[PATCH] [Fedora] OVAL checks for file_ownership_library_dirs, file_permissions_binary_dirs, and file_ownership_binary_dirs

Jan Lieskovsky jlieskov at redhat.com
Mon Dec 9 11:49:38 UTC 2013


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Sunday, December 8, 2013 8:21:23 PM
> Subject: Re: [PATCH] [Fedora] OVAL checks for file_ownership_library_dirs,	file_permissions_binary_dirs, and
> file_ownership_binary_dirs
> 
> On 12/6/13, 12:20 PM, Jan Lieskovsky wrote:
> 
> 
> 
> This patch adds the following to Fedora (all three are rewritten /
> simplified versions of existing RHEL-6 OVAL checks):
> * OVAL check for Verify that Shared Library Files Have Root Ownership
> * OVAL check for Verify that System Executables Have Restrictive Permissions
> * OVAL check for Verify that System Executables Have Root Ownership
> 
> While all three from the provided OVAL checks could be placed into shared
> directory, for now will keep them under Fedora input directory till
> there's support for XSLT platform rewrite transformation in shared etc.
> 
> When their times come, they can be moved to shared together with
> platforms attestations (past testing on RHEL-6 too).
> 
> Passed basic sanity testing on Fedora.
> 
> Please review (mainly if existing RHEL-6 ones could be
> possibly replaced with these).
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> Ack.

Thanks, Shawn.

> 
> I applied this locally, copied the OVAL into shared/, rm'd the RHEL6 version,
> soft linked shared into RHEL6/input/checks, then updated the platform tag to
> be:
> 
> 
> <affected family="unix">
> <platform>Fedora 19</platform>
> <platform>Red Hat Enterprise Linux 6</platform>
> </affected>

Yes, this is another way we could go instead of doing automated XSLT transform --
have platform fixed for RHEL6 (and upcoming RHEL 7) and latest Fedora (this
would require a patch once per half year updating it).

> 
> Ran 'make content' on RHEL6, and the scan worked correctly. IMO there's no
> need to wait until the XSLT is complete as this could get us moving forward.
> Don't particularly have a strong opinion on it though, so whatever you think
> is best!

Yeah, tested on RHEL-6 too, and they worked. So pushed to shared directory:
  https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=a51845ed0240542457cf1aafe2228b577b37d3c6

For now added only Fedora 19 as platform (RHEL6 will be added post the RHEL-6
RPM build enhanced and scripts equipped with attestations).

Right now need to focus on preparing new Fedora releases, but as soon as
they are done, will have a look on enhancing shared functionality (for
now we could go with multiple platform rows, and add just for presence
of attestations during the build).

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> 
> 
> 
> 
> 
> 
> 0001-Fedora-Add-OVAL-check-for-Verify-that-Shared-Library.patch
> From 02e08662c6d02f58e6a053492f87c436eb5b851a Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Fri, 6 Dec 2013 17:52:25
> +0100
> Subject: [PATCH] [Fedora] Add OVAL check for Verify that Shared Library Files
>  Have Root Ownership [Fedora] Add OVAL check for Verify that System
>  Executables Have Restrictive Permissions [Fedora] Add OVAL check for Verify
>  that System Executables Have Root Ownership
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  Fedora/input/checks/file_ownership_binary_dirs.xml | 47
>  ++++++++++++++++++++++
>  .../input/checks/file_ownership_library_dirs.xml   | 45
>  +++++++++++++++++++++
>  .../input/checks/file_permissions_binary_dirs.xml  | 40 ++++++++++++++++++
>  Fedora/input/system/permissions/files.xml          |  6 +--
>  Fedora/scap-security-guide.spec                    |  7 +++-
>  5 files changed, 141 insertions(+), 4 deletions(-)
>  create mode 100644 Fedora/input/checks/file_ownership_binary_dirs.xml
>  create mode 100644 Fedora/input/checks/file_ownership_library_dirs.xml
>  create mode 100644 Fedora/input/checks/file_permissions_binary_dirs.xml
> 
> diff --git a/Fedora/input/checks/file_ownership_binary_dirs.xml
> b/Fedora/input/checks/file_ownership_binary_dirs.xml
> new file mode 100644
> index 0000000..b6d0eec
> --- /dev/null
> +++ b/Fedora/input/checks/file_ownership_binary_dirs.xml
> @@ -0,0 +1,47 @@
> +<def-group>
> +  <definition class="compliance" id="file_ownership_binary_dirs"
> version="1">
> +    <metadata>
> +      <title>Verify that System Executables Have Root Ownership</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>
> +        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
> +        /usr/local/sbin, and objects therein, are owned by root.
> +      </description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion test_ref="test_ownership_binary_directories" />
> +      <criterion test_ref="test_ownership_binary_files" />
> +    </criteria>
> +  </definition>
> +
> +  <unix:file_test  check="all" check_existence="none_exist" comment="binary
> directories uid root" id="test_ownership_binary_directories" version="1">
> +    <unix:object object_ref="object_file_ownership_binary_directories" />
> +  </unix:file_test>
> +
> +  <unix:file_test  check="all" check_existence="none_exist" comment="binary
> files uid root" id="test_ownership_binary_files" version="1">
> +    <unix:object object_ref="object_file_ownership_binary_files" />
> +  </unix:file_test>
> +
> +  <unix:file_object comment="binary directories"
> id="object_file_ownership_binary_directories" version="1">
> +    <!-- Check that /bin, /sbin, /usr/sbin, /usr/sbin, /usr/local/bin, and
> +         /usr/local/sbin directories belong to user with uid 0 (root) -->
> +    <unix:path operation="pattern match">^\/( | s)bin |
> ^\/usr\/(|local\/)(|s)bin</unix:path>
> +    <unix:filename xsi:nil="true" />
> +    <filter action="include">state_owner_binaries_not_root</filter>
> +  </unix:file_object>
> +
> +  <unix:file_object comment="binary files"
> id="object_file_ownership_binary_files" version="1">
> +    <!-- Check that files within /bin, /sbin, /usr/bin, /usr/sbin,
> /usr/local/bin, and
> +         /usr/local/sbin directories belong to user with uid 0 (root) -->
> +    <unix:path operation="pattern match">^\/( | s)bin |
> ^\/usr\/(|local\/)(|s)bin</unix:path>
> +    <unix:filename operation="pattern match">^.*$</unix:filename>
> +   <filter action="include">state_owner_binaries_not_root</filter>
> +  </unix:file_object>
> +
> +  <unix:file_state id="state_owner_binaries_not_root" version="1"
> operator="OR">
> +    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
> +  </unix:file_state>
> +
> +</def-group>
> diff --git a/Fedora/input/checks/file_ownership_library_dirs.xml
> b/Fedora/input/checks/file_ownership_library_dirs.xml
> new file mode 100644
> index 0000000..09c408e
> --- /dev/null
> +++ b/Fedora/input/checks/file_ownership_library_dirs.xml
> @@ -0,0 +1,45 @@
> +<def-group>
> +  <definition class="compliance" id="file_ownership_library_dirs"
> version="1">
> +    <metadata>
> +      <title>Verify that Shared Library Files Have Root Ownership</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>
> +        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
> +        objects therein, are owned by root.
> +      </description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion test_ref="test_ownership_lib_dir" />
> +      <criterion test_ref="test_ownership_lib_files" />
> +    </criteria>
> +  </definition>
> +
> +  <unix:file_test  check="all" check_existence="none_exist" comment="library
> directories uid root" id="test_ownership_lib_dir" version="1">
> +    <unix:object object_ref="object_file_ownership_lib_dir" />
> +  </unix:file_test>
> +
> +  <unix:file_test  check="all" check_existence="none_exist" comment="library
> files uid root" id="test_ownership_lib_files" version="1">
> +    <unix:object object_ref="object_file_ownership_lib_files" />
> +  </unix:file_test>
> +
> +  <unix:file_object comment="library directories"
> id="object_file_ownership_lib_dir" version="1">
> +    <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories
> belong to user with uid 0 (root) -->
> +    <unix:path operation="pattern
> match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
> +    <unix:filename xsi:nil="true" />
> +    <filter action="include">state_owner_libraries_not_root</filter>
> +  </unix:file_object>
> +
> +  <unix:file_object comment="library files"
> id="object_file_ownership_lib_files" version="1">
> +    <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64
> directories belong to user with uid 0 (root) -->
> +    <unix:path operation="pattern
> match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
> +    <unix:filename operation="pattern match">^.*$</unix:filename>
> +   <filter action="include">state_owner_libraries_not_root</filter>
> +  </unix:file_object>
> +
> +  <unix:file_state id="state_owner_libraries_not_root" version="1">
> +    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
> +  </unix:file_state>
> +
> +</def-group>
> diff --git a/Fedora/input/checks/file_permissions_binary_dirs.xml
> b/Fedora/input/checks/file_permissions_binary_dirs.xml
> new file mode 100644
> index 0000000..22e5a39
> --- /dev/null
> +++ b/Fedora/input/checks/file_permissions_binary_dirs.xml
> @@ -0,0 +1,40 @@
> +<def-group>
> +  <definition class="compliance" id="file_permissions_binary_dirs"
> version="1">
> +    <metadata>
> +      <title>Verify that System Executables Have Restrictive
> Permissions</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>
> +        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
> +        /usr/local/bin, and /usr/local/sbin, are not group-writable or
> world-writable.
> +      </description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion test_ref="test_perms_binary_files" />
> +    </criteria>
> +  </definition>
> +
> +  <unix:file_test check="all" check_existence="none_exist" comment="binary
> files go-w" id="test_perms_binary_files" version="1">
> +    <unix:object object_ref="object_file_permissions_binary_files" />
> +  </unix:file_test>
> +
> +  <unix:file_object comment="binary files"
> id="object_file_permissions_binary_files" version="1">
> +    <!-- Check that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
> /usr/local/bin,
> +         and /usr/local/sbin directories have safe permissions (go-w) -->
> +    <unix:path operation="pattern match">^\/( | s)bin |
> ^\/usr\/(|local\/)(|s)bin</unix:path>
> +    <unix:filename operation="pattern match">^.*$</unix:filename>
> +    <filter
> action="include">state_perms_binary_files_nogroupwrite_noworldwrite</filter>
> +    <filter action="exclude">state_perms_binary_files_symlink</filter>
> +  </unix:file_object>
> +
> +  <unix:file_state id="state_perms_binary_files_nogroupwrite_noworldwrite"
> version="1" operator="OR">
> +    <unix:gwrite datatype="boolean">true</unix:gwrite>
> +    <unix:owrite datatype="boolean">true</unix:owrite>
> +  </unix:file_state>
> +
> +  <unix:file_state id="state_perms_binary_files_symlink" version="1">
> +    <unix:type operation="equals">symbolic link</unix:type>
> +  </unix:file_state>
> +
> +</def-group>
> diff --git a/Fedora/input/system/permissions/files.xml
> b/Fedora/input/system/permissions/files.xml
> index a9bfd93..5d0e507 100644
> --- a/Fedora/input/system/permissions/files.xml
> +++ b/Fedora/input/system/permissions/files.xml
> @@ -55,7 +55,7 @@ space of processes (including privileged ones) or of the
> kernel itself at
>  runtime. Proper ownership is necessary to protect the integrity of the
>  system.
>  </rationale>
>  <ref nist="AC-6" disa="1499"/>
> -<!-- <oval id="file_ownership_library_dirs" /> -->
> +<oval id="file_ownership_library_dirs" />
>  </Rule>
>  
>  <Rule id="file_permissions_binary_dirs" severity="medium">
> @@ -78,7 +78,7 @@ services, and restrictive permissions are necessary to
> ensure execution of
>  these programs cannot be co-opted.
>  </rationale>
>  <ref nist="AC-6" disa="1499"/>
> -<!-- <oval id="file_permissions_binary_dirs" /> -->
> +<oval id="file_permissions_binary_dirs" />
>  </Rule>
>  
>  <Rule id="file_ownership_binary_dirs" severity="medium">
> @@ -100,7 +100,7 @@ than root, correct its ownership with the following
> command:
>  services, and restrictive permissions are necessary to ensure that their
>  execution of these programs cannot be co-opted.
>  </rationale>
> -<!-- <oval id="file_ownership_binary_dirs" /> -->
> +<oval id="file_ownership_binary_dirs" />
>  <ref nist="AC-6" disa="1499"/>
>  </Rule>
>  
> diff --git a/Fedora/scap-security-guide.spec
> b/Fedora/scap-security-guide.spec
> index 63057ec..e27fc53 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>  # file one level up - in the main scap-security-guide directory (instead of
>  # this one).
>  
> -%global	fedorassgversion	4.rc10
> +%global	fedorassgversion	4.rc11
>  
>  Name:		scap-security-guide
>  Version:	0.1.%{fedorassgversion}
> @@ -54,6 +54,11 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8
> %{buildroot}%{_mandir}/en/man
>  %doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html
>  
>  %changelog
> +* Fri Dec 06 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1.4.rc11-1
> +- OVAL check for Verify that Shared Library Files Have Root Ownership
> +- OVAL check for Verify that System Executables Have Restrictive Permissions
> +- OVAL check for Verify that System Executables Have Root Ownership
> +
>  * Thu Dec 05 2013 Jan iankko Lieskovsky <jlieskov at redhat.com> 0.1.4.rc10-1
>  - Shared OVAL check for Verify that Shared Library Files Have Restrictive
>    Permissions
> --
> 1.8.3.1
> 
> 
> --
> Shawn Wells
> Director, Innovation Programs shawn at redhat.com | 443.534.0130
> @shawndwells
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list