Rsyslog Permission Checks

Maura Dailey maura at eclipse.ncsc.mil
Wed Aug 14 15:26:04 UTC 2013


On 08/13/2013 07:29 PM, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 08/13/2013 05:24 PM, Maura Dailey wrote:
>> On 08/13/2013 07:18 PM, Kurt Seifried wrote: On 08/13/2013 03:08
>> PM, Maura Dailey wrote:
>>>>> On 08/13/2013 03:36 PM, Shawn Wells wrote:
>>>>>> On 8/13/13 3:25 PM, Maura Dailey wrote:
>>>>>>> How do you think we should handle file owner and group
>>>>>>> permission checks on rsyslog files? Should we look for a
>>>>>>> predetermined list of files (trying to search for *.log
>>>>>>> is insufficient, since at the very least,
>>>>>>> /var/log/messages, /var/log/secure, and /var/log/maillog
>>>>>>> would get passed over)? Or should we try ninja regex to
>>>>>>> parse rsyslog.conf?
>>>>>> I'm torn. The 'right way' would be regex ninja. However
>>>>>> that's hard, and has resulted in nothing getting done.
>>>>>> Personally I'd rather have *something* hard coded, then
>>>>>> evolve into ninja regex.
>>>>>>
>>>>>> With that said.... your regex-foo is strong and perhaps you
>>>>>> could hack this out in 15min... ;)
>>>>>> _______________________________________________
>>>>>> scap-security-guide mailing list
>>>>>> scap-security-guide at lists.fedorahosted.org
>>>>>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> LOL, no, my regex is not that great. I played around with it this
>>>>> morning and got as far as the following check, but I can't
>>>>> even imagine how to handle rsyslog.conf's templating. If we
>>>>> have a consensus, perhaps the best strategy is just to delete
>>>>> both rsyslog log permissions checks. I can submit a patch
>>>>> that will do that pretty quickly.
>>>>>
>>>>> - Maura Dailey
>>>>>
>> Not to be a Debbie Downer but you forgot:
>>
>> /etc/rsyslog.d/*
>>
>> e.g.: /etc/rsyslog.d/spice-vdagentd.conf :
>>
>> # A template to for higher precision timestamps + severity logging
>> $template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds%
>> %syslogtag%
>> %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
>>
>>   :programname, startswith, "spice-vdagent"
>> /var/log/spice-vdagent.log;SpiceTmpl
>>
>>
>>> Meh, my /etc/rsyslog.d directory is empty. Can't miss what isn't
>>> there. The point is that the check I wrote in my last email isn't
>>> complete. I'm voting for deleting both the rsyslog permission
>>> checks.
>>> - Maura Dailey
> You can download the rpms and check their file listing/scripts for
> /etc/rsyslog* and whatnot content if you do want to find all instances
> of what Red Hat ships there.

I *could*, but that's hundreds of packages, which may or may not be 
installed on any given system. It also doesn't include packages that 
might be available through EPEL or configuration files that people code 
by hand. The real problem is detecting and resolving templating. If that 
hard problem is solved, any number of files in rsyslog.d could be 
vacuumed up. I don't think I'm the one to do it, since I'm about at the 
limit of my regex skills, and I'm skeptical that OVAL is up to the 
challenge either. (The rsyslog package doesn't include the file you 
referred to, according to rpm -ql. We don't run spice agent on our 
computers, which is no doubt why we don't have it.)

- Maura Dailey

>
>> _______________________________________________ scap-security-guide
>> mailing list scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
>
> iQIcBAEBAgAGBQJSCsFZAAoJEBYNRVNeJnmTrUUP/2wxg6GKKoUqVApYlS7UYK0n
> Fii05fhxbOqJ2Ugn5lwx1pLRsY0PCiM/VupQkzVYcNMUZAF3G2FE9TtzRBhs0qH4
> 0+2SJmLDp7Dn57Lyrc3LF865iPfYgv2fUJWEbMwT8W3G8l0QnhEGYqMGtaOV8C8O
> yIf699yQIZ6gebaoy05DYSs/WN44RO1bGmInKBm77JZno8rrU3rjoj7fHBPWDDWv
> aasRMY4M2PRz9GnHIhHu9Y2IKOUCJnbdjCnd74yz4Q1Cedp27QMFCNuXtLwpsejZ
> JW9XRe+5lakRu0LVEgZcPUS4PUReVI6gd3tKx4lUoJxA2baFkiHhXop8oROcqlEn
> NfoCtld5TR3UBvCUTUyR91IkTAMXyIGyHxKSzUOTuuKuSMX1SasR97rwtbOz9jEC
> xkT9fdepbjI6OFPRcOCv1Y3m64+ZUbnLKBMoNosmdZC9wkJXQ5jvoHhl9fBpWRl0
> GGxD7ekGwhlO3HLfov+d2Heyvp2LsbgqjhTbJImERPHvq0BXZixesjpmVvZljyho
> 6RfjT3XH7F9VyCJE5XPULQtv7ZX+m/7fJtmTRzYcGmkjlKhsHPH9WiDZZj64eXMT
> JTAm50Yl+99/hIp+2CwYApLcCVi2dpT7qo8kBPiP27oDoXS2cyM8FQu40aZ/2dpV
> 47ww9He6G5rH0T1JP0DX
> =OEgw
> -----END PGP SIGNATURE-----



More information about the scap-security-guide mailing list