtr01XEJQ4gyEz4huJBvZ8c7O6JByf/WQtX3
> lrT2zA/jRtxgp2OfETYwJxu4cKCrV3WcoLEnyYKDJ30coiM7dVPNXTaud/Bf5DvR
> 73r7JzwEZQJ5W4Le2IyqZYAFRK6rw4zmMjTcONl7nzG3hzBftu6pVQF6os/kaAMC
> LZIlXPNi7aWOLYFjRq7wPIXfmEiV4M+r6LIL1Pf17sohAUbKMROk5yhHkX0Hl4bs
> 2rBZxXwY7G4Qhp/psETdmqbQkM3O3Ic8ywnATFYggkZqJNIXzXMStDO9tT0rMTba
> dBBL3swug5g7j1j5r15gkpfmMrT7xc7VpMLywBNdlLv4nMLcnqxJIB25F1JR7eF9
> d7HRt88qfGU0SJ2sUjfxJtLgsFeZw/queRp1ebPq/X8f+tzcTI9BKQUodaXXDwny
> w032wvdSANNk3MNlGNGzwXrsmZV73FeM+y+m+m8rycCk/IymPJ3ak9O8GCBHzBwk
> /iPQSeL0vaLTw9r0UmVKCIPQdfm5h+IY2CAilpMmtRk6bjBZ7UcL85aMqDjHxSj9
> FcCYT5DK8We9cEx0uXg6
> =xJ8s
> -----END PGP SIGNATURE-----



More information about the scap-security-guide mailing list