[PATCH] [Fedora] Add OVAL check for Verify that Shared Library Files Have Restrictive Permissions

Shawn Wells shawn at redhat.com
Thu Dec 5 07:18:38 UTC 2013


On 12/4/13, 10:03 AM, Jan Lieskovsky wrote:
> This patch adds OVAL check for 'Verify that Shared Library Files Have Restrictive Permissions'
> rule for Fedora.
>
> It is a re-implementation / simplification against currently used RHEL-6 form:
>    [1]https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/checks/file_permissions_library_dirs.xml
>
> Instead of having dedicated tests for each of /lib, /lib64, /usr/lib && /usr/lib64
> directories (and checking based on 'equals' operation), it uses just one test
> for each of library permissions checks and files' permissions within those libraries
> check (and checks based on 'pattern match' operation).
>
> Passed basic sanity && regression testing.
>
> Please review (especially in relation with existing RHEL-6 form if
> we would like to use this proposal also for particular RHEL-6 OVAL check
> in the future).
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-Fedora-Add-OVAL-check-for-Verify-that-Shared-Library.patch
>
>
>  From 569de3bfcf8c65951b3b1c6ec4f59bd66511b367 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Wed, 4 Dec 2013 15:54:15 +0100
> Subject: [PATCH] [Fedora] Add OVAL check for Verify that Shared Library Files
>   Have Restrictive Permissions
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   .../input/checks/file_permissions_library_dirs.xml | 52 ++++++++++++++++++++++
>   Fedora/input/system/permissions/files.xml          |  2 +-
>   Fedora/scap-security-guide.spec                    |  1 +
>   3 files changed, 54 insertions(+), 1 deletion(-)
>   create mode 100644 Fedora/input/checks/file_permissions_library_dirs.xml
>
> diff --git a/Fedora/input/checks/file_permissions_library_dirs.xml b/Fedora/input/checks/file_permissions_library_dirs.xml
> new file mode 100644
> index 0000000..cce15a5
> --- /dev/null
> +++ b/Fedora/input/checks/file_permissions_library_dirs.xml
> @@ -0,0 +1,52 @@
> +<def-group>
> +  <definition class="compliance" id="file_permissions_library_dirs" version="1">
> +    <metadata>
> +      <title>Verify that Shared Library Files Have Restrictive Permissions</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>
> +        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
> +        objects therein, are not group-writable or world-writable.
> +      </description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion test_ref="test_perms_lib_dir" />
> +      <criterion test_ref="test_perms_lib_files" />
> +    </criteria>
> +  </definition>
> +
> +  <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="test_perms_lib_dir" version="1">
> +    <unix:object object_ref="object_file_permissions_lib_dir" />
> +  </unix:file_test>
> +
> +  <unix:file_test check="all" check_existence="none_exist" comment="library files go-w" id="test_perms_lib_files" version="1">
> +    <unix:object object_ref="object_file_permissions_lib_files" />
> +  </unix:file_test>
> +
> +  <unix:file_object comment="library directories" id="object_file_permissions_lib_dir" version="1">
> +    <!-- Check that /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
> +    <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
> +    <unix:filename xsi:nil="true" />
> +    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
> +    <filter action="exclude">perms_state_symlink</filter>
> +  </unix:file_object>
> +
> +  <unix:file_object comment="library files" id="object_file_permissions_lib_files" version="1">
> +    <!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
> +    <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
> +    <unix:filename operation="pattern match">^.*$</unix:filename>
> +    <filter action="include">state_perms_nogroupwrite_noworldwrite</filter>
> +    <filter action="exclude">perms_state_symlink</filter>
> +  </unix:file_object>
> +
> +  <unix:file_state id="state_perms_nogroupwrite_noworldwrite" version="1" operator="OR">
> +    <unix:gwrite datatype="boolean">true</unix:gwrite>
> +    <unix:owrite datatype="boolean">true</unix:owrite>
> +  </unix:file_state>
> +
> +  <unix:file_state id="perms_state_symlink" version="1">
> +    <unix:type operation="equals">symbolic link</unix:type>
> +  </unix:file_state>
> +
> +</def-group>
> diff --git a/Fedora/input/system/permissions/files.xml b/Fedora/input/system/permissions/files.xml
> index c15482c..a9bfd93 100644
> --- a/Fedora/input/system/permissions/files.xml
> +++ b/Fedora/input/system/permissions/files.xml
> @@ -30,7 +30,7 @@ runtime. Restrictive permissions are necessary to protect the integrity of the
>   system.
>   </rationale>
>   <ref nist="AC-6" disa="1499"/>
> -<!-- <oval id="file_permissions_library_dirs" /> -->
> +<oval id="file_permissions_library_dirs" />
>   </Rule>
>   
>   <Rule id="file_ownership_library_dirs" severity="medium">
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
> index cd3ff7e..356d024 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -56,6 +56,7 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
>   %changelog
>   * Mon Dec 02 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1.4.rc9-1
>   - Fix remediation for Disable Prelinking rule
> +- OVAL check for Verify that Shared Library Files Have Restrictive Permissions
>   
>   * Fri Nov 29 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1.4.rc8-1
>   - OVAL check and remediation for sshd's ClientAliveCountMax rule
> -- 1.8.3.1

This is much cleaner. Ack to the code.

Should we start the scap-security-guide/shared/oval/ directory now, 
instead of placing within Fedora/input/checks/ directly?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131205/b79aaee3/attachment.html>


More information about the scap-security-guide mailing list